A data fuzzy matching method, device and equipment

Abstract

The application provides a data fuzzy matching method, device and equipment, the method comprising: obtaining target matching data, and obtaining fuzzy matching data according to the target matching data; taking the first data bit of the fuzzy matching data as a current data bit, and taking the continuous K data bits starting from the current data bit as current matching data; querying the target leaf node corresponding to the current matching data from all leaf nodes of the established decision tree; selecting M data bits from the current matching data, and selecting M rule bits from the K rule bits; if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, performing the processing corresponding to the matching success based on the target matching data. Through the application scheme, the matching performance can be improved, and the matching time can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a data fuzzy matching method, device and equipment. BACKGROUND

[0002] A large number of fuzzy domain names are issued in the form of sub-strings on a security device (such as a firewall device). When the security device receives a DNS (Domain Name System) request message sent by a DNS server, the security device can parse a to-be-matched domain name and an IP address (i.e., an IP address corresponding to the to-be-matched domain name) from the DNS request message. If the to-be-matched domain name matches any fuzzy domain name, the IP address is stored. If the to-be-matched domain name fails to match all fuzzy domain names, the IP address is not stored. On this basis, the security device can take the stored IP address as a legal IP address, release a data message accessing the legal IP address, and discard a data message accessing an illegal IP address, thereby implementing access control of the data message.

[0003] For example, assuming that the fuzzy domain name includes a rule string "xiao", if the to-be-matched domain name includes a data string "xiaoyi", the data string "xiaoyi" matches the rule string "xiao". If the to-be-matched domain name includes a data string "xiamen", the data string "xiamen" does not match the rule string "xiao". Alternatively, assuming that the fuzzy domain name includes a rule string "xia", the data string "xiaoyi" and the data string "xiamen" both match the rule string "xia".

[0004] However, when a large number of fuzzy domain names are issued, the to-be-matched domain name needs to be matched with each fuzzy domain name in turn, and the matching time is very long, the matching performance is low, and the matching performance cannot meet actual requirements. SUMMARY

[0005] The present application provides a data fuzzy matching method, which comprises:

[0006] Obtaining target matching data, and obtaining fuzzy matching data according to the target matching data;

[0007] Taking a first data bit of the fuzzy matching data as a current data bit, and taking K continuous data bits starting from the current data bit as current to-be-matched data;

[0008] Querying a target leaf node corresponding to the current to-be-matched data from all leaf nodes of the established decision tree, the target leaf node being used to record a target matching rule and a target mask; wherein the target matching rule includes K rule bits, and the target mask is used to indicate that M rule bits in the K rule bits are exact matching bits.

[0009] selecting M data bits from the current to-be-matched data and selecting M rule bits from the K rule bits;

[0010] if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, performing a corresponding processing of matching success based on the target matching data;

[0011] if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, taking the next data bit of the current data bit as the current data bit, and repeatedly performing the operation of taking the continuous K data bits starting from the current data bit as the current to-be-matched data, selecting M data bits from the current to-be-matched data, and selecting M rule bits from the K rule bits, until the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits.

[0012] The application provides a data fuzzy matching device, which comprises:

[0013] a generating module configured to obtain target matching data, and obtain fuzzy matching data according to the target matching data; take the first data bit of the fuzzy matching data as a current data bit, and take the continuous K data bits starting from the current data bit as current to-be-matched data;

[0014] an obtaining module configured to query a target leaf node corresponding to the current to-be-matched data from all leaf nodes of an established decision tree, wherein the target leaf node is used to record a target matching rule and a target mask; the target matching rule comprises K rule bits, and the target mask is used to indicate that M rule bits in the K rule bits are used as accurate matching bits;

[0015] a determining module configured to select M data bits from the current to-be-matched data and select M rule bits from the K rule bits; if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, perform a corresponding processing of matching success based on the target matching data; if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, take the next data bit of the current data bit as the current data bit, and take the continuous K data bits starting from the current data bit as the current to-be-matched data by the generating module.

[0016] The application provides an electronic device, comprising a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor; the processor is used for executing the machine executable instructions to realize the data fuzzy matching method of the above examples of the application.

[0017] The application provides a computer program product, comprising a computer program, the computer program is executed by a processor to realize the data fuzzy matching method of the above examples of the application.

[0018] The application provides a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by a processor; wherein the processor is used for executing the machine executable instructions to realize the data fuzzy matching method of the above examples of the application.

[0019] From the above technical solutions, in the embodiment of the application, the target leaf node corresponding to the current to-be-matched data is queried from all leaf nodes of the decision tree, and the current to-be-matched data is matched with the target matching rule in the target leaf node, so that the current to-be-matched data is matched with all matching rules, thereby reducing the number of matches, improving the matching performance, reducing the matching time, and the matching performance can meet the actual demand. For example, even if there are tens of thousands of matching rules, only the current to-be-matched data and several matching rules in the target leaf node need to be matched, which greatly reduces the number of matches. In addition, the exact matching bit is indicated by the target mask, so that only the exact matching bit needs to be matched, further improving the matching performance and reducing the matching time. After splitting the target matching data and querying multiple times, the fuzzy matching of the exact matching field position can be realized, thereby significantly improving the performance of the fuzzy matching of the massive data of the exact matching field position, and the matching performance under the condition of massive rules can be significantly improved, the performance of the exact and fuzzy matching can be greatly improved, and the matching performance is more stable. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 is a flowchart of the data fuzzy matching method in an embodiment of the application;

[0021] Figure 2 is a flowchart of the decision tree construction method in an embodiment of the application;

[0022] Figure 3 is a schematic diagram of left alignment and continuous arrangement of the exact matching bit in an embodiment of the application;

[0023] Figure 4A is a schematic diagram of dividing the matching rule into leaf nodes in an embodiment of the application;

[0024] Figure 4B is a schematic diagram of dividing matching rules to leaf nodes in an embodiment of the present application;

[0025] Figure 4C is a schematic diagram of a four-level decision tree in an embodiment of the present application;

[0026] Figure 5A is a schematic diagram of a target mask in an embodiment of the present application;

[0027] Figure 5B is a schematic diagram of a two-level mask in an embodiment of the present application;

[0028] Figure 6 is a flowchart of a data fuzzy matching method in an embodiment of the present application;

[0029] Figure 7 is a schematic diagram of searching a leaf node in an embodiment of the present application;

[0030] Figure 8 is a schematic diagram of fuzzy matching data in an embodiment of the present application;

[0031] Figure 9A is a structural schematic diagram of a data fuzzy matching device in an embodiment of the present application;

[0032] Figure 9B is a hardware structure diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0033] A data fuzzy matching method is provided in the embodiments of the present application, which can be applied to an electronic device, which can be a security device (such as a firewall device, etc.) or a network device (such as a router, a switch, etc.). Referring to FIG. 1, a flowchart of the method is shown, which can include the following steps. Figure 1

[0034] In step 101, target matching data is obtained, and fuzzy matching data is obtained according to the target matching data. For example, the target matching data includes multiple data bits (such as accurate matching bits and special character bits), and the fuzzy matching data includes multiple data bits and padding bits.

[0035] In step 102, the first data bit of the fuzzy matching data is taken as a current data bit, and K continuous data bits starting from the current data bit are taken as current to-be-matched data.

[0036] ​Step 103, querying a target leaf node corresponding to the current to-be-matched data from all leaf nodes of the established decision tree, the target leaf node being used for recording a target matching rule and a target mask.

[0037] In one example, the target matching rule includes K rule bits, and the target mask is used for indicating M rule bits in the K rule bits as exact matching bits.

[0038] Step 104, selecting M data bits (such as selecting M data bits based on indication information of the target mask) from the current to-be-matched data, and selecting M rule bits (such as selecting M rule bits based on indication information of the target mask) from K rule bits (i.e., K rule bits of the target matching rule), and determining whether the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits. If yes, i.e., the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, step 105 can be executed, and if no, i.e., the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, step 106 can be executed.

[0039] Step 105, performing a processing corresponding to a matching success based on the target matching data. For example, obtaining an IP address corresponding to the target matching data from a DNS request packet, and storing the IP address in a security table item, so that a data packet accessing the IP address can pass through a security device, and access control of the data packet is realized.

[0040] Step 106, taking a next data bit of the current data bit as the current data bit, and repeatedly performing the operation of selecting M data bits from the current to-be-matched data and selecting M rule bits from K rule bits, starting from the current data bit and the continuous K data bits, until the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, i.e., stopping the repetition of steps 102-106.

[0041] In one example, obtaining the fuzzy matching data according to the target matching data can include but is not limited to: determining the number of padding bits based on the number of exact matching bits in the target matching data and the minimum effective length; wherein the minimum effective length is the minimum value of the effective lengths of all matching rules corresponding to the decision tree; adding the number of padding bits to the back of the target matching data to obtain the fuzzy matching data, wherein the padding bits are special character bits that do not appear in the target matching rule.

[0042] In an example, if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, the next data bit after the current data bit is taken as the current data bit, and it is further determined whether the matching number corresponding to the target matching data is the sum of the number and 1; wherein the initial value of the matching number corresponding to the target matching data is a preset value (such as 0). If not, the matching number corresponding to the target matching data is incremented by 1, and the next data bit after the current data bit is taken as the current data bit; if yes, the processing corresponding to the matching failure is performed based on the target matching data. For example, when the IP address corresponding to the target matching data is obtained from the DNS request message, the IP address is prohibited from being stored in the security table item, so that the data message accessing the IP address cannot pass through the security device.

[0043] In an example, before querying the target leaf node corresponding to the current to-be-matched data from all leaf nodes of the established decision tree, the establishment process of the decision tree can include but is not limited to: obtaining a plurality of matching rules, each of which can include K rule bits; based on the BSS value of each rule bit, the rule bit with the maximum BSS value is taken as the reference rule bit; based on the reference rule bit, all matching rules are divided into leaf nodes to obtain the current decision tree; it is determined whether the current decision tree satisfies the end division condition. If not, based on the BSS value of the remaining rule bits other than the reference rule bit, the rule bit with the maximum BSS value in the BSS value of the remaining rule bits is taken as the reference rule bit again; based on all reference rule bits, all matching rules are divided into a plurality of leaf nodes to obtain the current decision tree, and the operation of determining whether the current decision tree satisfies the end division condition is repeatedly executed until the current decision tree satisfies the end division condition and stops. If yes, the current decision tree is determined as the established decision tree, and a bit mask is generated for the decision tree. The bit mask is used to indicate all reference rule bits.

[0044] In an example, the end division condition can include but is not limited to: the target space factor of the current decision tree is not less than the space factor threshold; wherein the space factor threshold can be the maximum value that the configured target space factor can reach; or the space factor threshold can be the maximum floating point number configured. The number of leaf node rules of the current decision tree is not greater than the leaf node rule number threshold; wherein the leaf node rule number threshold can be a specified value (such as 1) configured. The matching rules in each leaf node of the current decision tree cannot be further divided into two leaf nodes.

[0045] The determining whether the current decision tree satisfies the end-splitting condition can include: if the current decision tree satisfies any one of the end-splitting conditions, determining that the current decision tree has satisfied the end-splitting condition; and if the current decision tree does not satisfy each of the end-splitting conditions, determining that the current decision tree has not satisfied the end-splitting condition.

[0046] In one example, the obtaining the plurality of matching rules can include, but is not limited to: obtaining a plurality of original rules configured; for each original rule, if a number of rule bits in the original rule is less than K, supplementing the original rule with wildcard bits to obtain a supplemented rule, and a number of rule bits in the supplemented rule can be equal to K, K can be 2 raised to the power of n, and n can be a positive integer; and if the supplemented rule includes exact match bits and wildcard bits, performing left alignment or right alignment on all the exact match bits to obtain a matching rule corresponding to the original rule.

[0047] The obtaining the target matching data can include, but is not limited to: obtaining original matching data input; if a number of data bits in the original matching data is less than K, supplementing the original matching data with special character bits to obtain supplemented matching data, and a number of data bits in the supplemented matching data is equal to K; and if the supplemented matching data includes exact match bits and special character bits (the special character bits refer to bits of characters that do not appear in the matching rule), performing left alignment or right alignment on all the exact match bits to obtain the target matching data.

[0048] In one example, the matching rule in the leaf node is configured with a target mask, and the target mask includes a primary mask and a secondary mask; wherein K rule bits of the matching rule are divided into P1 data blocks, the primary mask includes P1 bits, and the P1 bits correspond to the P1 data blocks one by one; for each data block, when the data block has an exact match bit, a bit corresponding to the data block in the primary mask has a first value, and the first value indicates that the data block has the exact match bit; and when the data block does not have the exact match bit, a bit corresponding to the data block in the primary mask has a second value, and the second value indicates that the data block does not have the exact match bit.

[0049] Wherein, for each data block, when the data block does not have the exact match bit, the data block does not correspond to the secondary mask; and when the data block has the exact match bit, the data block corresponds to the secondary mask.

[0050] Wherein, when the data block includes P2 rule bits, the secondary mask includes P2 bits, and the P2 bits correspond to the P2 rule bits one by one.

[0051] For each rule bit, when the rule bit is the exact match bit, the value of the bit corresponding to the rule bit in the secondary mask is the third value, and the third value represents the exact match bit; when the rule bit is the general match bit, the value of the bit corresponding to the rule bit in the secondary mask is the fourth value, and the fourth value represents the general match bit.

[0052] In one example, if the first match rule and the second match rule exist in the leaf node, and the rule range of the first match rule is greater than the rule range of the second match rule, the position of the second match rule in the leaf node is in front of the position of the first match rule in the leaf node.

[0053] As can be seen from the above technical solutions, in the embodiments of the present application, the target leaf node corresponding to the current to-be-matched data is queried from all leaf nodes of the decision tree, and the current to-be-matched data is matched with the target match rule in the target leaf node, without matching the current to-be-matched data with all match rules, thereby reducing the number of matches, improving the matching performance, and reducing the matching time. The matching performance can meet the actual demand. For example, even if there are tens of thousands of match rules, only a few match rules in the target leaf node need to be matched with the current to-be-matched data, greatly reducing the number of matches. In addition, the exact match bit is indicated by the target mask, so only the exact match bit needs to be matched, further improving the matching performance and reducing the matching time. After splitting the target match data and multiple queries, fuzzy matching of the exact match field position can be realized, thereby significantly improving the performance of fuzzy matching of massive data with the exact match field position, and the matching performance in the case of massive rules can be significantly improved, the performance of exact and fuzzy matching can be greatly improved, and the matching performance is more stable.

[0054] The above technical solutions of the embodiments of the present application are described below in combination with specific application scenarios.

[0055] The function strstr (used to return the address of the first occurrence of a substring in a string) and the function strcasestr (used to find another string in a string) are used for substring matching of a string. For example, based on the function strstr or the function strcasestr, the data string "xiaoyi" matches the rule string "xiao", and the data string "xiamen" does not match the rule string "xiao". For the rule string "xia", the data string "xiaoyi" matches the rule string "xia", and the data string "xiamen" matches the rule string "xia".

[0056] On a security device (such as a firewall device), a large number of fuzzy domain name rules (i.e., partial content of a complete domain name) and a large number of accurate domain name rules (i.e., a complete domain name) can be issued in the form of substrings, that is, a mixed configuration of fuzzy domain name rules and accurate domain name rules is supported. When the security device receives a DNS request message sent by a DNS server, the security device can parse a domain name to be matched and an IP address from the DNS request message. If the domain name to be matched matches any fuzzy domain name rule or accurate domain name rule (for example, the function strstr or the function strcasestr is used for matching), the IP address is stored in a security table item. If the domain name to be matched does not match any fuzzy domain name rule or accurate domain name rule, the IP address is not stored in the security table item.

[0057] On this basis, the security device releases a data packet accessing an IP address in the security table item, and discards a data packet accessing an IP address outside the security table item, thereby implementing access control of the data packet.

[0058] In addition to issuing a large number of fuzzy domain name rules and a large number of accurate domain name rules in the form of substrings, that is, the matching rules include fuzzy domain name rules and accurate domain name rules, other types of matching rules can also be issued in the form of substrings. The matching rules can be any matching rule that needs to improve the performance of string substring matching, and the type of the matching rule is not limited. For convenience of description, domain name rules are used as an example for description in subsequent embodiments.

[0059] An embodiment of the present application proposes a mass data fuzzy matching method without fixed positions. The method can involve a decision tree construction process and a decision tree-based data fuzzy matching process. The decision tree construction process and the decision tree-based data fuzzy matching process are described below in combination with specific examples.

[0060] For the decision tree construction process, an embodiment of the present application proposes a decision tree construction method. Referring to FIG. 1, a flowchart of the decision tree construction method is shown. The decision tree construction method can include the following steps. Figure 2

[0061] Step 201: Obtain a plurality of matching rules. Each matching rule includes K rule bits.

[0062] For example, K can be a positive integer. For example, K can be 2 raised to the power of n, and n can be a positive integer. Alternatively, K can not be 2 raised to the power of n. For example, when n is 1, K is 2, when n is 2, K is 4, when n is 3, K is 8, when n is 4, K is 16, when n is 8, K is 256, and so on.

[0063] For each matching rule, the matching rule can include K bits, which can be referred to as rule bits. Therefore, the matching rule can include K rule bits.​

[0064] In one example, for step 201, the following steps can be used to obtain the plurality of matching rules:

[0065] Step 2011, obtaining a plurality of original rules configured, for each original rule, the original rule can include a plurality of rule bits, and the number of rule bits in the original rule is less than or equal to K.

[0066] For example, the original rule can be pre-configured, the original rule can be pre-configured by a user, or the original rule can be pre-configured by using an algorithm, and the source of the original rule is not limited.

[0067] For example, the original rule can be three protocol number rules, and the three protocol number rules are: original rule 1: protocol number 38, original rule 2: protocol number 46, and original rule 3: protocol number 54 or 62. The above original rules can be converted into binary bit form as follows: original rule 1: 0010 0110, original rule 2: 0010 1110, and original rule 3: 0011 110. In the above original rules, 0 represents a 0 bit, 1 represents a 1 bit, and * represents a wildcard, which can be a 0 bit or a 1 bit.

[0068] Step 2012, for each original rule, if the number of rule bits in the original rule is less than K, the original rule can be supplemented with a wildcard bit to obtain a supplemented rule, and the number of rule bits in the supplemented rule can be equal to K. Or, if the number of rule bits in the original rule is equal to K, the original rule remains unchanged, that is, the original rule can be used as the supplemented rule.

[0069] For example, taking the domain name rule as an example, since the maximum length of the domain name is 253 bytes, the value of K closest to the maximum length of the domain name 253 bytes is 256 bytes (K needs to be greater than or equal to the maximum length of the domain name, and K is 2 raised to the power of n), therefore, for each original rule, the original rule can be supplemented with a wildcard bit to obtain a supplemented rule, and the number of rule bits in the supplemented rule can be equal to 256 bytes, that is, there are 2048 rule bits.

[0070] For example, when the original rule is supplemented with a wildcard bit to obtain a supplemented rule, the wildcard bit represents a wildcard bit, and the wildcard is a special statement that can have the form of an asterisk (*) and a question mark (?), and the wildcard is used for fuzzy search, and the wildcard represents the ability to match all characters.

[0071] For example, in a 32-bit system or a 64-bit system, the performance of operation according to 4 bytes or 8 bytes is the highest, and thus the original rule is completed to 2 8, i.e. 256 bytes, to obtain a supplemented rule, and the performance of operation according to the supplemented rule is the highest.

[0072] In step 2013, if the supplemented rule includes the exact match bit and the general match bit, all the exact match bits are left-aligned and arranged continuously to obtain a match rule corresponding to the original rule.

[0073] Alternatively, if the supplemented rule includes the exact match bit and the general match bit, all the exact match bits are right-aligned and arranged continuously to obtain a match rule corresponding to the original rule.

[0074] Obviously, for each original rule, a match rule corresponding to the original rule can be obtained after the original rule is preprocessed (such as the supplementing general bit processing and / or the aligning and continuously arranging processing, etc.), and thus a plurality of match rules corresponding to a plurality of original rules can be obtained.

[0075] For example, taking the supplemented rule as a domain name supplemented rule, the domain name supplemented rule is 256 bytes, and the domain name supplemented rule can be a fuzzy domain name rule or an exact domain name rule, if the domain name supplemented rule includes the exact match bit and the general match bit, all the exact match bits in the domain name supplemented rule are left-aligned and arranged continuously, and it is ensured that the first exact match bit has no general match bit on the left side and all the general match bits are on the right side in a single domain name supplemented rule.

[0076] Referring to Figure 3As shown, for the domain name supplemented rule 1, abcde represents 5 exact match characters, the bit positions corresponding to the 5 exact match characters can be exact match bit positions, and the exact match bit positions corresponding to the 5 exact match characters need to be left-aligned and arranged continuously. ***…*** (251) represents 251 wildcard characters, the bit positions corresponding to the 251 wildcard characters can be wildcard bit positions, and the wildcard bit positions corresponding to the 251 wildcard characters can be located to the right of the last exact match bit position. For the domain name supplemented rule 2, an can represent 2 exact match characters, the exact match bit positions corresponding to the 2 exact match characters are left-aligned and arranged continuously. The 254 wildcard characters correspond to wildcard bit positions, which can be located to the right of the last exact match bit position. For the domain name supplemented rule 3, gaagbb can represent 6 exact match characters, the exact match bit positions corresponding to the 6 exact match characters are left-aligned and arranged continuously. The 250 wildcard characters correspond to wildcard bit positions, which can be located to the right of the last exact match bit position.

[0077] Alternatively, taking the domain name supplemented rule as an example, the domain name supplemented rule is 256 bytes, and the domain name supplemented rule can be a fuzzy domain name rule or an exact domain name rule. If the domain name supplemented rule includes exact match bit positions and wildcard bit positions, all the exact match bit positions in the domain name supplemented rule are right-aligned and arranged continuously, so that the right side of the first exact match bit position in a single domain name supplemented rule has no wildcard bit position, and all the wildcard bit positions are on the left.

[0078] Step 202, based on the BSS (Bit Separability Set) value of each rule bit position, the rule bit position with the maximum BSS value is taken as a reference rule bit position.

[0079] For example, after obtaining a plurality of matching rules, since each matching rule includes K rule bit positions, the BSS value of each rule bit position can be calculated, that is, K rule bit positions correspond to K BSS values, so that the rule bit position with the maximum BSS value is taken as a reference rule bit position.

[0080] For convenience of description, three matching rules are taken as an example, the matching rule 1 is 0010 0110, the matching rule 2 is 0010 1110, and the matching rule 3 is 0011*110. Then, eight BSS values corresponding to eight rule bits can be calculated. The BSS value is the product value of the number of matching rules with 0 bits and the number of matching rules with 1 bit, and the universal matching bit is not included in the calculation of the BSS value. The BSS value represents the strength of distinguishing the matching rule set (i.e., all matching rules), and the greater the BSS value, the more the matching rule set can be distinguished.

[0081] For example, eight BSS values corresponding to eight rule bits can be seen from Table 1.

[0082] Table 1

[0083] bit0 bit1 bit2 bit3 bit4 bit5 bit6 bit7 0 0 0 2 1 0 0 0

[0084] Obviously, for the first rule bit (bit0), there are three 0s, therefore, the number of matching rules with 0 bits is 3, the number of matching rules with 1 bit is 0, and the product value of the two represents the BSS value, i.e., the BSS value is 0. For the fourth rule bit (bit3), there are two 0s and one 1, therefore, the number of matching rules with 0 bits is 2, the number of matching rules with 1 bit is 1, and the product value of the two represents the BSS value, i.e., the BSS value is 2. For the fifth rule bit (bit4), there is one 0 and one 1, and the universal matching bit is not included in the calculation, therefore, the number of matching rules with 0 bits is 1, the number of matching rules with 1 bit is 1, and the product value of the two represents the BSS value, i.e., the BSS value is 1, and so on.

[0085] For example, after obtaining eight BSS values corresponding to eight rule bits, the rule bit of the maximum BSS value (i.e., the fourth rule bit) can be taken as the reference rule bit.

[0086] Step 203, based on the reference rule bit, all matching rules are divided into leaf nodes to obtain the current decision tree, i.e., after all matching rules are divided into multiple leaf nodes, the current decision tree is obtained.

[0087] In one example, the matching rule with the reference rule bit of 0 can be divided into one leaf node, and the matching rule with the reference rule bit of 1 can be divided into another leaf node.

[0088] For example, a decision tree can be constructed, the current decision tree includes a root node, and the root node includes all matching rules, such as the matching rule 1 is 0010 0110, the matching rule 2 is 0010 1110, and the matching rule 3 is 0011*110. After taking the fourth rule bit (bit3) as the reference rule bit, it can be seen from Table 1 that the matching rule with the reference rule bit of 0 can be divided into one leaf node, and the matching rule with the reference rule bit of 1 can be divided into another leaf node.Figure 4A As shown, the matching rules with the 4th rule bit (bit3) being 0 (matching rule 1 and matching rule 2) are divided to the left leaf node, and the matching rules with the 4th rule bit (bit3) being 1 (matching rule 3) are divided to the right leaf node. After the above division is performed on all the matching rules, the obtained tree is referred to as the current decision tree.

[0089] Step 204, it is judged whether the current decision tree satisfies an end division condition.

[0090] If not, step 205 can be performed, and if yes, step 207 can be performed.

[0091] In one example, the end division condition can include, but is not limited to, at least one of the following:

[0092] Condition 1: the target space factor of the current decision tree is not less than a space factor threshold.

[0093] In one example, the target space factor can be determined based on the total number of reference rule bits, the number of matching rules in the leaf nodes of the current decision tree, and the total number of all matching rules.

[0094] For example, the target space factor can be determined by the following formula, of course, the formula is only an example.

[0095]

[0096] In the above formula, SPFAC represents the target space factor, the greater the value of the target space factor, the faster the matching performance of the decision tree, but the greater the memory occupation. m represents the total number of reference rule bits, in Figure 4A In the above formula, the total number of reference rule bits is 1, when steps 202 and 203 are performed again, the total number of reference rule bits is increased by 1, and so on, the total number of reference rule bits is constantly changing.

[0097] 2 m represents the total number of leaf nodes of the current decision tree, N i represents the number of matching rules in the i-th leaf node, in Figure 4A In the above formula, when i is 0, N i represents the number of matching rules in the 1st leaf node, that is, 2, when i is 1, N i represents the number of matching rules in the 2nd leaf node, that is, 2.

[0098] N represents the total number of all matching rules, in Figure 4A In the above formula, the total number of all matching rules is 3.

[0099] In one example, the space factor threshold value can be configured empirically, and no limit is imposed on the value of the space factor threshold value. For example, the space factor threshold value can be the configured maximum value.

[0100] For example, the target space factor is an important parameter of the decision tree. By adjusting the target space factor, an effect is achieved, i.e., for the leaf node in which the matching rules are finally placed, no new reference rule bit can be found between any two matching rules, and only matching rules in the two relationships of "big bag small" and "cross contain" exist, and no new reference rule bit can be found for the matching rules in the two relationships.

[0101] Here, an example is given to illustrate the two relationships of "big bag small" and "cross contain". Suppose that domain name 1 is abcde******, where * represents a wildcard character, and there are 251 *s after the domain name, and domain name 2 is ab******, where * represents a wildcard character, and there are 254 *s after the domain name. Obviously, domain name 2 is "big", and domain name 1 is "small", and they are in the "big bag small" relationship. In this way, domain name 1 is contained by domain name 2.

[0102] Suppose that domain name 3 is ******ab, where * represents a wildcard character, and there are 254 *s before the domain name, and domain name 4 is uvwxyz******, where * represents a wildcard character, and there are 250 *s after the domain name. In this way, the first 6 characters of domain name 3 contain uvwxyz of domain name 4, and the last 2 characters of domain name 4 contain ab of domain name 3, and they are in the "cross contain" relationship. In the embodiment, by continuously arranging all the exact matching bits in left (or right) alignment, no "cross contain" relationship exists, and only the "big bag small" relationship needs to be considered.

[0103] In order to avoid the existence of the leaf node in the "big bag small" relationship as much as possible, the space factor threshold value can be set to be large enough, i.e., the space factor threshold value can be the configured maximum value. For example, the space factor threshold value can be the maximum value that the configured target space factor can reach. If the target space factor is a signed 4-byte integer, the space factor threshold value can be 0xFFFFFFFF, i.e., 0xFFFFFFFF is the maximum value that the target space factor can reach. Alternatively, the space factor threshold value can be the configured maximum floating-point number, the maximum value of the IEEE 754 floating-point number (3.40282347e+38), the maximum value of the floating-point number in the C language, the maximum value of the floating-point number in the Java language, etc. Of course, the above is only an example of the space factor threshold value.

[0104] Condition 2: The number of reference rules of the current decision tree leaf node is not greater than the leaf node rule number threshold value.

[0105] In one example, the maximum number of matching rules can be taken as the leaf node rule reference number based on the number of matching rules in each leaf node. Figure 4A In one example, there are 2 leaf nodes, the number of matching rules in the first leaf node is 2, and the number of matching rules in the second leaf node is 2, so the maximum number of matching rules is 2, and thus the leaf node rule reference number can be 2.

[0106] In one example, the leaf node rule number threshold value can be configured empirically, and the leaf node rule number threshold value is not limited. For example, the leaf node rule number threshold value can be a specified value configured.

[0107] For example, the leaf node rule number threshold value can be denoted as BINTH, the smaller the leaf node rule number threshold value, the lower the height of the decision tree, the fewer the number of matching rules in the leaf node, the faster the matching performance, but the larger the memory occupancy. When the number of rules in the leaf node with the maximum number of matching rules (i.e., the leaf node rule reference number) is less than or equal to the leaf node rule number threshold value, the reference rule bit of the screening cut rule is terminated.

[0108] For example, the leaf node rule reference number is an important parameter of the decision tree, and by adjusting the leaf node rule reference number, an effect is achieved, i.e., for the leaf node in which the matching rules are finally placed, there is no new reference rule bit between any two matching rules, and only the matching rules with the two relationships of “big package small” and “cross inclusion” exist, and the matching rules with the two relationships cannot find new reference rule bits. On the basis of the absence of the “cross inclusion” relationship, in order to avoid the existence of the leaf node with the “big package small” relationship, the leaf node rule number threshold value can be set to 1, i.e., BINTH is set to 1.

[0109] Condition 3: The matching rules in each leaf node of the current decision tree cannot be further divided into two leaf nodes. For example, for each leaf node, if there is no new reference rule bit between any two matching rules in the leaf node, and only the matching rules with the two relationships of “big package small” and “cross inclusion” exist, the matching rules cannot be further divided into two leaf nodes.

[0110] Of course, the above three conditions are only examples, and more ending division conditions can be configured, such as the number of reference rule bits reaching a number threshold value, such as 6, 8, 10, etc., i.e., when the number of reference rule bits reaches 6, the current decision tree also satisfies the ending division condition.

[0111] In one example, when determining whether the end-splitting condition is satisfied, if the current decision tree satisfies any one of the end-splitting conditions, it is determined that the current decision tree has satisfied the end-splitting condition; if the current decision tree does not satisfy each of the end-splitting conditions, it is determined that the current decision tree has not satisfied the end-splitting condition.

[0112] In step 205, based on the BSS values of the remaining rule bits other than the reference rule bit, the rule bit corresponding to the maximum BSS value among the BSS values of the remaining rule bits is taken as the reference rule bit again, that is, one reference rule bit is added.

[0113] In one example, the leaf node with the most matching rules can be selected from all leaf nodes, and based on this, the BSS value of each rule bit can be calculated, and on the basis of excluding the reference rule bit, the rule bit corresponding to the maximum BSS value among the BSS values of the remaining rule bits is taken as the reference rule bit again.

[0114] Referring to Figure 4A As shown in the table, the number of matching rules of the left leaf node is greater than that of the right leaf node, so the left leaf node is selected. For this leaf node, on the basis of excluding the reference rule bit (bit3), the 7 BSS values corresponding to the 7 rule bits can be seen from Table 2.

[0115] Table 2

[0116] bit0 bit1 bit2 bit3 bit4 bit5 bit6 bit7 0 0 0 * 1 0 0 0

[0117] As can be seen from Table 2, on the basis of excluding the reference rule bit (bit3), for the first rule bit (bit0), there are 2 0s, so the number of matching rules of 0 bits is 2, the number of matching rules of 1 bits is 0, and the product value of the two represents the BSS value, that is, the BSS value is 0. For the fifth rule bit (bit4), there is 1 0 and 1 1, so the number of matching rules of 0 bits is 1, the number of matching rules of 1 bits is 1, and the product value of the two represents the BSS value, that is, the BSS value is 1, and so on.

[0118] As can be seen from Table 2, after obtaining the 7 BSS values corresponding to the 7 rule bits, the rule bit corresponding to the maximum BSS value (i.e., the fifth rule bit) can be taken as the reference rule bit again.

[0119] In another example, based on all matching rules of the root node, the BSS value of each rule bit can be calculated, and on the basis of excluding the reference rule bit, the rule bit corresponding to the maximum BSS value among the BSS values of the remaining rule bits is taken as the reference rule bit again.

[0120] Step 206, dividing all the matching rules into multiple leaf nodes based on all the reference rule bits, to obtain the current decision tree. For example, dividing all the matching rules into 2nleaf nodes, n represents the number of reference rule bits.

[0121] For example, taking two reference rule bits as an example, the matching rule with reference rule bits of 00 (i.e. bit3 is 0 and bit4 is 0, bit3 represents the first reference rule bit, and bit4 represents the second reference rule bit) can be divided into the first leaf node, the matching rule with reference rule bits of 01 (i.e. bit3 is 0 and bit4 is 1) can be divided into the second leaf node, the matching rule with reference rule bits of 10 (i.e. bit3 is 1 and bit4 is 0) can be divided into the third leaf node, and the matching rule with reference rule bits of 11 (i.e. bit3 is 1 and bit4 is 1) can be divided into the fourth leaf node, thereby obtaining the current decision tree, i.e. the current decision tree includes a total of 4 leaf nodes.

[0122] For example, taking three reference rule bits as an example, the matching rule with reference rule bits of 000 is divided into the first leaf node, the matching rule with reference rule bits of 001 is divided into the second leaf node, the matching rule with reference rule bits of 010 is divided into the third leaf node, the matching rule with reference rule bits of 011 is divided into the fourth leaf node, the matching rule with reference rule bits of 100 is divided into the fifth leaf node, the matching rule with reference rule bits of 101 is divided into the sixth leaf node, the matching rule with reference rule bits of 110 is divided into the seventh leaf node, and the matching rule with reference rule bits of 111 is divided into the eighth leaf node, thereby obtaining the current decision tree, i.e. the current decision tree includes a total of 8 leaf nodes.

[0123] In summary, the current decision tree can be obtained, which includes a root node, and the root node includes all the matching rules. After taking the fourth rule bit (bit3) and the fifth rule bit (bit4) as reference rule bits, see FIG. 4 for a schematic diagram of dividing the matching rules into leaf nodes. Figure 4B

[0124] ​For matching rule 1 where bit 3 is 0 and bit 4 is 0, it can be assigned to the first leaf node. For matching rule 2 where bit 3 is 0 and bit 4 is 1, it can be assigned to the second leaf node. Considering that the * in matching rule 3 can be 0 or 1, when the * in matching rule 3 is 0, for matching rule 3 where bit 3 is 1 and bit 4 is 0, it can be assigned to the third leaf node. When the * in matching rule 3 is 1, for matching rule 3 where bit 3 is 1 and bit 4 is 1, it can be assigned to the fourth leaf node.

[0125] In one example, after step 206, the operation of determining whether the current decision tree meets the termination splitting condition can be repeated until the current decision tree meets the termination splitting condition. For instance, after step 206, step 204 can be executed to determine whether the current decision tree meets the termination splitting condition. If not, steps 205 and 206 are executed again, that is, a reference rule bit is added, and all matching rules are split into more leaf nodes (2 to the power of n leaf nodes, where n represents the reference rule bit), and so on, until the current decision tree meets the termination splitting condition.

[0126] Step 207: Determine the current decision tree as the established decision tree (i.e., the final decision tree) and generate a bit mask for the decision tree. This bit mask is used to indicate all reference rule bits.

[0127] In one example, the final decision tree can be a two-level decision tree, with the root node at the first level and 2 to the power of n leaf nodes at the second level, where n represents the reference rule bits. Based on this, the current decision tree (see...) can be further developed. Figure 4B (As shown) is the established final decision tree. In this way, a bitmask corresponding to the final decision tree can also be generated. For example, the bitmask can be 00011000, where the fourth "1" indicates that the fourth rule bit (bit3) is used as a reference rule bit, the fifth "1" indicates that the fifth rule bit (bit4) is used as a reference rule bit, and the remaining 0s indicate that they are not used as reference rule bits.

[0128] In one example, if the current decision tree does not contain leaf nodes of a specified type, then the current decision tree is considered the final decision tree. The final decision tree is a two-level decision tree, with the root node at level one and 2 to the power of n leaf nodes at level two. Alternatively, if the current decision tree contains leaf nodes of a specified type, these leaf nodes can be further divided into multiple leaf nodes, resulting in a multi-level decision tree where the root node is at level one, the second level contains multiple leaf nodes, the third level contains multiple leaf nodes, and so on. See also... Figure 4CAs shown, it is a schematic diagram of a four-level decision tree, the first level is a root node, the second level includes a plurality of leaf nodes, the third level includes a plurality of leaf nodes, and the fourth level includes a plurality of leaf nodes.

[0129] As to the way of dividing the root node into the second-level leaf nodes, referring to steps 201-207, a bit mask of the second-level leaf nodes can be generated, which is used to indicate the reference rule bit of the root node to the second-level leaf nodes, and the second-level leaf node corresponding to the data can be queried based on the bit mask.

[0130] If there is a specified type leaf node in the second-level leaf nodes, that is, the specified type leaf node includes a plurality of matching rules, and the plurality of matching rules can be divided, then based on the plurality of matching rules of the specified type leaf node, referring to steps 201-207, the plurality of matching rules of the specified type leaf node can be divided into third-level leaf nodes, and the process will not be repeated, and a bit mask of the third-level leaf nodes is generated, which is used to indicate the reference rule bit of the second-level leaf node to the third-level leaf node, and the third-level leaf node corresponding to the data can be queried based on the bit mask.

[0131] If there is a specified type leaf node in the third-level leaf nodes, that is, the specified type leaf node includes a plurality of matching rules, and the plurality of matching rules can be divided, then based on the plurality of matching rules of the specified type leaf node, referring to steps 201-207, the plurality of matching rules of the specified type leaf node can be divided into fourth-level leaf nodes, and a bit mask of the fourth-level leaf nodes is generated.

[0132] In one example, for each leaf node of the established decision tree (i.e. the final decision tree), each matching rule in the leaf node can be configured with a target mask, that is, a target mask is configured for each matching rule in the leaf node. For example, for each matching rule, the matching rule can include K rule bits (such as 256*8 rule bits), and the target mask is used to indicate that M rule bits in the K rule bits are exact matching bits, such as the first M rule bits are exact matching bits.

[0133] For example, taking a fuzzy domain name as an example, the matching rule can include 256 bytes (i.e. 256*8 rule bits), and the exact matching part of the fuzzy domain name in the actual production environment is relatively short, such as the name of an organization, a manufacturer, a trademark, etc., and there are many wildcard characters. In order to avoid meaningless wildcard comparison, in this embodiment, by configuring a target mask for the matching rule, the target mask is used to indicate the exact matching bits in the K rule bits, so as to solve the performance problem of exact matching.

[0134] In one example, the target mask can include a primary mask and a secondary mask. K rule bits of the matching rule are divided into P1 data blocks, P1 being a positive integer, and P1 can be configured according to actual needs, such as P1 being 16, 32, 64, etc. Based on this, the primary mask can include P1 bits, and the P1 bits correspond to the P1 data blocks one by one. For example, taking 32 data blocks as the P1 data blocks, and the size of each data block being 8 bytes (64 bits), that is, each data block can include 64 rule bits, 32 data blocks correspond to 2048 rule bits (that is, K rule bits).

[0135] For each data block, if the data block has an exact match bit, the bit corresponding to the data block in the primary mask has a first value (such as 1), and the first value indicates that the data block has an exact match bit. If the data block does not have an exact match bit, the bit corresponding to the data block in the primary mask has a second value (0), and the second value indicates that the data block does not have an exact match bit.

[0136] For each data block, if the data block does not have an exact match bit, the data block does not correspond to the secondary mask; if the data block has an exact match bit, the data block corresponds to the secondary mask. If the data block includes P2 rule bits, the secondary mask corresponding to the data block includes P2 bits, and the P2 bits correspond to the P2 rule bits one by one. For example, taking 64 rule bits as the P2 rule bits, that is, the size of the data block is 8 bytes, the secondary mask includes 64 bits.

[0137] For each rule bit, if the rule bit is an exact match bit, the bit corresponding to the rule bit in the secondary mask has a third value (such as 1), and the third value indicates an exact match bit. If the rule bit is a general match bit, the bit corresponding to the rule bit in the secondary mask has a fourth value (such as 0), and the fourth value indicates a general match bit.

[0138] For example, assuming that the matching rule is a fuzzy domain name abcabc****…*** (a total of 250 *), referring to FIG. 1, the matching rule includes 250 rule bits, and the 250 rule bits are divided into 32 data blocks, and the size of each data block is 8 bytes (64 bits). The primary mask corresponding to the matching rule includes 32 bits, and the 32 bits correspond to the 32 data blocks one by one. For example, the bit corresponding to the first data block in the primary mask has a first value (1), indicating that the first data block has an exact match bit. The bit corresponding to the second data block in the primary mask has a second value (0), indicating that the second data block does not have an exact match bit. The bit corresponding to the third data block in the primary mask has a first value (1), indicating that the third data block has an exact match bit. The bit corresponding to the fourth data block in the primary mask has a second value (0), indicating that the fourth data block does not have an exact match bit. Figure 5AThe target mask of the fuzzy domain name abcabc****…*** is shown. The fuzzy domain name abcabc****…*** can be divided into 32 data blocks, the first data block includes the first 8 bytes, i.e., the data block includes "abcabc**", i.e., the data block includes 6 exact match characters and 2 fuzzy match characters. The second data block includes the second 8 bytes, i.e., the data block includes "********", i.e., the data block is 8 fuzzy match characters. The third data block includes the third 8 bytes, i.e., the data block includes "********", and so on. The last 31 data blocks are 8 bytes of fuzzy match characters.

[0139] The first-level mask can be 4 bytes, i.e., 32 bits, and the 32 bits correspond to the 32 data blocks one by one. For the first data block, since the data block has exact match bits (such as 48 bits corresponding to abcabc), the value of the first bit in the first-level mask is the first value (such as 1). For the second data block, since the data block does not have exact match bits, the value of the second bit in the first-level mask is the second value (such as 0). For the third data block, since the data block does not have exact match bits, the value of the third bit in the first-level mask is the second value (such as 0), and so on. In this way, the first-level mask can be 10000000000000000000000000000000.

[0140] In addition, the first data block corresponds to the second-level mask, and the remaining data blocks do not correspond to the second-level mask. For the second-level mask corresponding to the first data block, the second-level mask can be 8 bytes, i.e., 64 bits, and the 8 bytes (64 bits) of the second-level mask correspond to the 8 bytes (64 regular bits) of the data block one by one.

[0141] The first byte (8 regular bits) of the data block is "a", indicating that the 8 regular bits are exact match bits, and the value of the first byte (8 bits) of the secondary mask is the third value (e.g. 1). The second byte (8 regular bits) of the data block is "b", indicating that the 8 regular bits are exact match bits, and the value of the second byte (8 bits) of the secondary mask is the third value (e.g. 1). Similarly, the sixth byte (8 regular bits) of the data block is "c", indicating that the 8 regular bits are exact match bits, and the value of the sixth byte (8 bits) of the secondary mask is the third value (e.g. 1). The seventh byte (8 regular bits) of the data block is "*", indicating that the 8 regular bits are wildcard match bits, and the value of the seventh byte (8 bits) of the secondary mask is the fourth value (e.g. 0). The eighth byte (8 regular bits) of the data block is "*", indicating that the 8 regular bits are wildcard match bits, and the value of the eighth byte (8 bits) of the secondary mask is the fourth value (e.g. 0).

[0142] On this basis, when performing exact matching, the data block with exact match characters is first found through the primary mask, and then the fuzzy domain name and the matching domain name are matched through the secondary mask.

[0143] For example, the above-mentioned secondary mask is suitable not only for fuzzy matching with a byte-level granularity, but also for fuzzy matching with a bit-level granularity. For example, the sixth byte "c" mentioned above corresponds to 8 bits 0110 0101, the first 6 bits are exact match bits, and the last 2 bits 01 are set as wildcard bit bits. In this way, the secondary mask can be changed to Figure 5B as shown.

[0144] In one example, for a leaf node of an established decision tree (i.e. a final decision tree), if there are a first matching rule and a second matching rule in the leaf node, and the rule range of the first matching rule is greater than the rule range of the second matching rule, then in the leaf node, the position of the second matching rule in the leaf node can be in front of the position of the first matching rule in the leaf node.

[0145] For example, the rule range of the first matching rule being greater than the rule range of the second matching rule means that the first matching rule envelopes the second matching rule. For example, if the target matching data matches the first matching rule successfully, the target matching data may not necessarily match the second matching rule successfully; if the target matching data matches the second matching rule successfully, the target matching data must match the first matching rule successfully.

[0146] Referring to the above embodiment, the first matching rule envelops the second matching rule refers to that the first matching rule and the second matching rule have a "big envelops small" relationship. For example, assuming that the domain name 1 is abcde****** and the domain name 2 is ab******, the domain name 2 is the "big" rule and the domain name 1 is the "small" rule. Here, the domain name 2 is the first matching rule and the domain name 1 is the second matching rule. Obviously, if the target matching data matches the domain name 2, the target matching data does not necessarily match the domain name 1; conversely, if the target matching data matches the domain name 1, the target matching data necessarily matches the domain name 2.

[0147] For the data fuzzy matching process based on the decision tree, an embodiment of the present application proposes a data fuzzy matching method. Referring to FIG. 6, which is a flowchart of the method, the method can include the following steps. Figure 6

[0148] Step 601, obtaining target matching data, the target matching data including K data bits.

[0149] For example, the target matching data can include K bits, and the bits in the target matching data can be referred to as data bits. Therefore, the target matching data can include K data bits.

[0150] In one example, for step 601, the target matching data can be obtained by the following steps.

[0151] Step 6011, obtaining the input original matching data, the original matching data including multiple data bits, and the number of data bits in the original matching data can be less than or equal to K. For example, the original matching data can be obtained from the DNS request message, that is, the original matching data input by the DNS server.

[0152] Step 6012, if the number of data bits in the original matching data is less than K, special character bits (the bits of characters that do not appear in the matching rule) can be supplemented to the original matching data to obtain supplemented matching data, and the number of data bits in the supplemented matching data can be equal to K. Or, if the number of data bits in the original matching data is equal to K, the original matching data remains unchanged, that is, the original matching data is used as the supplemented matching data.

[0153] For example, taking the original matching data as a domain name, since the maximum length of the domain name is 253 bytes, and the value of K closest to the maximum length of the domain name 253 bytes is 256 bytes, special character bits can be supplemented to the original matching data to obtain 256-byte supplemented matching data.

[0154] ​Step 6013, if the matching data after supplementing includes the exact matching bit and the special character bit, then all the exact matching bits are arranged in sequence in left alignment to obtain the target matching data.

[0155] Alternatively, if the matching data after supplementing includes the exact matching bit and the special character bit, then all the exact matching bits are arranged in sequence in right alignment to obtain the target matching data.

[0156] Step 602, generate the fuzzy matching data based on the target matching data, the target matching data can include a plurality of data bits, and the fuzzy matching data can include a plurality of data bits and padding bits.

[0157] In one example, the number S of padding bits can be determined based on the number of exact matching bits in the target matching data and the minimum effective length, and the number S of padding bits is added at the back of the target matching data (i.e., S padding bits are added), to obtain the fuzzy matching data. On this basis, the target matching data can include K data bits, and the fuzzy matching data can include K data bits and S padding bits. For the S padding bits, the padding bits are special character bits that do not appear in the matching rule, i.e., the special character bits that do not appear in the matching rule are used as padding bits, and the content of the special character bits is not limited in this embodiment.

[0158] For the number S of padding bits, the number of padding bits can be determined based on the number of exact matching bits and the minimum effective length. For example, the target matching data can include the exact matching bit and the special character bit, and the number of exact matching bits is the number of exact matching bits in the target matching data. For example, assuming that the target matching data is the fuzzy domain name abcabc****…***(a total of 250 *), then the number of exact matching bits is 6 bytes (48 bits).

[0159] The minimum effective length is the minimum value of the effective lengths of all matching rules corresponding to the decision tree, as shown in Figure 3 As shown, there are matching rules with an effective length of 6 bytes (48 bits) (domain name 1 and domain name N), and there are matching rules with an effective length of 2 bytes (16 bits) (domain name 2), so the minimum value of the effective length is 2 bytes (16 bits), and the minimum effective length can be 16 bits.

[0160] For example, the number S of padding bits can be determined by the following formula: S=D-R, where D represents the number of exact matching bits in the target matching data, and R represents the minimum effective length.

[0161] The target matching data can be stored continuously in the memory with a length of (M+D-R), the first byte is stored at the leftmost low address (array index is 0), and the bytes not needed for matching are filled with special characters (characters not appearing in the matching rule). In the memory with a length of (M+D-R), M represents the maximum valid length, i.e., the maximum value of the valid length supported by the decision tree, the maximum valid length can be 256 bytes, i.e., the maximum valid length is the length K of the target matching data in the above embodiment, (D-R) represents the number S of filling bits, obviously, (M+D-R) represents that (D-R) filling bits are added after the target matching data, therefore, (M+D-R) can represent the length of the fuzzy matching data.

[0162] In step 603, the first data bit of the fuzzy matching data is taken as a current data bit, and the continuous K data bits starting from the current data bit are taken as the current to-be-matched data.

[0163] In an example, assuming that the number of the exact matching bits of the target matching data is D, and the minimum valid length is R, then the number D is compared with the minimum valid length R first, if D is less than R, it is directly determined that the target matching data does not match the target matching rule in the target leaf node, i.e., the matching fails. If D is not less than R, the target matching data needs to be matched with the target matching rule, and step 603 is executed.

[0164] For the number D of the exact matching bits of the target matching data, the target matching data can include the exact matching bits and the special character bits, for example, the target matching data is a fuzzy domain name abcabc****…***(a total of 250 *), and the number D of the exact matching bits is 6 bytes (48 bits).

[0165] In an example, if the special character cannot be found or the bit granularity matching is not performed, the number of the exact matching bits of the target matching data (referred to as the first exact matching length) and the number of the exact matching bits of the target matching rule (referred to as the second exact matching length) also need to be recorded. When the exact matching is performed, if the first exact matching length is inconsistent with the second exact matching length, it is directly determined that the target matching data does not match the target matching rule, i.e., the matching fails. If the first exact matching length is consistent with the second exact matching length, the target matching data is matched with the target matching rule, and step 603 is executed.

[0166] For example, if the target matching data is a fuzzy domain name abcd000000, the exact matching bit of the target matching data is 4 bytes (32 bits), the first exact matching length is 4 bytes, the target matching rule is a fuzzy domain name abcd00****, the exact matching bit of the target matching rule is 6 bytes (48 bits), and the second exact matching length is 6 bytes, when matching the target matching data with the target matching rule, the fuzzy domain name abcd00 of 6 bytes (48 bits) is matched with the fuzzy domain name abcd00 of 6 bytes (48 bits). Obviously, the matching result is a success, but actually, the exact matching character of the target matching data "abcd000000" is "abcd", and the matching with the target matching rule "abcd00" fails, that is, the matching result is incorrect.

[0167] Based on this, in the embodiment, the first exact matching length (4 bytes) and the second exact matching length (6 bytes) are compared. Obviously, since the first exact matching length and the second exact matching length are inconsistent, it is directly determined that the target matching data and the target matching rule fail to match, and the fuzzy domain name abcd00 of 6 bytes is not matched with the fuzzy domain name abcd00 of 6 bytes, and no incorrect matching result is obtained.

[0168] In step 604, the target leaf node corresponding to the current matching data is queried from all leaf nodes of the established decision tree, and the target leaf node is used to record the target matching rule and the target mask.

[0169] In one example, the target matching rule can include K rule bits, and the target mask is used to indicate that M rule bits of the K rule bits are exact matching bits. For example, the target mask can include a first-level mask and a second-level mask, the first-level mask is used to indicate which data block of the target matching rule includes the exact matching bit, and the second-level mask is used to indicate which rule bit of the data block is the exact matching bit. The details of the first-level mask and the second-level mask can be referred to the above embodiment.

[0170] After the current matching data is obtained, the reference data bit in the current matching data can be obtained by querying the bit mask (which is used to indicate all reference rule bits). For example, if all reference rule bits include bit3 and bit4, the reference data bit is bit3 and bit4, and therefore, the data bit of bit3 (i.e., the fourth data bit) and the data bit of bit4 (i.e., the fifth data bit) are selected from the current matching data, so that the target leaf node corresponding to the current matching data can be queried from all leaf nodes by using the data bit of bit3 and the data bit of bit4.

[0171] Referring to Figure 4B As shown in the table, if the data bit of bit3 is 0 and the data bit of bit4 is 0, the first leaf node is the target leaf node corresponding to the current data to be matched. If the data bit of bit3 is 0 and the data bit of bit4 is 1, the second leaf node is the target leaf node corresponding to the current data to be matched. If the data bit of bit3 is 1 and the data bit of bit4 is 0, the third leaf node is the target leaf node corresponding to the current data to be matched. If the data bit of bit3 is 1 and the data bit of bit4 is 1, the fourth leaf node is the target leaf node corresponding to the current data to be matched.

[0172] In summary, the target leaf node can be queried from all the leaf nodes of the decision tree.

[0173] In one example, in the decision tree, each leaf node contains a pointer pointing to a piece of memory containing a matching rule. Each non-leaf node contains a target mask of rule bits and a pointer pointing to an array of all leaf nodes. Based on this, the target leaf node corresponding to the current data to be matched can be queried from all the leaf nodes of the decision tree. Referring to Figure 7 As shown in the table, the target leaf node corresponding to the current data to be matched can be queried from all the leaf nodes of the decision tree.

[0174] Packet Header (data header) represents the information of the incoming packet tuple, represented in binary, i.e. the current data to be matched obtained based on the packet, which can be a domain name, etc. Here, the current data to be matched includes 10 data bits, which are denoted as B0, B1,..., B9.

[0175] Bitmask represents the reference data bits screened out during the tree building process, which indicates that the 2nd bit, the 6th bit, the 7th bit and the 9th bit are reference data bits.

[0176] Index for the Next Node (next node index) represents the subscript of the target leaf node calculated, i.e. the index composed of B1, B5, B6 and B8 corresponds to the target leaf node. For example, assuming that B1 is 1, B5 is 0, B6 is 1 and B8 is 0, the leaf node corresponding to the index 0101 is the target leaf node. Obviously, the bit values corresponding to the 1 bits in the Bitmask in the Packet Header can be taken out and placed at the tail of the all-0 data to obtain the Index for the Next Node, and then the target leaf node is found.

[0177] Step 605, selecting M data bits from the current to-be-matched data, selecting M rule bits from the K rule bits of the target matching rule, and determining whether the value of each bit in the M data bits is same as the value of the corresponding rule bit in the M rule bits.

[0178] If yes, i.e., the value of each bit in the M data bits is same as the value of the corresponding rule bit in the M rule bits, step 606 is executed, and if no, i.e., the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, step 607 is executed.

[0179] Step 606, determining that the target matching data and the target matching rule are matched successfully, and performing a processing corresponding to the matching success based on the target matching data. For example, obtaining the IP address corresponding to the target matching data from the DNS request message, and storing the IP address in the security table item, so that the data message accessing the IP address can pass through the security device, and the access control of the data message is realized.

[0180] Step 607, determining whether the matching number corresponding to the target matching data is the sum of the number of padding bits and 1. The number of padding bits can be determined based on the minimum effective length and the number of accurate matching bits, such as S=D-R, and in step 607, it can be determined whether the matching number corresponding to the target matching data has reached D-R+1. If yes, step 608 can be executed, and if no, step 609 can be executed.

[0181] For example, the initial value of the matching number corresponding to the target matching data is a preset value (such as 0), and when the current to-be-matched data is selected from the fuzzy matching data for the first time (i.e., the current to-be-matched data is matched with the target matching rule), the matching number corresponding to the target matching data is updated to 1, and when the current to-be-matched data is selected from the fuzzy matching data in each subsequent time, the matching number corresponding to the target matching data is increased by 1.

[0182] Step 608, determining that the target matching data and the target matching rule are matched unsuccessfully, and performing a processing corresponding to the matching failure based on the target matching data. For example, when the IP address corresponding to the target matching data is obtained from the DNS request message, the IP address is prohibited from being stored in the security table item, so that the data message accessing the IP address cannot pass through the security device.

[0183] Step 609, add 1 to the matching number corresponding to the target matching data, and take the next data bit of the current data bit as the current data bit. Repeat the operation of taking the continuous K data bits starting from the current data bit as the current matching data, selecting M data bits from the current matching data, and selecting M rule bits from the K rule bits, until the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, i.e. stop, i.e. re-execute steps 603-609.

[0184] The above steps will be described in detail in combination with specific application scenarios.

[0185] Assuming that the target matching data is the domain name "abcdefgh.com" (a total of 244 characters), the number of accurate matching bits D of the target matching data is 12 bytes (96 bits). Assuming that the minimum effective length R is 2 bytes (16 bits), the number of padding bits S is 10 bytes (80 bits). On this basis, the target matching data can be stored continuously in the memory with a length of (M+D-R), M represents the maximum effective length, i.e. 256 bytes, and (M+D-R) represents the length of the fuzzy matching data, i.e. the length of the fuzzy matching data is 266 bytes (2128 bits).

[0186] Referring to Figure 8 , it is a schematic diagram of fuzzy matching data, the fuzzy matching data includes 12 bytes of accurate matching characters (abcdefgh.com), and the fuzzy matching data includes 254 bytes of special characters. In this way, the target matching data "abcdefgh.com" can be placed in an array of 266 bytes, and the target matching data "abcdefgh.com" is placed on the left, and the remaining positions are filled with special characters that will not appear in the domain name. Figure 8 In the above description, byte granularity is taken as an example. The fuzzy matching data can also be in bit granularity, i.e. for each accurate matching character of the fuzzy matching data, 8 accurate matching bits can be corresponded.

[0187] For the first matching process, the first exact matching character "a" of the fuzzy matching data is taken as the current exact matching character (e.g., the exact matching bit is taken as the current data bit), and the continuous K data bits (e.g., 256 bytes) starting from the current exact matching character are taken as the current to-be-matched data, that is, the current to-be-matched data is the character between two 1s. The first M data bits are selected from the current to-be-matched data, the first M rule bits are selected from the target matching rule, and if the M data bits are the same as the M rule bits, it is determined that the target matching data and the target matching rule match successfully, and the matching process is ended. If the M data bits are different from the M rule bits, since the number of matching times corresponding to the target matching data does not reach the number of padding bits, the second matching process is continued.

[0188] For the second matching process, the second exact matching character "b" of the fuzzy matching data is taken as the current exact matching character, and the continuous K data bits starting from the current exact matching character are taken as the current to-be-matched data, that is, the current to-be-matched data is the character between two 2s. The first M data bits are selected from the current to-be-matched data, the first M rule bits are selected from the target matching rule, and if the M data bits are the same as the M rule bits, it is determined that the target matching data and the target matching rule match successfully, and the matching process is ended. If the M data bits are different from the M rule bits, since the number of matching times corresponding to the target matching data does not reach the number of padding bits, the third matching process is continued.

[0189] For the third matching process, the current to-be-matched data is the character between two 2s, and so on, until the number of matching times corresponding to the target matching data reaches the number of padding bits plus 1, it is determined that the target matching data and the target matching rule match unsuccessfully, or, when the M data bits are the same as the M rule bits, it is determined that the target matching data and the target matching rule match successfully, and the matching process is ended.

[0190] In summary, the matching process between the target matching data and the target matching rule can be completed until it is determined that the target matching data and the target matching rule match successfully or unsuccessfully.

[0191] In the above process, the value of M can be determined based on a target mask. The target mask can include a first-level mask and a second-level mask. The first-level mask is used to indicate which data block of the target matching rule / target matching data includes an exact matching bit, and the second-level mask is used to indicate which rule bit / data bit of the data block is an exact matching bit. In this way, the value of M can be determined based on the first-level mask and the second-level mask, and then the first M data bits are selected from the current to-be-matched data, the first M rule bits are selected from the target matching rule, and it is compared whether the M data bits are the same as the M rule bits.

[0192] From the above, for the first matching process, the matching domain name pointed by the start pointer 0 and the end pointer 255 is queried. For the second matching process, the matching domain name pointed by the start pointer 1 and the end pointer 256 is queried. By analogy, for the last matching process, the matching domain name pointed by the start pointer 10 and the end pointer 265 is queried. In this way, at most 11 times of query are needed, and as long as there is one hit, the hit result is output, and the query is terminated. If all possible matching fuzzy domain names are needed to be found, the 11 times of query are all needed to be completed, and the final query result is obtained.

[0193] In one example, when the target matching data is matched with the target matching rule, there are three cases of matching result, any one of the target matching rules is hit, all of the target matching rules are not hit, and all of the target matching rules that can be hit are found. In this embodiment, for the target leaf node corresponding to the target matching data, the target leaf node can have no target matching rule, the target leaf node can have one target matching rule, and the target leaf node can have multiple target matching rules in a "big bag small" relationship. On this basis, for the above three cases, the following matching processing modes can be used.

[0194] 1. For finding all of the target matching rules that can be hit.

[0195] The first case is that the target matching data does not hit the target matching rule, the matching fails, and the query is terminated.

[0196] The second case is that the first-level mask and the second-level mask are used to do the exact matching of the target matching data and the target matching rule, the target matching data can hit the target matching rule, the matching succeeds, the query is terminated, or the target matching data does not hit the target matching rule, the matching fails, and the query is terminated.

[0197] The third case, considering that a hit "small" rule can certainly hit a "big" rule, a hit "big" rule can not necessarily hit a "small" rule, therefore, the "small" rule is arranged in front, and the "big" rule is arranged in back. Based on this, if the target leaf node includes a first matching rule and a second matching rule, and the first matching rule envelopes the second matching rule, the first matching rule is a "big" rule, the second matching rule is a "small" rule, and the second matching rule is arranged in front of the first matching rule. On this basis, after a first "small" rule is matched and hit, the subsequent rule can also be hit, and the hit "small" rule and all rules after the "small" rule can be output at the same time. For example, if the target matching data matches the first matching rule, if the target matching data hits the first matching rule, the matching is successful, the query is ended, and the first matching rule and the second matching rule can be output at the same time, indicating that multiple rules are hit at the same time.

[0198] 2. All target matching rules are not hit.

[0199] The first case, the target matching data does not hit the target matching rule, the matching fails, and the query is ended.

[0200] The second case, the target matching data and the target matching rule are matched by using a first-level mask and a second-level mask, the target matching data can hit the target matching rule, the matching is successful, the query is ended, or the target matching data does not hit the target matching rule, the matching fails, and the query is ended.

[0201] The third case, considering that a hit "small" rule can certainly hit a "big" rule, a hit "big" rule can not necessarily hit a "small" rule, therefore, the "big" rule is arranged in front, and the "small" rule is arranged in back. Based on this, if the target leaf node includes a first matching rule and a second matching rule, and the first matching rule envelopes the second matching rule, the first matching rule is a "big" rule, the second matching rule is a "small" rule, and the second matching rule is arranged in front of the first matching rule. On this basis, after a first "small" rule is matched and hit, the subsequent rule can also be hit, and the hit "small" rule and all rules after the "small" rule can be output at the same time. For example, if the target matching data matches the first matching rule, if the target matching data hits the first matching rule, the matching is successful, the query is ended, and the first matching rule and the second matching rule can be output at the same time, indicating that multiple rules are hit at the same time.

[0202] 3. Any one of the target matching rules is hit.

[0203] The first case, the target matching data does not hit the target matching rule, the matching fails, and the query is ended.

[0204] The second case is that the target matching data and the target matching rule are matched by using the first mask and the second mask. The target matching data can hit the target matching rule, the matching is successful, the query is ended, or the target matching data does not hit the target matching rule, the matching is failed, and the query is ended.

[0205] The third case is that the hit "small" rule can hit the "large" rule, but the hit "large" rule can not hit the "small" rule. Therefore, the "large" rule is arranged in front of the "small" rule. After the first "large" rule is hit, the matching can be stopped, and the query is ended. Based on this, if the target leaf node includes the first matching rule and the second matching rule, and the first matching rule envelopes the second matching rule, the first matching rule is arranged in front of the second matching rule. When the target matching data is matched with the second matching rule, if the target matching data hits the second matching rule, the matching is successful, and the query is ended.

[0206] From the above technical solutions, in the embodiment of the present application, the current matching data does not need to be matched with all the matching rules, the matching times are reduced, the matching performance is improved, the performance of the accurate and fuzzy matching is greatly improved, the matching time is reduced, and the matching performance can meet the actual demand. The accurate matching bit is indicated by the target mask, the accurate matching is optimized, only the accurate matching bit needs to be matched, the matching performance is further improved, and the matching time is reduced. After the target matching data is split and queried multiple times, the fuzzy matching of the accurate matching field position is realized, the performance of the fuzzy matching of the accurate matching field position of the massive data is significantly improved, the matching performance in the case of massive rules is significantly improved, the performance of the accurate and fuzzy matching is greatly improved, and the matching performance is more stable.

[0207] The performance of the fuzzy matching of the accurate matching field position of the massive data can be significantly improved. The fuzzy matching of the internet English domain name is taken as an experimental object (the algorithm is not limited to the fuzzy matching of the internet English domain name, and is suitable for any scene of the fuzzy matching of the accurate matching field position of the massive data). The time consumption of the single domain name matching any subdomain name is measured in the case of the massive fuzzy subdomain names.

[0208] The experimental conditions of the experiment are as follows: the maximum length of the domain name is 253 bytes, the domain name rule is expanded to 256 bytes, that is, 2 to the power of 8, for easy calculation, and the remaining part is a wildcard character. The characters used in the domain name are letters (a-z, A-Z), numbers (0-9), hyphens (-), and separators (.). The format of the rule domain name used for matching is *** xyz***, the front and rear * represent wildcard characters, and xyz represents a subdomain name. The total number of wildcard characters and subdomain names is 256, and the number of wildcard characters in front and rear can be 0. Here, xyz is only an example, and in the experiment, it is randomly generated, with a length of 1-255, and the number of rule domain names is 8K, 16K, 32K, and 100K, 1K representing 1024. The data domain name used for matching is selected from the domain names of a well-known website.

[0209] The experimental group of the experiment is the above technical solution of the embodiment, and the control group uses the substring matching library function strcasestr to perform traversal search. In the case of the same device environment, the same number of rule domain names, and the same data domain name, a plurality of groups of data are measured and averaged, and the comparison results can be seen from Table 3.

[0210] Table 3

[0211]

[0212] As can be seen from Table 3, the time consumption of a single matching of the algorithm is in the order of thousands of nanoseconds to ten thousand nanoseconds, and only differs by one order of magnitude, while the control group is between 100,000 nanoseconds and 1 million nanoseconds, and differs by two orders of magnitude. Since the average value is taken from multiple experiments, the original data before the average is still in the order of thousands of nanoseconds to ten thousand nanoseconds, while the best of the control group is in the order of thousands of nanoseconds, the worst is in the order of 1 million nanoseconds, and the maximum difference is 4 orders of magnitude. Therefore, the matching performance of the algorithm is more stable than that of the control group, with smaller fluctuations.

[0213] Compared with the traversal matching of strcasestr, the performance of the algorithm is improved by 10-1000 times whether it matches or not, and the more the number of rule domain names, the more obvious the improvement.

[0214] Based on the same application concept as the above method, an application embodiment proposes a data fuzzy matching device, as shown in Figure 9A The device can include:

[0215] The generating module 911 is configured to obtain target matching data, and obtain fuzzy matching data according to the target matching data; take the first data bit of the fuzzy matching data as a current data bit, and take the continuous K data bits starting from the current data bit as current to-be-matched data.

[0216] The acquisition module 912 is configured to query a target leaf node corresponding to the current data to be matched from all leaf nodes of the established decision tree, where the target leaf node is used to record a target matching rule and a target mask; the target matching rule includes K rule bits, and the target mask is used to indicate that M rule bits in the K rule bits are used as exact matching bits.

[0217] The determination module 913 is configured to select M data bits from the current data to be matched and select M rule bits from the K rule bits; if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, the processing corresponding to a matching success is performed based on the target matching data; if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, a next data bit of the current data bit is used as the current data bit, and the generation module 911 is configured to use the continuous K data bits starting from the current data bit as the current data to be matched.

[0218] In one example, the generation module 911 is configured to obtain the fuzzy matching data according to the target matching data in the following manner: determining the number of padding bits based on the number of exact matching bits in the target matching data and a minimum effective length; the minimum effective length is the minimum value of the effective lengths of all matching rules corresponding to the decision tree; adding the number of padding bits at the back of the target matching data to obtain the fuzzy matching data, and the padding bits are special character bits that do not appear in the target matching rule; and the determination module 913 is further configured to determine whether the matching number corresponding to the target matching data is the sum of the number and 1 if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits; the initial value of the matching number corresponding to the target matching data is a preset value; if not, the matching number corresponding to the target matching data is increased by 1, and a next data bit of the current data bit is used as the current data bit; and if yes, the processing corresponding to a matching failure is performed based on the target matching data.

[0219] In an example, the apparatus further includes an establishing module configured to establish the decision tree, and the establishing module is configured to, when establishing the decision tree, obtain a plurality of matching rules, each of the matching rules including K rule bits; determine a maximum BSS value of the BSS values of each rule bit as a reference rule bit based on the BSS values of each rule bit; divide all the matching rules into leaf nodes based on the reference rule bit to obtain a current decision tree; determine whether the current decision tree satisfies an end division condition; if not, determine a maximum BSS value of the BSS values of the remaining rule bits other than the reference rule bit as a reference rule bit based on the BSS values of the remaining rule bits; divide all the matching rules into a plurality of leaf nodes based on all the reference rule bits to obtain a current decision tree, and repeatedly perform the operation of determining whether the current decision tree satisfies the end division condition until the current decision tree satisfies the end division condition; if yes, determine the current decision tree as the established decision tree, and generate a bit mask for the decision tree, the bit mask being configured to indicate all the reference rule bits.

[0220] In an example, the end division condition includes: a target space factor of the current decision tree is not less than a space factor threshold; the space factor threshold is a maximum value that a configured target space factor can reach; or the space factor threshold is a configured maximum floating point number; a leaf node rule reference number of the current decision tree is not greater than a leaf node rule number threshold; the leaf node rule number threshold is a configured specified value; and the matching rules in each leaf node of the current decision tree cannot be further divided into two leaf nodes.

[0221] In an example, the establishing module is configured to: obtain a plurality of original rules configured; for each original rule, if a number of rule bits in the original rule is less than K, supplement wildcard bits to the original rule to obtain a supplemented rule, wherein a number of rule bits in the supplemented rule is equal to K, and K is 2 raised to the power of n, where n is a positive integer; if the supplemented rule includes exact match bits and wildcard bits, arrange all the exact match bits in left alignment or right alignment to obtain a matching rule corresponding to the original rule; and the obtaining module 912 is configured to: obtain original matching data input; if a number of data bits in the original matching data is less than K, supplement special character bits to the original matching data to obtain supplemented matching data, wherein a number of data bits in the supplemented matching data is equal to K; if the supplemented matching data includes exact match bits and special character bits, arrange all the exact match bits in left alignment or right alignment to obtain the target matching data.

[0222] In an example, the matching rule in the leaf node is configured with a target mask, and the target mask includes a primary mask and a secondary mask.

[0223] In an example, the K rule bits of the matching rule are divided into P1 data blocks, the primary mask includes P1 bits, and the P1 bits correspond to the P1 data blocks one by one; for each data block, if the data block includes an exact match bit, a value of a bit corresponding to the data block in the primary mask is a first value, and the first value indicates that the data block includes an exact match bit; if the data block does not include an exact match bit, a value of a bit corresponding to the data block in the primary mask is a second value, and the second value indicates that the data block does not include an exact match bit.

[0224] In an example, for each data block, if the data block does not include an exact match bit, the data block does not correspond to a secondary mask; if the data block includes an exact match bit, the data block corresponds to a secondary mask.

[0225] In an example, if the data block includes P2 rule bits, the secondary mask includes P2 bits, and the P2 bits correspond to the P2 rule bits one by one.

[0226] For each rule bit, if the rule bit is an exact match bit, a value of a bit corresponding to the rule bit in the second mask is a third value, and the third value represents the exact match bit; if the rule bit is a universal match bit, a value of a bit corresponding to the rule bit in the second mask is a fourth value, and the fourth value represents the universal match bit.

[0227] In one example, if the first match rule and the second match rule exist in the leaf node, and a rule range of the first match rule is greater than a rule range of the second match rule, a position of the second match rule in the leaf node is in front of a position of the first match rule in the leaf node.

[0228] Based on the same application concept as the above method, an electronic device is provided in the embodiments of the present application, referring to Figure 9B As shown in the figure, the electronic device includes a processor 921 and a machine readable storage medium 922, the machine readable storage medium 922 stores machine executable instructions which can be executed by the processor 921; the processor 921 is configured to execute the machine executable instructions to implement the data fuzzy matching method disclosed in the above examples of the present application.

[0229] Based on the same application concept as the above method, the embodiments of the present application further provide a machine readable storage medium, the machine readable storage medium stores a plurality of computer instructions, and the computer instructions can implement the data fuzzy matching method disclosed in the above examples of the present application when executed by a processor.

[0230] The machine readable storage medium can be any electronic, magnetic, optical, or other physical storage device, and can contain or store information such as executable instructions, data, and the like. For example, the machine readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state drive, any type of storage disk (such as an optical disk, a DVD, etc.), or similar storage medium, or a combination thereof.

[0231] Based on the same application concept as the above method, the embodiments of the present application further provide a computer program product, the computer program product can include a computer program, and the computer program can implement the data fuzzy matching method disclosed in the above examples of the present application when executed by a processor.

[0232] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer-usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0233] The foregoing is merely illustrative of the embodiments of this application, and is not intended to limit the application. Numerous variations and modifications can be possible to the embodiments of the present application based on the description of this application. Any modifications, equivalents, improvements, combinations, or the like not described above are also intended to be within the scope of the present application.

Claims

1. A method of data fuzzy matching, the method comprising: The method comprises: obtaining target matching data, and obtaining fuzzy matching data according to the target matching data; taking a first data bit of the fuzzy matching data as a current data bit, and taking K continuous data bits starting from the current data bit as current to-be-matched data; querying a target leaf node corresponding to the current to-be-matched data from all leaf nodes of an established decision tree, the target leaf node being used for recording a target matching rule and a target mask; wherein the target matching rule comprises K rule bits, and the target mask is used for indicating that M rule bits in the K rule bits are exact matching bits; selecting M data bits from the current to-be-matched data, and selecting M rule bits from the K rule bits; if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, performing a matching success corresponding processing based on the target matching data; if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, taking a next data bit of the current data bit as the current data bit, and repeatedly performing the operation of taking K continuous data bits starting from the current data bit as the current to-be-matched data, selecting M data bits from the current to-be-matched data, and selecting M rule bits from the K rule bits, until the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits.

2. The method of claim 1, wherein, The method further comprises: determining the number of padding bits based on the number of exact matching bits in the target matching data and a minimum effective length; wherein the minimum effective length is the minimum value of the effective lengths of all matching rules corresponding to the decision tree; adding the number of padding bits to the back of the target matching data to obtain the fuzzy matching data, the padding bits being special character bits that do not appear in the target matching rule; if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, before taking the next data bit of the current data bit as the current data bit, the method further comprises: determining whether the matching number corresponding to the target matching data is the sum of the number and 1; wherein the initial value of the matching number corresponding to the target matching data is a preset value; if not, increasing the matching number corresponding to the target matching data by 1, and taking the next data bit of the current data bit as the current data bit; if yes, performing a matching failure corresponding processing based on the target matching data.

3. The method of claim 1 or 2, wherein, before the querying of the target leaf node corresponding to the current to-be-matched data from all leaf nodes of the established decision tree, the method further comprises: ​ obtaining a plurality of matching rules, each of which includes K rule bits; based on the bit separable set (BSS) value of each rule bit, taking the rule bit with the maximum BSS value as a reference rule bit; based on the reference rule bit, dividing all the matching rules into leaf nodes to obtain a current decision tree; determining whether the current decision tree meets an end division condition; if not, taking the rule bit with the maximum BSS value among the BSS values of the remaining rule bits other than the reference rule bit as a reference rule bit again; based on all the reference rule bits, dividing all the matching rules into a plurality of leaf nodes to obtain a current decision tree, and repeatedly performing the operation of determining whether the current decision tree meets the end division condition until the current decision tree meets the end division condition and stops; if yes, determining the current decision tree as the established decision tree, and generating a bit mask for the decision tree, the bit mask being used to indicate all the reference rule bits.

4. The method of claim 3, wherein, The end division condition includes: a target space factor of the current decision tree is not less than a space factor threshold; wherein the space factor threshold is a maximum value that a configured target space factor can reach; or the space factor threshold is a configured maximum floating point number; a leaf node rule reference number of the current decision tree is not greater than a leaf node rule number threshold; wherein the leaf node rule number threshold is a specified value that has been configured; the matching rules in each leaf node of the current decision tree cannot be further divided into two leaf nodes; The determination of whether the current decision tree meets the end division condition specifically includes: if the current decision tree meets any one of the end division conditions, it is determined that the current decision tree has met the end division condition; if the current decision tree does not meet each of the end division conditions, it is determined that the current decision tree has not met the end division condition.

5. The method of claim 3, wherein, The obtaining of the plurality of matching rules specifically includes: obtaining a plurality of configured original rules; for each original rule, if the number of rule bits in the original rule is less than K, supplementing the original rule with a wildcard bit to obtain a supplemented rule, the number of rule bits in the supplemented rule being equal to K, K being 2 raised to the power of n, n being a positive integer; if the supplemented rule includes an exact match bit and a general match bit, all the exact match bits are arranged in left alignment or right alignment to obtain a matching rule corresponding to the original rule; The obtaining of the target matching data specifically includes: obtaining an original matching data that has been input; if the number of data bits in the original matching data is less than K, supplementing the original matching data with a special character bit to obtain a supplemented matching data, the number of data bits in the supplemented matching data being equal to K; if the supplemented matching data includes an exact match bit and a special character bit, all the exact match bits are arranged in left alignment or right alignment to obtain the target matching data.

6. The method of claim 3, wherein, The matching rule in the leaf node is configured with a target mask, and the target mask includes a first-level mask and a second-level mask; The K rule bits of the matching rule are divided into P1 data blocks, the first-level mask includes P1 bits, and the P1 bits correspond to the P1 data blocks one by one; for each data block, when there is an exact match bit in the data block, the value of the bit corresponding to the data block in the first-level mask is a first value, and the first value indicates that there is an exact match bit in the data block; when there is no exact match bit in the data block, the value of the bit corresponding to the data block in the first-level mask is a second value, and the second value indicates that there is no exact match bit in the data block; For each data block, when there is no exact match bit in the data block, the data block does not correspond to a second-level mask; when there is an exact match bit in the data block, the data block corresponds to a second-level mask; When the data block includes P2 rule bits, the second-level mask includes P2 bits, and the P2 bits correspond to the P2 rule bits one by one; For each rule bit, when the rule bit is an exact match bit, the value of the bit corresponding to the rule bit in the second-level mask is a third value, and the third value indicates an exact match bit; when the rule bit is a general match bit, the value of the bit corresponding to the rule bit in the second-level mask is a fourth value, and the fourth value indicates a general match bit.

7. The method of claim 3, wherein, If there are a first matching rule and a second matching rule in the leaf node, and the rule range of the first matching rule is greater than the rule range of the second matching rule, the position of the second matching rule in the leaf node is in front of the position of the first matching rule in the leaf node.

8. A data fuzzy matching apparatus, characterized by, The device includes: A generation module configured to obtain target matching data, and obtain fuzzy matching data according to the target matching data; take a first data bit of the fuzzy matching data as a current data bit, and take K consecutive data bits starting from the current data bit as current to-be-matched data; An acquisition module configured to query a target leaf node corresponding to the current to-be-matched data from all leaf nodes of an established decision tree, the target leaf node being configured to record a target matching rule and a target mask; the target matching rule includes K rule bits, and the target mask is configured to indicate that M rule bits in the K rule bits are exact match bits. The determining module is configured to select M data bits from the current to-be-matched data and select M rule bits from the K rule bits; if the value of each bit in the M data bits is the same as the value of the corresponding rule bit in the M rule bits, the processing corresponding to a matching success is performed based on the target matching data; if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, a next data bit of the current data bit is taken as the current data bit, and the generating module takes the continuous K data bits starting from the current data bit as the current to-be-matched data.

9. The apparatus of claim 8, wherein, The generating module is configured to obtain the fuzzy matching data according to the target matching data by: determining the number of padding bits based on the number of exact matching bits in the target matching data and the minimum effective length; the minimum effective length is the minimum value of the effective lengths of all matching rules corresponding to the decision tree; adding the number of padding bits at the back of the target matching data to obtain the fuzzy matching data, the padding bits being special character bits that do not appear in the target matching rule; The determining module is further configured to, if the value of each bit in the M data bits is different from the value of the corresponding rule bit in the M rule bits, determine whether the matching number corresponding to the target matching data is the sum of the number and 1; the initial value of the matching number corresponding to the target matching data is a preset value; if not, the matching number corresponding to the target matching data is incremented by 1, and a next data bit of the current data bit is taken as the current data bit; if yes, the processing corresponding to a matching failure is performed based on the target matching data.

10. The apparatus of claim 8 or 9, wherein, The apparatus further includes an establishing module configured to establish the decision tree; the establishing module is specifically configured to: obtain a plurality of matching rules, each matching rule including K rule bits; determine a rule bit with a maximum BSS value as a reference rule bit based on the BSS values of the rule bits; divide all the matching rules to leaf nodes based on the reference rule bit to obtain a current decision tree; determine whether the current decision tree satisfies an end division condition; if not, determine a rule bit with a maximum BSS value among the BSS values of the remaining rule bits other than the reference rule bit as a new reference rule bit again; divide all the matching rules to a plurality of leaf nodes based on all the reference rule bits to obtain a current decision tree, and repeatedly perform the operation of determining whether the current decision tree satisfies the end division condition until the current decision tree satisfies the end division condition and stops; if yes, determine the current decision tree as the established decision tree, and generate a bit mask for the decision tree, the bit mask being configured to indicate all the reference rule bits.

11. The apparatus of claim 10, wherein, The end partition condition comprises: a target space factor of the current decision tree is not less than a space factor threshold value; the space factor threshold value is a maximum value that a configured target space factor can reach; or the space factor threshold value is a maximum floating point number that has been configured; a leaf node rule reference quantity of the current decision tree is not greater than a leaf node rule number threshold value; the leaf node rule number threshold value is a specified value that has been configured; and matching rules in each leaf node of the current decision tree cannot continue to be partitioned into two leaf nodes. The establishing module is specifically configured to determine that the current decision tree has met the end partition condition if the current decision tree meets any one of the end partition conditions; and determine that the current decision tree has not met the end partition condition if the current decision tree does not meet each of the end partition conditions.

12. The apparatus of claim 10, wherein the establishing module is configured to: The establishing module is specifically configured to: obtain a plurality of original rules that have been configured; for each original rule, if a quantity of rule bit positions in the original rule is less than K, supplement a wildcard bit position to the original rule to obtain a supplemented rule, a quantity of rule bit positions in the supplemented rule is equal to K, K is 2 raised to the power of n, and n is a positive integer; and if the supplemented rule comprises an exact match bit position and a wildcard bit position, left-justify and continuously arrange or right-justify and continuously arrange all exact match bit positions to obtain a matching rule corresponding to the original rule; The obtaining module is specifically configured to: obtain original matching data that has been input; if a quantity of data bit positions in the original matching data is less than K, supplement a special character bit position to the original matching data to obtain supplemented matching data, a quantity of data bit positions in the supplemented matching data is equal to K; and if the supplemented matching data comprises an exact match bit position and a special character bit position, left-justify and continuously arrange or right-justify and continuously arrange all exact match bit positions to obtain the target matching data. The matching rule in the leaf node is configured with a target mask, and the target mask comprises a first-level mask and a second-level mask; 13. The apparatus of claim 10, wherein, The K rule bit positions of the matching rule are partitioned into P1 data blocks, the first-level mask comprises P1 bit positions, and the P1 bit positions correspond to the P1 data blocks one by one; for each data block, if the data block comprises an exact match bit position, a value of a bit position corresponding to the data block in the first-level mask is a first value, and the first value indicates that the data block comprises an exact match bit position; and if the data block does not comprise an exact match bit position, a value of a bit position corresponding to the data block in the first-level mask is a second value, and the second value indicates that the data block does not comprise an exact match bit position. ​ Wherein, for each data block, if there is no exact match bit in the data block, the data block does not correspond to the secondary mask; if there is an exact match bit in the data block, the data block corresponds to the secondary mask; Wherein, if the data block includes P2 regular bits, the secondary mask includes P2 bits, and the P2 bits correspond to the P2 regular bits one by one; For each regular bit, if the regular bit is an exact match bit, the value of the bit corresponding to the regular bit in the secondary mask is a third value, and the third value represents an exact match bit; if the regular bit is a general match bit, the value of the bit corresponding to the regular bit in the secondary mask is a fourth value, and the fourth value represents a general match bit.

14. The apparatus of claim 10, wherein, If the first match rule and the second match rule exist in the leaf node, and the rule range of the first match rule is greater than the rule range of the second match rule, the position of the second match rule in the leaf node is in front of the position of the first match rule in the leaf node.

15. An electronic device, comprising: comprising: a processor and a machine readable storage medium storing machine executable instructions executable by the processor; the processor is configured to execute the machine executable instructions to implement the method of any one of claims 1-7.

Images