Data processing method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a data processing method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining a target search processing language code in a rule operation and maintenance scene from a code analysis input interface, determining a target logic operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logic operator, determining a conditional clause corresponding to the target logic operator, and generating a code structure display graph based on the hierarchical relationship information, the target logic operator and the conditional clause, and displaying the code structure display diagram on the code analysis input interface. Therefore, the code structure display graph is generated through the hierarchical relationship information, the target logic operator and the condition clause, so that the target search processing language code is converted into a structure form which is convenient to understand and can be refined, the structure form is displayed in the code structure display graph, and safety analysts are helped to quickly understand the target search processing language code.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a data processing method and device, a storage medium, and an electronic device. BACKGROUND

[0002] In related technologies, log data is crucial for monitoring and analyzing the security state of a system. As the operating environment of the system becomes more complex, the rules used for security analysis of log data are gradually refined. The refinement of rules, although helpful in improving security and the accuracy of problem troubleshooting, also presents obvious challenges. On the one hand, the refinement of rules increases the complexity of reading, and the dramatic increase in information volume makes it easy for analysts to miss critical data, increasing the workload. On the other hand, with the increase and change of rules, the maintenance of rules becomes increasingly difficult, and if the rules are not properly set or updated in a timely manner, the system may not be able to detect potential security threats in a timely manner.

[0003] Therefore, in the security operation analysis of log data, how to convert refined security operation rules into a visual form that is easy to understand is a technical problem that needs to be solved for those skilled in the art. SUMMARY

[0004] Embodiments of the present application provide a data processing method, device, computer storage medium, and electronic device. The technical solution is as follows: In a first aspect, the embodiments of the present application provide a data processing method, which comprises: obtaining a target search processing language code in a rule operation and maintenance scene from a code parsing input interface; determining a target logical operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logical operator, and determining a condition clause corresponding to the target logical operator; generating a code structure display diagram based on the hierarchical relationship information, the target logical operator, and the condition clause; displaying the code structure display diagram on the code parsing input interface.

[0005] In combination with the first aspect, in some possible implementations, the determination of the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and the determination of the condition clause corresponding to the target logical operator, comprises: performing code parsing processing based on the target search processing language code by using a code parsing large model to obtain the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the condition clause corresponding to the target logical operator.

[0006] In combination with the above-mentioned embodiments, in some possible embodiments, the code parsing large model performs code parsing processing on the target search processing language code based on the target search processing language code to obtain a target logical operator corresponding to the target search processing language code, hierarchical relationship information corresponding to the target logical operator, and a condition clause corresponding to the target logical operator, which includes: The code parsing large model performs logical operator searching processing on the target search processing language code to obtain a root-level logical operator; The first condition clause corresponding to the root-level logical operator is determined; It is judged whether the first condition clause includes a sub-level logical operator; If the first condition clause includes a sub-level logical operator, the sub-level logical operator is taken as the root-level logical operator, and the step of determining the first condition clause corresponding to the root-level logical operator is executed; If the first condition clause does not include a sub-level logical operator, the first condition clause is determined as a second condition clause, the root-level logical operator is determined as a target logical operator, hierarchical relationship information corresponding to the target logical operator is determined, and the second condition clause is determined as a condition clause corresponding to the target logical operator.

[0007] In combination with the above-mentioned embodiments, in some possible embodiments, the code parsing large model performs logical operator searching processing on the target search processing language code to obtain a root-level logical operator, which includes: The code parsing large model identifies a reference logical operator in the target search processing language code and determines nested position information corresponding to the reference logical operator; The root-level logical operator is determined from the reference logical operator based on the nested position information.

[0008] In combination with the first aspect, in some possible embodiments, the code structure display diagram is generated based on the hierarchical relationship information, the target logical operator, and the condition clause, which includes: A root-layer logical operator and a sub-layer logical operator corresponding to the root-layer logical operator are determined in the target logical operator based on the hierarchical relationship information; A parallel condition clause corresponding to the sub-layer logical operator is determined from the condition clause; A root-layer editing component is determined based on the root-layer logical operator, a condition clause editing component and a sub-layer editing component connected to the root-layer editing component are determined based on the parallel condition clause and the sub-layer logical operator; The code structure display diagram is generated based on the root-layer editing component, the condition clause editing component, and the sub-layer editing component.

[0009] In combination with the above-mentioned embodiments, in some possible embodiments, the generating the code structure display diagram based on the root layer editing component, the conditional clause editing component, and the sub-layer editing component comprises: determining whether the sub-layer logical operator comprises a base layer logical operator; if the sub-layer logical operator comprises the base layer logical operator, determining the sub-layer logical operator as the root layer logical operator, determining the base layer logical operator as the sub-layer logical operator, and performing the steps of determining the parallel conditional clause corresponding to the sub-layer logical operator from the conditional clause, determining the root layer editing component based on the root layer logical operator, and determining the conditional clause editing component and the sub-layer editing component connected to the root layer editing component based on the parallel conditional clause and the sub-layer logical operator; if the sub-layer logical operator does not comprise the base layer logical operator, determining the base layer conditional clause corresponding to the sub-layer logical operator from the conditional clause, determining the base layer conditional clause editing component connected to the sub-layer logical operator based on the base layer conditional clause, and generating the code structure display diagram based on all root layer editing components, all conditional clause editing components, all sub-layer editing components, and all base layer conditional clause editing components.

[0010] In combination with the first aspect, in some possible embodiments, the displaying the code structure display diagram in the code parsing input interface comprises: obtaining a first display area of the target search processing language code in the code parsing input interface, determining a second display area in the code parsing input interface based on the first display area; displaying the code structure display diagram in the second display area.

[0011] The second aspect, the embodiments of the present application provide a data processing device, the device comprises: a code obtaining module configured to obtain a target search processing language code in a rule operation and maintenance scenario from a code parsing input interface; a code parsing module configured to determine a target logical operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logical operator, and determine a conditional clause corresponding to the target logical operator; a structure generating module configured to generate a code structure display diagram based on the hierarchical relationship information, the target logical operator, and the conditional clause; a structure display module configured to display the code structure display diagram in the code parsing input interface.

[0012] Optionally, the code parsing module comprises: The code parsing unit is configured to perform code parsing processing on the target search processing language code based on the code parsing large model to obtain a target logical operator corresponding to the target search processing language code, hierarchical relationship information corresponding to the target logical operator, and a condition clause corresponding to the target logical operator.

[0013] Optionally, the code parsing unit comprises: The first parsing subunit is configured to perform logical operator searching processing on the target search processing language code based on the code parsing large model to obtain a root-level logical operator. The second parsing subunit is configured to determine a first condition clause corresponding to the root-level logical operator. The third parsing subunit is configured to determine whether the first condition clause comprises a sub-level logical operator. The fourth parsing subunit is configured to, if the first condition clause comprises a sub-level logical operator, take the sub-level logical operator as the root-level logical operator and perform the step of determining the first condition clause corresponding to the root-level logical operator. The fifth parsing subunit is configured to, if the first condition clause does not comprise a sub-level logical operator, determine the first condition clause as a second condition clause, determine the root-level logical operator as a target logical operator, determine hierarchical relationship information corresponding to the target logical operator, and determine the second condition clause as a condition clause corresponding to the target logical operator.

[0014] Optionally, the first parsing subunit is specifically configured to: identify a reference logical operator in the target search processing language code based on the code parsing large model and determine nesting position information corresponding to the reference logical operator. determine a root-level logical operator from the reference logical operator based on the nesting position information.

[0015] Optionally, the structure generation module comprises: The first structure generation unit is configured to determine a root-layer logical operator and a sub-layer logical operator corresponding to the root-layer logical operator in the target logical operator based on the hierarchical relationship information. The second structure generation unit is configured to determine a parallel condition clause corresponding to the sub-layer logical operator from the condition clause. The third structure generation unit is configured to determine a root-layer editing component based on the root-layer logical operator, and determine a condition clause editing component and a sub-layer editing component connected to the root-layer editing component based on the parallel condition clause and the sub-layer logical operator. The fourth structure generation unit is configured to generate a code structure display diagram based on the root layer editing component, the conditional clause editing component, and the sub-layer editing component.

[0016] Optionally, the fourth structure generation unit is specifically configured to: determine whether the sub-layer logical operator includes a base layer logical operator; if the sub-layer logical operator includes the base layer logical operator, determine the sub-layer logical operator as the root layer logical operator, determine the base layer logical operator as the sub-layer logical operator, and perform the steps of determining the parallel conditional clause corresponding to the sub-layer logical operator from the conditional clause, determining the root layer editing component based on the root layer logical operator, and determining the conditional clause editing component connected with the root layer editing component and the sub-layer editing component based on the parallel conditional clause and the sub-layer logical operator; if the sub-layer logical operator does not include the base layer logical operator, determine the base layer conditional clause corresponding to the sub-layer logical operator from the conditional clause, determine the base layer conditional clause editing component connected with the sub-layer logical operator based on the base layer conditional clause, and generate a code structure display diagram based on all root layer editing components, all conditional clause editing components, all sub-layer editing components, and all base layer conditional clause editing components.

[0017] Optionally, the structure display module is specifically configured to: obtain a first display area of the target search processing language code in the code parsing input interface, and determine a second display area in the code parsing input interface based on the first display area; display the code structure display diagram in the second display area.

[0018] In a third aspect, an embodiment of the present application provides a computer storage medium, which has a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method described above.

[0019] In a fourth aspect, an embodiment of the present application provides an electronic device, which can include a memory and a processor; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the memory and executing the method described above.

[0020] The technical scheme provided by the embodiment of the present application has at least the following beneficial effects: The data processing method provided in the embodiments of the present application obtains a target search processing language code in a rule operation and maintenance scene from a code parsing input interface, determines a target logical operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logical operator, determines a condition clause corresponding to the target logical operator, generates a code structure display diagram based on the hierarchical relationship information, the target logical operator and the condition clause, and displays the code structure display diagram on the code parsing input interface. In this way, the target search processing language code is converted into a structure form that is easy to understand and can be refined by determining the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the condition clause corresponding to the target logical operator, and generating the code structure display diagram based on the hierarchical relationship information, the target logical operator and the condition clause, so that the target search processing language code is displayed in the code structure display diagram, which helps security analysts to quickly understand the target search processing language code, thereby improving the efficiency of the security analysts in maintaining the target search processing language code. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0022] Figure 1 FIG. 1 is a flowchart of a data processing method provided in the embodiments of the present application; Figure 2 FIG. 2 is a flowchart of another data processing method provided in the embodiments of the present application; Figure 3 FIG. 3 is a flowchart of a code parsing method of a target search processing language code provided in the embodiments of the present application; Figure 4 FIG. 4 is a code structure display diagram provided in the embodiments of the present application; Figure 5 FIG. 5 is a structural diagram of a data processing device provided in the embodiments of the present application; Figure 6 FIG. 6 is a structural diagram of an electronic device provided in the embodiments of the present application. DETAILED DESCRIPTION

[0023] In order to make the application purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0024] In the description of the present application, it should be understood that the terms "first", "second" and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance. In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device. Those skilled in the art can understand the specific meaning of the above terms in the present application according to the specific circumstances. In addition, in the description of the present application, "multiple" means two or more, unless otherwise specified. "And / or" describes the relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally represents a "or" relationship between the associated objects.

[0025] The present application will be described in detail below with reference to specific embodiments.

[0026] In one embodiment, as shown in Figure 1 A data processing method is specifically proposed, which can be implemented depending on a computer program and can be run on a data processing device based on von Neumann architecture. The computer program can be integrated in an application or run as an independent tool application.

[0027] Specifically, the data processing method comprises: S101, obtaining target search processing language code in a rule operation and maintenance scene from a code analysis input interface.

[0028] It can be understood that the code analysis input interface refers to a user interface for inputting search processing language code.

[0029] The rule operation and maintenance scene refers to a context in which a security technician or a security analyst maintains or constructs a security operation rule. The security operation rule refers to a related security rule used when performing security analysis on security data logs.

[0030] The target search processing language code refers to a code for representing a certain security operation rule, which is written using a search processing language (SPL) syntax.

[0031] In some embodiments, step S101 is performed, specifically, the target search processing language code in the rule operation and maintenance scene is acquired from the code parsing input interface after receiving the sentence parsing instruction. The sentence parsing instruction can be generated after detecting a touch operation input by a user on the sentence parsing control.

[0032] S102, determining a target logical operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logical operator, and determining a condition clause corresponding to the target logical operator.

[0033] It can be understood that the target logical operator refers to a logical operator used in the target search processing language code to connect multiple conditions. In the embodiments of the present application, for the SPL syntax, the target logical operator can include an operator (such as AND) for connecting multiple conditions together and representing that these conditions are met at the same time, an operator (such as OR) for connecting multiple conditions together and representing that at least one of the conditions is met, an operator (such as NOT) for representing excluding a certain condition, and the like.

[0034] The hierarchical relationship information refers to information for representing the hierarchical relationship between multiple target logical operators. For example, the target logical operator can include a first logical operator, a second logical operator, a third logical operator, a fourth logical operator, and a fifth logical operator. The first logical operator and the second logical operator are the outermost logical operators in the target search processing language code, the third logical operator and the fourth logical operator are logical operators included in a certain end condition connected by the second logical operator, and the fifth logical operator is a logical operator included in a certain end condition connected by the fourth logical operator. Then, the hierarchical relationship information can be described as: the first logical operator and the second logical operator are the outermost logical operators, the third logical operator and the fourth logical operator are the next level logical operators of the second logical operator, and the fifth logical operator is the next level logical operator of the fourth logical operator.

[0035] The condition clause refers to a specific condition expression connected by each target logical operator in the target search processing language code. For example, a certain target logical operator connects expression 1 and expression 2, and expression 1 and expression 2 are the condition clauses.

[0036] In some embodiments, performing step S102 can be: inputting the target search processing language code into the code parsing large model, using the powerful code understanding capability of the code parsing large model, performing code parsing processing on the target search processing language code by the code parsing large model, determining the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and determining the condition clause corresponding to the target logical operator.

[0037] S103, generating a code structure display diagram based on the hierarchical relationship information, the target logical operator and the condition clause.

[0038] It can be understood that the code structure display diagram is a code structure diagram representing the connection relationship between each target logical operator and the connection relationship between each condition clause in a tree structure.

[0039] In some embodiments, performing step S103 can be: determining a first editing component corresponding to the target logical operator, the first editing component being a control component for displaying the target logical operator and being editable, determining a second editing component corresponding to the condition clause, the second editing component being a control component for displaying the condition clause and being editable, performing component connection processing on the first editing component and the second editing component based on the hierarchical relationship information, and generating the code structure display diagram.

[0040] S104, displaying the code structure display diagram in the code parsing input interface.

[0041] In some embodiments, the code structure display diagram can be displayed in a target region below a reference region where the target search processing language code is located in the code parsing input interface, so as to simultaneously display the target search processing language code and the code structure display diagram.

[0042] It can be understood that when the area of the reference region where the target search processing language code is located in the code parsing input interface is greater than a preset area, a structure display region associated with the reference region where the target search processing language code is located is determined in the code parsing input interface, and the code structure diagram is displayed in the structure display region. The structure display region and the reference region are not displayed in the same interface, that is, when the code structure display diagram is displayed in the structure display region, the reference region (the target search processing language code is not displayed) is hidden, and when the reference region is displayed, the structure display region is hidden.

[0043] In the data processing method provided in the embodiments of the present application, the target search processing language code in the rule operation and maintenance scene is obtained from the code parsing input interface, the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator are determined, the condition clause corresponding to the target logical operator is determined, the code structure display diagram is generated based on the hierarchical relationship information, the target logical operator and the condition clause, and the code structure display diagram is displayed on the code parsing input interface. Therefore, by determining the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the condition clause corresponding to the target logical operator, the code structure display diagram is generated according to the hierarchical relationship information, the target logical operator and the condition clause, so as to realize the conversion of the target search processing language code into a structure form that is easy to understand and can be refined, and the code structure display diagram is displayed, which helps the security analyst to quickly understand the target search processing language code, thereby improving the efficiency of the security analyst in maintaining the target search processing language code.

[0044] Please refer to Figure 2 , a flowchart of another embodiment of a data processing method proposed in the present application.

[0045] Specifically, the data processing method comprises: S201, obtaining a target search processing language code in a rule operation and maintenance scene from a code parsing input interface.

[0046] Specifically, the implementation of step S201 can refer to the description of related steps in the embodiment shown in Figure 1 , and will not be described in detail here.

[0047] S202, performing code parsing processing based on the target search processing language code by using a code parsing large model to obtain a target logical operator corresponding to the target search processing language code, hierarchical relationship information corresponding to the target logical operator, and a condition clause corresponding to the target logical operator.

[0048] It can be understood that the code parsing large model refers to a large language model with strong programming ability, which can understand, generate and process code. The programming ability of the code parsing large model is reflected in that it can understand the syntax and structure of multiple programming languages, can understand the intention of the code, and can parse the structure of the code. The code parsing large model can be obtained by fine-tuning a basic programming large model, or the basic programming large model can be directly used. The programming large model is a large model with strong programming ability.

[0049] In some embodiments, step S202 can be specifically implemented by referring to Figure 3 , a flowchart of a code parsing method of a target search processing language code, which can specifically comprise the following steps: S2021: The code parsing big model is used to perform logical operator lookup processing on the target search processing language code to obtain the root-level logical operators; S2022: Determine the first conditional clause corresponding to the root-level logical operator; S2023: Determine whether the first conditional clause includes child logical operators; S2024: If the first conditional clause includes a child logical operator, then the child logical operator is treated as the root logical operator; S2025: If the first condition clause does not include a child logical operator, then the first condition clause is determined as the second condition clause, the root logical operator is determined as the target logical operator, the hierarchical relationship information corresponding to the target logical operator is determined, and the second condition clause is determined as the condition clause corresponding to the target logical operator.

[0050] In step S2021, the root-level logical operator refers to the outermost logical operator in the target search processing language code. Root-level logical operators can connect single conditional statements or conditional block statements. A conditional block statement can further include logical operators at the next lower level used to connect single conditions. The target search processing language code and the code parsing task description information are input into the code parsing big model, which then performs logical operator lookup processing on the target search processing language code to obtain the root-level logical operator.

[0051] For example, a target search processing language code could be: alarm_description contains "Number of abnormal nodes: 8" AND file_name contains_any ["SamSa" ,"Samas" ,"samsam"] AND (ext_malware contains "samsam" OR malware_name contains "samsam" OR (service_code =7 AND sae_rule_type = "availability" AND duration>= 259200) OR (ext_virus_type = "ransomware" AND service_code = 12)).

[0052] In the target search processing language code in the example above, the first "AND" and the second "AND" are root-level logical operators. The left side of the second "AND" is connected to a single conditional statement, and the right side is connected to a conditional block statement, which includes multiple lower-level logical operators "OR" and even lower-level logical operators "AND".

[0053] In some embodiments, performing step S2021 can include: identifying, by the code parsing large model, reference logical operators in the target search processing language code, determining nested position information corresponding to the reference logical operators; and determining, based on the nested position information, a root-level logical operator from the reference logical operators.

[0054] Specifically, the target search processing language code is input into the code parsing large model, and the code parsing large model identifies whether there is a target string matching a preset logical operator in the target search processing language code. When there is a target string matching a preset logical operator, the target string is determined as a reference logical operator. It can be understood that the preset logical operator refers to a logical operator in the SPL syntax for connecting multiple conditions, and the preset logical operator can include but is not limited to AND, OR, NOT, etc. After identifying the reference logical operator, the code parsing large model extracts the position information of the reference logical operator in the target search processing language code, and determines the nested position information corresponding to the reference logical operator according to the position information. The nested position information is used to represent the nesting relationship between the reference logical operators. Based on the nested position information, a root-level logical operator is determined from the reference logical operators. It can be understood that the reference logical operator in the outermost layer is determined as the root-level logical operator.

[0055] In step S2022, the first condition clause refers to a single condition statement and / or a condition block statement connected by the root-level logical operator. Specifically, after determining the root-level logical operator, the single condition statement and / or the condition block statement connected by each root-level logical operator is determined. When the root-level logical operator is used to connect a condition statement, the condition statement is determined as the first condition clause. When the root-level logical operator is used to connect a condition block statement, the condition block statement is determined as the first condition clause. When the root-level logical operator is used to connect a condition statement and a condition block statement, the condition statement and the condition block statement are determined as the first condition clause.

[0056] In step S2023, the sub-level logical operator refers to the outermost logical operator in the first condition clause. For each first condition clause, it is first analyzed whether the first condition clause includes a logical operator. When the first condition clause includes a logical operator, it is analyzed whether each logical operator is the outermost logical operator in the first condition clause. If the logical operator is the outermost logical operator in the first condition clause, it can be determined that the first condition clause includes a sub-level logical operator. When the first condition clause does not include a logical operator, it can be determined that the first condition clause does not include a sub-level logical operator.

[0057] In step S2024, when the first conditional clause includes a sub-level logical operator, the sub-level logical operator is taken as the root-level logical operator, and the execution of step S2022 is returned to, and after the execution of step S2022, the execution of step S2023 is continued, so as to realize the further parsing of the first conditional clause.

[0058] In step S2025, when the first conditional clause does not include a sub-level logical operator, it is indicated that the first conditional clause does not include a logical operator of the next level, and the root-level logical operator is determined as the target logical operator. In the case that the first conditional clause is obtained by executing step S2022 for the first time, it can be determined that the target logical operator is the starting point of a branch structure of the target search processing language code, and the first conditional clause is the end point of the branch structure. In the case that the first conditional clause is obtained by executing step S2022 for the Nth time, where N is greater than 1 and N is an integer, it can be determined that the root-level logical operator when step S2022 is executed for the first time is the starting point of a certain branch structure of the target search processing language, and the root-level logical operators when step S2022 is executed after the first time are taken as intermediate nodes after the starting point in turn, and the first conditional clause is determined as the end point of the branch structure. According to the above-mentioned determination of the branch structure, the structure connection information of each branch structure of the target search processing language can be determined, and according to the structure connection information of each branch structure, the level relationship information corresponding to the target logical operator can be determined.

[0059] For example, a target search processing language code can be: alarm_description contain "Abnormal node number: 8" AND file_name contain_any ["SamSa", "Samas", "samsam"] AND (ext_malware contain "samsam" OR malware_name contain "samsam" OR (service_code = 7 AND sae_rule_type = "availability" AND duration >= 259200) OR (ext_virus_type = "ransomware" AND service_code = 12)).

[0060] In the target search processing language code of the above example, a branch structure included therein has a start point of "AND", an end point of "alarm_description contain "abnormal node number: 8" ". Another branch structure included therein has a start point of "AND", an intermediate node of "OR", and an end point of "ext_malware contain "samsam" ". A branch structure included therein has a start point of "AND", intermediate nodes of "OR", "AND" in sequence, and an end point of "service_code = 7".

[0061] S203, determine a root layer logical operator and a sub-layer logical operator corresponding to the root layer logical operator in the target logical operator based on the hierarchical relationship information.

[0062] It can be understood that the root layer logical operator refers to a logical operator represented by a start point of a single branch structure of the target search processing language code. The sub-layer logical operator refers to a logical operator represented by an intermediate node directly connected to the root layer logical operator in the same branch structure as the root layer logical operator.

[0063] In some embodiments, the hierarchical relationship information can include structure connection information of multiple branch structures of the target search processing language code. According to the hierarchical relationship information, a target logical operator represented by a start point of each branch structure can be determined as a root layer logical operator. A logical operator directly connected to the root layer logical operator in a branch structure where the root layer logical operator is located can be determined as a sub-layer logical operator corresponding to the root layer logical operator.

[0064] It can be understood that when there is no logical operator directly connected to the root layer logical operator in the branch structure where the root layer logical operator is located, a preset string is determined as the sub-layer logical operator corresponding to the root layer logical operator.

[0065] For example, continue to use the above-mentioned target search processing language code: alarm_description contain "Abnormal node number: 8" AND file_name contain_any ["SamSa", "Samas", "samsam"] AND (ext_malware contain "samsam" OR malware_name contain "samsam" OR (service_code = 7 AND sae_rule_type = "availability" AND duration >= 259200) OR (ext_virus_type = "Ransomware" AND service_code = 12)). In this target search processing language code, the root layer logical operator is "AND", and in the branch structure "AND-OR-ext_malware contain "samsam"", the corresponding sub-layer logical operator of "AND" is "OR". In the branch structure "AND-alarm_description contain "Abnormal node number: 8"", there is no logical operator directly connected with the root layer logical operator "AND", and the preset string is determined as the sub-layer logical operator corresponding to the root layer logical operator, such as the preset string can be "null".

[0066] Optionally, the training process of the code parsing large model can include the following steps: creating an initial code parsing large model for a code parsing scene; obtaining sample SPL code; labeling the logical operator label corresponding to the sample SPL code, the hierarchical relationship information label corresponding to the logical operator label, and the condition clause label corresponding to the logical operator label; performing code parsing processing on the sample SPL code based on the initial code parsing large model to obtain the predicted logical operator corresponding to the sample SPL code, the predicted hierarchical relationship information corresponding to the predicted logical operator, and the predicted condition clause corresponding to the predicted logical operator; adjusting the model parameters of the initial code parsing large model based on the predicted logical operator, the logical operator label, the predicted hierarchical relationship information, the hierarchical relationship information label, the predicted condition clause, and the condition clause label to obtain the code parsing large model after model training.

[0067] Specifically, the model parameter adjustment is performed on the initial code parsing large model based on the predicted logical operator, the logical operator label, the predicted hierarchical relationship information, the hierarchical relationship information label, the predicted conditional clause and the conditional clause label to obtain the code parsing large model after model training, which can be: determining a first model loss based on the predicted logical operator and the logical operator label, determining a second model loss based on the predicted hierarchical relationship information and the hierarchical relationship information label, determining a third model loss based on the predicted conditional clause and the conditional clause label, determining a comprehensive model loss based on the first model loss, the second model loss and the third model loss, and performing model parameter adjustment on the initial code parsing large model based on the comprehensive model loss until a model training end condition is met to obtain the code parsing large model.

[0068] Optionally, the model end training condition of the model can include, for example, that the value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, and the like. The specific model end training condition can be determined based on actual conditions, which is not limited here.

[0069] S204, determining a parallel conditional clause corresponding to the sub-layer logical operator from the conditional clauses.

[0070] In some embodiments, a target branch structure having the same root layer logical operator as the sub-layer logical operator can be determined, a first node position of the sub-layer logical operator in the branch structure in which the sub-layer logical operator is located can be determined, a second node position corresponding to the first node position in the target branch structure can be determined, a conditional clause indicated by the second node position can be determined from the conditional clauses, and the conditional clause indicated by the second node position can be determined as the parallel conditional clause corresponding to the sub-layer logical operator. Wherein, the position of the first node position in the branch structure in which the sub-layer logical operator is located is the same as the position of the second node position in the target branch structure.

[0071] It can be understood that when there is no logical operator directly connected to the root layer logical operator in the branch structure in which the root layer logical operator is located, and the preset string is the sub-layer logical operator corresponding to the root layer logical operator, a target conditional clause directly connected to the root layer logical operator in the branch structure in which the root layer logical operator is located is determined from the conditional clauses, and the target conditional clause is determined as the parallel conditional clause corresponding to the sub-layer logical operator.

[0072] For example, continue to search the above listed target processing language code: alarm_description contain "Abnormal node number: 8" AND file_name contain_any ["SamSa", "Samas", "samsam"] AND (ext_malware contain "samsam" OR malware_name contain "samsam" OR (service_code = 7 AND sae_rule_type = "availability" AND duration >= 259200) OR (ext_virus_type = "Ransomware" AND service_code = 12)). For the sub-layer logical operator "OR", the branch structure where "OR" is located can be "AND-OR-ext_malware contain "samsam" ", the target branch structure with the same root layer logical operator as the sub-layer logical operator "OR" can be "AND-alarm_description contain "Abnormal node number: 8" " and "AND-file_name contain_any ["SamSa", "Samas", "samsam"] ", and the parallel condition clause corresponding to the sub-layer logical operator "OR" can include "alarm_description contain "Abnormal node number: 8" " and "file_name contain_any ["SamSa", "Samas", "samsam"] ".

[0073] At S205, the root layer editing component is determined based on the root layer logical operator, and the condition clause editing component and the sub-layer editing component connected to the root layer editing component are determined based on the parallel condition clause and the sub-layer logical operator.

[0074] It can be understood that the root layer editing component can be understood as an editable control component for displaying the root layer logical operator. The condition clause editing component can be understood as an editable control component for displaying the parallel condition clause. The sub-layer editing component can be understood as an editable control component for displaying the sub-layer logical operator.

[0075] In some embodiments, the step S205 can be specifically performed as follows: generating the root layer editing component based on the preset template component and the root layer logical operator, generating the condition clause editing component connected to the root layer editing component based on the preset template component and the parallel condition clause, and generating the sub-layer editing component connected to the root layer editing component based on the preset template component and the sub-layer logical operator.

[0076] S206, determining whether the sub-layer logical operator includes a base-layer logical operator.

[0077] S207, if the sub-layer logical operator includes the base-layer logical operator, determining the sub-layer logical operator as a root-layer logical operator and the base-layer logical operator as a sub-layer logical operator.

[0078] S208, if the sub-layer logical operator does not include the base-layer logical operator, determining a base-layer conditional clause corresponding to the sub-layer logical operator from the conditional clauses, determining a base-layer conditional clause editing component connected with the sub-layer logical operator based on the base-layer conditional clause, and generating a code structure display diagram based on all root-layer editing components, all conditional clause editing components, all sub-layer editing components and the base-layer conditional clause editing component.

[0079] In step S206, the base-layer logical operator refers to a non-root-layer logical operator directly connected with the sub-layer logical operator in the branch structure where the sub-layer logical operator is located, and the non-root-layer logical operator refers to a logical operator directly connected with the sub-layer logical operator in the branch structure where the sub-layer logical operator is located, except for the root-layer logical operator. It is determined whether there is a base-layer logical operator directly connected with the sub-layer logical operator in the branch structure where the sub-layer logical operator is located, if there is, it can be determined that the sub-layer logical operator includes the base-layer logical operator, and if there is not, it can be determined that the sub-layer logical operator does not include the base-layer logical operator.

[0080] In step S207, when the sub-layer logical operator includes the base-layer logical operator, the sub-layer logical operator is determined as the root-layer logical operator and the base-layer logical operator is determined as the sub-layer logical operator, and the execution returns to step S204, and after step S204 is executed, step S205 is executed to determine the editing components corresponding to each node in the branch structure where the sub-layer logical operator is located.

[0081] In step S208, when the sub-layer logical operator does not include the base-layer logical operator, the end node directly connected to the sub-layer logical operator in the branch structure where the sub-layer logical operator is located is determined, and the base-layer conditional clause indicated by the end node is determined from the conditional clauses. The base-layer conditional clause editing component connected to the sub-layer logical operator is generated based on the preset component template and the base-layer conditional clause. The code structure display diagram is generated based on all root layer editing components, all conditional clause editing components, all sub-layer editing components, and all base-layer conditional clause editing components. Specifically, the structural connection information of the plurality of branch structures of the target search processing language code included in the hierarchical relationship information is used to determine the target root layer editing component, the target conditional clause editing component, the target sub-layer editing component, and the target base-layer conditional clause editing component corresponding to each branch structure from all root layer editing components, all conditional clause editing components, all sub-layer editing components, and all base-layer conditional clause editing components. The target display structure corresponding to each branch structure is generated according to the target root layer editing component, the target conditional clause editing component, the target sub-layer editing component, and the target base-layer conditional clause editing component. The root layer editing component in each target display structure is taken as a root node, and each target display structure is merged to remove duplicate editing components, thereby obtaining a code structure display diagram represented in a tree structure.

[0082] For example, for the target search processing language code listed in step S204, the corresponding code structure display diagram can be seen in Figure 4 As can be seen from the target search processing language code listed in step S204, the code includes two root layer logical operators "AND" and three sub-layer logical operators "OR". However, in the code structure display diagram, the duplicate root layer editing component "AND" and the sub-layer editing component "OR" are not displayed.

[0083] In step S209, the first display area of the target search processing language code in the code parsing input interface is obtained, and the second display area in the code parsing input interface is determined based on the first display area.

[0084] It can be understood that the first display area is an editing area in the code parsing input interface for displaying the target search processing language code, the area size of the first area is obtained, and the second display area in the code parsing input interface is determined according to the area size of the first area. Specifically, when the area size of the first area is greater than the preset size, a target layer above the layer where the first display area is located is determined, and the second display area in the target layer of the code parsing input interface is determined. When the area size of the first area is less than the preset size, a second display area in the same layer as the first display area is determined, and the second display area can be located below the first display area in the code parsing input interface.

[0085] S210, display a code structure display diagram in the second display area.

[0086] In the data processing method provided by the embodiments of the present application, the target search processing language code in the rule operation and maintenance scene is obtained from the code parsing input interface, the code parsing large model is used for code parsing processing based on the target search processing language code, the target logic operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logic operator, and the condition clause corresponding to the target logic operator are obtained, and thus, with the powerful code understanding ability of the code parsing large model, the structural information of the target search processing language code is accurately parsed. Then, the root layer logic operator and the sublayer logic operator corresponding to the root layer logic operator are determined in the target logic operator based on the hierarchical relationship information, the parallel condition clause corresponding to the sublayer logic operator is determined from the condition clause, the root layer editing component is determined based on the root layer logic operator, the condition clause editing component and the sublayer editing component connected with the root layer editing component are determined based on the parallel condition clause and the sublayer logic operator, it is judged whether the sublayer logic operator includes the base layer logic operator, if the sublayer logic operator includes the base layer logic operator, the sublayer logic operator is determined as the root layer logic operator, and the base layer logic operator is determined as the sublayer logic operator, if the sublayer logic operator does not include the base layer logic operator, the base layer condition clause corresponding to the sublayer logic operator is determined from the condition clause, the base layer condition clause editing component connected with the sublayer logic operator is determined based on the base layer condition clause, the code structure display diagram is generated based on all root layer editing components, all condition clause editing components, all sublayer editing components and base layer condition clause editing components, the first display area of the target search processing language code in the code parsing input interface is obtained, the second display area is determined in the code parsing input interface based on the first display area, and the code structure display diagram is displayed in the second display area. In this way, after obtaining the structural information of the target search processing language code, the branch structure of the target search processing language code is analyzed step by step, the editing components corresponding to each node included in the branch structure are generated, including the root layer editing component, the condition clause editing component, the sublayer editing component and the base layer condition clause editing component, and then the code structure display diagram is generated from these components, which is convenient for understanding, can clearly show the structural relationship between each logic operator and the structural relationship between each condition clause, and provides editable control components, increases the convenience of the security analyst in maintaining the target search processing language code, and improves the maintenance efficiency of the target search processing language code.

[0087] The following will be combined Figure 5 The data processing device provided by the embodiments of the present application will be described in detail. It should be noted that, Figure 5 The data processing device shown in the figure is used to execute the data processing method provided by the embodiments of the present application. Figures 1-2The method of the embodiment shown, for ease of illustration, only shows parts related to the embodiments of the present application, and specific technical details not disclosed, please refer to the present application Figures 1-2 The embodiment shown.

[0088] See Figure 5 , which shows the structural schematic diagram of the data processing apparatus of the embodiments of the present application. The data processing apparatus 1 can be realized by software, hardware or combination of the two to become all or part of the device. According to some embodiments, the data processing apparatus 1 comprises a code acquisition module 11, a code analysis module 12, a structure generation module 13 and a structure display module 14, specifically used for: The code acquisition module 11 is used to acquire the target search processing language code in the rule operation and maintenance scene from the code analysis input interface; The code analysis module 12 is used to determine the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and determine the condition clause corresponding to the target logical operator; The structure generation module 13 is used to generate a code structure display diagram based on the hierarchical relationship information, the target logical operator and the condition clause; The structure display module 14 is used to display the code structure display diagram on the code analysis input interface.

[0089] Optionally, the code analysis module 12 comprises: The code analysis unit is used to perform code analysis processing based on the target search processing language code by using the code analysis large model, to obtain the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator and the condition clause corresponding to the target logical operator.

[0090] Optionally, the code analysis unit comprises: The first analysis subunit is used to perform logical operator searching processing on the target search processing language code by using the code analysis large model to obtain the root level logical operator; The second analysis subunit is used to determine the first condition clause corresponding to the root level logical operator; The third analysis subunit is used to determine whether the first condition clause includes a sub level logical operator; The fourth analysis subunit is used to take the sub level logical operator as the root level logical operator if the first condition clause includes a sub level logical operator, and execute the step of determining the first condition clause corresponding to the root level logical operator; The fifth parsing subunit is configured to determine the first conditional clause as a second conditional clause if the first conditional clause does not include a sub-level logical operator, determine the root-level logical operator as a target logical operator, determine the hierarchical relationship information corresponding to the target logical operator, and determine the second conditional clause as a conditional clause corresponding to the target logical operator.

[0091] Optionally, the first parsing subunit is specifically configured to: identify the reference logical operator in the target search processing language code by using the code parsing large model, and determine the nesting position information corresponding to the reference logical operator; determine a root-level logical operator from the reference logical operator based on the nesting position information.

[0092] Optionally, the structure generation module 13 comprises: The first structure generation unit is configured to determine a root-level logical operator and a sub-level logical operator corresponding to the root-level logical operator in the target logical operator based on the hierarchical relationship information. The second structure generation unit is configured to determine a parallel conditional clause corresponding to the sub-level logical operator from the conditional clause. The third structure generation unit is configured to determine a root-level editing component based on the root-level logical operator, and determine a conditional clause editing component and a sub-level editing component connected to the root-level editing component based on the parallel conditional clause and the sub-level logical operator. The fourth structure generation unit is configured to generate a code structure display diagram based on the root-level editing component, the conditional clause editing component, and the sub-level editing component.

[0093] Optionally, the fourth structure generation unit is specifically configured to: determine whether the sub-level logical operator includes a base-level logical operator; If the sub-level logical operator includes a base-level logical operator, determine the sub-level logical operator as the root-level logical operator, determine the base-level logical operator as the sub-level logical operator, and perform the steps of determining a parallel conditional clause corresponding to the sub-level logical operator from the conditional clause, determining a root-level editing component based on the root-level logical operator, and determining a conditional clause editing component and a sub-level editing component connected to the root-level editing component based on the parallel conditional clause and the sub-level logical operator. If the sub-layer logical operator does not include a base-layer logical operator, a base-layer conditional clause corresponding to the sub-layer logical operator is determined from the conditional clause, a base-layer conditional clause editing component connected with the sub-layer logical operator is determined based on the base-layer conditional clause, and a code structure display diagram is generated based on all root-layer editing components, all conditional clause editing components, all sub-layer editing components and all base-layer conditional clause editing components.

[0094] Optionally, the structure display module 14 is specifically configured to: acquire a first display area of the target search processing language code in the code parsing input interface, determine a second display area in the code parsing input interface based on the first display area; display the code structure display diagram in the second display area.

[0095] The data processing apparatus provided by the embodiments of the present application acquires the target search processing language code in the rule operation and maintenance scene from the code parsing input interface, determines the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, determines the conditional clause corresponding to the target logical operator, generates the code structure display diagram based on the hierarchical relationship information, the target logical operator and the conditional clause, and displays the code structure display diagram in the code parsing input interface. Therefore, by determining the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator and the conditional clause corresponding to the target logical operator, the code structure display diagram is generated according to the hierarchical relationship information, the target logical operator and the conditional clause, so as to realize the conversion of the target search processing language code into a structure form that can be refined and understood, and the code structure display diagram is displayed, which helps the security analyst to quickly understand the target search processing language code, thereby improving the efficiency of the security analyst in maintaining the target search processing language code.

[0096] Please refer to Figure 6 , Figure 6 A structural diagram of an electronic device is provided for the embodiments of the present application. The electronic device can include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140 and a bus 150. The processor 110, the memory 120, the input device 130 and the output device 140 can be connected through the bus 150.

[0097] The processor 110 can include one or more processing cores. The processor 110 connects various parts within the entire electronic device by various interfaces and lines, performs various functions of the electronic device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Alternatively, the processor 110 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes an operating system, a user interface, and an application program; the GPU is responsible for rendering and drawing display content; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 110, but can be realized by a separate communication chip.

[0098] The memory 120 can include a random access memory (RAM) and can also include a read-only memory (ROM). Alternatively, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing each of the methods described below, etc. The operating system can be an Android system, including a system developed based on the Android system, an IOS system developed by Apple Inc., including a system developed based on the IOS system, or other systems.

[0099] In order to enable the operating system to distinguish the specific application scenarios of the third-party application, it is necessary to open up the data communication between the third-party application and the operating system, so that the operating system can obtain the current scenario information of the third-party application at any time, and then perform targeted system resource adaptation based on the current scenario.

[0100] The input device 130 is configured to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is configured to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In an example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are a touch display screen.

[0101] The touch display screen can be designed as a full screen, a curved screen, or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, and the present application does not limit this.

[0102] In addition, those skilled in the art can understand that the structure of the electronic device shown in the above figure does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than the figure, or combine certain components, or different component arrangements. For example, the electronic device also includes radio frequency circuitry, an input unit, a sensor, audio circuitry, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module, and the like, which are not described here.

[0103] In some embodiments, in Figure 6 In the electronic device shown, the processor 110 can be configured to invoke a program of a data processing method stored in the memory 120, and specifically perform the following operations: obtain a target search processing language code in a rule operation and maintenance scene from a code parsing input interface; determine a target logical operator corresponding to the target search processing language code and hierarchical relationship information corresponding to the target logical operator, and determine a condition clause corresponding to the target logical operator; generate a code structure display diagram based on the hierarchical relationship information, the target logical operator, and the condition clause; display the code structure display diagram on the code parsing input interface.

[0104] In one embodiment, when the processor 110 performs the step of determining the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and determining the condition clause corresponding to the target logical operator, the processor 110 specifically performs the following operations: perform code parsing processing based on the target search processing language code using a code parsing large model to obtain the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the condition clause corresponding to the target logical operator.

[0105] In one embodiment, the processor 110, when performing the step of performing code parsing processing on the target search processing language code based on the code parsing large model to obtain a target logical operator corresponding to the target search processing language code, hierarchical relationship information corresponding to the target logical operator, and a condition clause corresponding to the target logical operator, specifically performs the following operations: The code parsing large model performs logical operator searching processing on the target search processing language code to obtain a root-level logical operator; Determining a first condition clause corresponding to the root-level logical operator; Determining whether the first condition clause includes a sub-level logical operator; If the first condition clause includes a sub-level logical operator, the sub-level logical operator is taken as the root-level logical operator, and the step of determining the first condition clause corresponding to the root-level logical operator is performed; If the first condition clause does not include a sub-level logical operator, the first condition clause is determined as a second condition clause, the root-level logical operator is determined as a target logical operator, hierarchical relationship information corresponding to the target logical operator is determined, and the second condition clause is determined as a condition clause corresponding to the target logical operator.

[0106] In one embodiment, the processor 110, when performing the step of performing logical operator searching processing on the target search processing language code based on the code parsing large model to obtain a root-level logical operator, specifically performs the following operations: The code parsing large model identifies a reference logical operator in the target search processing language code and determines nested position information corresponding to the reference logical operator; Based on the nested position information, a root-level logical operator is determined from the reference logical operator.

[0107] In one embodiment, the processor 110, when performing the step of generating a code structure display diagram based on the hierarchical relationship information, the target logical operator, and the condition clause, specifically performs the following operations: Based on the hierarchical relationship information, a root-level logical operator and a sub-level logical operator corresponding to the root-level logical operator are determined in the target logical operator; From the condition clause, a parallel condition clause corresponding to the sub-level logical operator is determined; Based on the root-level logical operator, a root-level editing component is determined, based on the parallel condition clause and the sub-level logical operator, a condition clause editing component and a sub-level editing component connected to the root-level editing component are determined; generating a code structure display diagram based on the root layer editing component, the conditional clause editing component and the sub-layer editing component.

[0108] In one embodiment, the processor 110, when performing the step of generating a code structure display diagram based on the root layer editing component, the conditional clause editing component and the sub-layer editing component, specifically performs the following operations: determining whether the sub-layer logical operator includes a base layer logical operator; if the sub-layer logical operator includes a base layer logical operator, determining the sub-layer logical operator as the root layer logical operator, determining the base layer logical operator as the sub-layer logical operator, and performing the steps of determining a parallel conditional clause corresponding to the sub-layer logical operator from the conditional clause, determining a root layer editing component based on the root layer logical operator, determining a conditional clause editing component and a sub-layer editing component connected to the root layer editing component based on the parallel conditional clause and the sub-layer logical operator; if the sub-layer logical operator does not include a base layer logical operator, determining a base layer conditional clause corresponding to the sub-layer logical operator from the conditional clause, determining a base layer conditional clause editing component connected to the sub-layer logical operator based on the base layer conditional clause, and generating a code structure display diagram based on all root layer editing components, all conditional clause editing components, all sub-layer editing components and all base layer conditional clause editing components.

[0109] In one embodiment, the processor 110, when performing the step of displaying the code structure display diagram in the code parsing input interface, specifically performs the following operations: obtaining a first display area of the target search processing language code in the code parsing input interface, determining a second display area in the code parsing input interface based on the first display area; displaying the code structure display diagram in the second display area.

[0110] The embodiments of the present application also provide a computer readable storage medium, which stores at least one instruction, and the at least one instruction is used to be executed by a processor to implement the data processing method according to the above various embodiments.

[0111] The embodiments of the present application also provide a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the data processing method according to the above various embodiments.

[0112] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the embodiments of the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or code on the computer readable medium. The computer readable medium includes computer storage medium and communication medium, and the communication medium includes any medium that facilitates transfer of computer program from one place to another. The storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

[0113] The above only describes optional embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data processing method, characterized in that, The method includes: Obtain the target search processing language code in the rule operation and maintenance scenario from the code parsing input interface; Determine the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and determine the conditional clause corresponding to the target logical operator; A code structure diagram is generated based on the hierarchical relationship information, the target logical operator, and the conditional clause. The code structure diagram is displayed on the code parsing input interface.

2. The method according to claim 1, characterized in that, The process of determining the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and determining the conditional clause corresponding to the target logical operator, includes: The code parsing model is used to perform code parsing processing based on the target search processing language code to obtain the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the conditional clause corresponding to the target logical operator.

3. The method according to claim 2, characterized in that, The code parsing model is used to perform code parsing based on the target search processing language code to obtain the target logical operator corresponding to the target search processing language code, the hierarchical relationship information corresponding to the target logical operator, and the conditional clause corresponding to the target logical operator, including: The root-level logical operators are obtained by performing logical operator lookup on the target search and processing language code using a large code parsing model. Determine the first conditional clause corresponding to the root-level logical operator; Determine whether the first conditional clause includes child logical operators; If the first conditional clause includes a child logical operator, then the child logical operator is used as the root logical operator, and the step of determining the first conditional clause corresponding to the root logical operator is executed. If the first conditional clause does not include a child-level logical operator, then the first conditional clause is determined as the second conditional clause, the root-level logical operator is determined as the target logical operator, the hierarchical relationship information corresponding to the target logical operator is determined, and the second conditional clause is determined as the conditional clause corresponding to the target logical operator.

4. The method according to claim 3, characterized in that, The step of using a large code parsing model to perform logical operator lookup processing on the target search and processing language code to obtain root-level logical operators includes: The code parsing big model is used to identify reference logical operators in the target search processing language code and determine the nesting position information corresponding to the reference logical operators. The root-level logical operator is determined from the reference logical operators based on the nested position information.

5. The method according to claim 1, characterized in that, The generation of the code structure diagram based on the hierarchical relationship information, the target logical operator, and the conditional clause includes: Based on the hierarchical relationship information, the root logic operator and the corresponding sub-level logic operator are determined in the target logic operator; Determine the parallel conditional clauses corresponding to the sub-level logical operators from the conditional clauses; The root-level editing component is determined based on the root-level logical operator, and the conditional clause editing component and the sub-level editing component connected to the root-level editing component are determined based on the parallel conditional clauses and the sub-level logical operator. A code structure diagram is generated based on the root layer editing component, the conditional clause editing component, and the sub-layer editing component.

6. The method according to claim 5, characterized in that, The generation of the code structure diagram based on the root editing component, the conditional clause editing component, and the sub-level editing component includes: Determine whether the sub-level logic operator includes the basic level logic operator; If the sub-level logic operator includes a basic-level logic operator, then the sub-level logic operator is determined as the root-level logic operator, the basic-level logic operator is determined as the sub-level logic operator, and the steps of determining the parallel conditional clauses corresponding to the sub-level logic operator from the conditional clauses, determining the root-level editing component based on the root-level logic operator, and determining the conditional clause editing component and the sub-level editing component connected to the root-level editing component based on the parallel conditional clauses and the sub-level logic operator are executed; If the sub-level logical operator does not include the basic level logical operator, then the basic level conditional clause corresponding to the sub-level logical operator is determined from the conditional clauses. Based on the basic level conditional clause, the basic level conditional clause editing component connected to the sub-level logical operator is determined. Based on all root level editing components, all conditional clause editing components, all sub-level editing components, and all basic level conditional clause editing components, a code structure display diagram is generated.

7. The method according to claim 1, characterized in that, The step of displaying the code structure diagram on the code parsing input interface includes: Obtain the first display area of ​​the target search processing language code in the code parsing input interface, and determine the second display area in the code parsing input interface based on the first display area; The code structure diagram is displayed in the second display area.

8. A data processing apparatus, characterized in that, The device includes: The code acquisition module is used to obtain the target search processing language code in the rule operation and maintenance scenario from the code parsing input interface; The code parsing module is used to determine the target logical operator corresponding to the target search processing language code and the hierarchical relationship information corresponding to the target logical operator, and to determine the conditional clause corresponding to the target logical operator. The structure generation module is used to generate a code structure display diagram based on the hierarchical relationship information, the target logical operator, and the conditional clause; The structure display module is used to display the code structure diagram on the code parsing input interface.

9. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions, which are adapted to be loaded by a processor and executed as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and executed as described in any one of claims 1 to 7.

Images