An efficient identification method of bit features based on byte anchoring

Abstract

The application discloses a kind of based on byte anchoring bit feature efficient identification method, comprising the following steps: S1, the length m of bit feature to be identified, determine byte window length L, wherein m≥8, L=⌊(m+7) / 8⌋+1, wherein ⌊·⌋ it indicates the down rounding function;S2, construct second byte fast mapping table;S3, read L byte data in current window in data stream;S4, according to the numerical value of the second byte of current window, obtain the possible bit offset set, based on the possible bit offset set, carry out bit feature to be identified matching;S5, according to the matching result adjustment window sliding step, and return S3 continue to execute.By byte level step, second byte anchoring and fast mapping table, specially solve the technical bottleneck of low bit feature matching efficiency in network traffic, suitable for bit feature of medium length and above.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network data processing, and particularly relates to a network traffic efficient identification and extraction method based on bit features. BACKGROUND

[0002] In many scenarios in the technical field of computer network data processing, the common data features are byte-based, which meet the computer memory alignment requirements and can be directly operated by CPU in byte units, thus having high processing efficiency. Different from byte features, bit features have a finer granularity, can be accurate to each bit, have high flexibility, and can express features of any length. However, bit features do not meet the computer memory alignment requirements, leading to more complex processing. Therefore, efficient identification of bit features in network traffic is a key technology.

[0003] The existing bit feature identification usually adopts a method based on a bit-level sliding window. First, a byte stream is converted into a continuous bit stream, a sliding window with a length of L is set, and the sliding window is slid by 1 bit each time. Each time, L bits are extracted for matching. In the existing technology, byte-to-bit conversion of the data stream is frequently performed each time, and the bit-level operation is frequently performed each time. For a bit feature with a length of m, (N*8-m+1) complete matching operations are required in a data stream with a length of N. Frequent bit stream conversion and frequent bit-level operations lead to excessive consumption of CPU and memory resources, especially when the feature length is long or the amount of data to be identified is large. This situation is more obvious, and real-time traffic analysis requirements in a high-speed network environment cannot be met.

[0004] Meanwhile, the existing technologies retrieved show that researchers have made a series of explorations in bit stream processing. However, these schemes cannot effectively solve the above technical defects:

[0005] Some schemes (such as patent US12051215B1) focus on the field of video coding. The processing object is a highly structured and compressed video bit stream. The core goal is to improve the compression efficiency or extract structured fields from the compressed stream. The technical means (such as constructing a "frame" and using image detection methods) are essentially different from the identification of any bit feature in network traffic.

[0006] Some other schemes (such as patent CN112115830A) involve bit field feature extraction. However, the core idea is to quantize perceptual signals (such as image features) into bit fields to reduce data transmission volume, which belongs to the category of data compression and transmission optimization, rather than efficient pattern matching in high-speed data streams.

[0007] In summary, with the continuous improvement of network bandwidth and the increasing demand for network security detection, especially when dealing with bit features of medium length and above (m>=8), there is an urgent need to develop an efficient bit feature recognition algorithm that can reduce the consumption of computing resources and meet the real-time processing requirements. SUMMARY

[0008] To solve the above problems in the prior art, the present application provides a byte anchor-based efficient bit feature recognition method, which can effectively solve the technical problems of low bit stepping efficiency and inability to meet the real-time network traffic processing performance requirements in the prior art.

[0009] To achieve the above purpose, the present application is implemented by the following technical solutions:

[0010] A byte anchor-based efficient bit feature recognition method, comprising the following steps:

[0011] S1, set the bit feature to be recognized, and determine the byte window length L according to the length m of the bit feature to be recognized, wherein m>=8, L =⌊(m+7) / 8⌋+1, wherein ⌊·⌋ represents the floor function;

[0012] S2, construct a second byte fast mapping table, construct a second byte fast mapping table according to the bit feature to be recognized, and the second byte fast mapping table is used to record the mapping relationship between the value of the second byte and the possible bit offset k;

[0013] When m=8, the value of the possible bit offset k is an integer from 1 to 7;

[0014] When m>8, the value of the possible bit offset k is an integer from 0 to 7;

[0015] S3, set a byte window with a length of L in the data stream, and slide the byte window by 1 byte each time, and read the L byte data in the current window after each sliding;

[0016] S4, extract the value of the second byte from the L byte data in the current window, query the second byte fast mapping table according to the value of the second byte to determine whether there is a possible bit offset k, obtain a possible bit offset set, and based on the possible bit offset set, take values and match other bytes in the L byte data in the current window, and output the matching result;

[0017] S5, adjust the window sliding step according to the matching result, and return to S3 to continue execution;

[0018] If the matching is successful, the byte window is then slid by (L-1) bytes each time;

[0019] If the matching fails, then subsequently slide the byte window by 1 byte.

[0020] Further, in the S2, the step of constructing the second byte fast mapping table comprises:

[0021] For each value of the possible bit offset k, calculate the value or value range of the second byte under the value; map the value or value range of the second byte to the corresponding possible bit offset k to form a mapping relationship.

[0022] Further, when 8≤m<16, obtain the value range of the second byte according to each possible bit offset k, and map each value in the value range of the second byte to the corresponding possible bit offset k.

[0023] Further, when m≥16, for each possible bit offset k, the value of the second byte is uniquely determined, obtain the value of the second byte, and map the value of the second byte to the corresponding possible bit offset k.

[0024] Further, when 8≤m<16, in the S2, the step of constructing the second byte fast mapping table comprises:

[0025] First, obtain basic parameters, including byte window length L and possible bit offset k;

[0026] Second, calculate the value range of the second byte corresponding to each possible bit offset k. First, determine the high several bits of the second byte occupied by the bit feature to be identified, then fix the value of the high several bits, set the value of the low several bits to all 0 and all 1, and obtain the value range of the second byte under the possible bit offset k;

[0027] Third, create a fast mapping table. Create an array with a fixed length of 256, the subscript of the array represents the value of the second byte, and the content of the array represents the set of possible bit offsets k. The default value is empty, indicating that the value has not found a possible bit offset k that meets the bit feature to be identified.

[0028] Further, when m≥16, in the S2, the step of constructing the second byte fast mapping table comprises:

[0029] First, obtain basic parameters, including byte window length L and possible bit offset k;

[0030] Second, calculate the value of the second byte corresponding to each possible bit offset k. Since the bit feature length m≥16, the 8 bits of the second byte are completely covered by the bit feature to be identified, and for each possible bit offset k, the exact value of the 8 bits of the second byte covered by the bit feature to be identified is directly calculated.

[0031] Thirdly, a quick mapping table is created. An array with a fixed length of 256 is created, for each possible bit offset k, the calculated unique second byte value is taken as the array index, and the content of the array represents the set of possible bit offsets k, and the default value is empty, indicating that the value has not found a possible bit offset k that meets the to-be-identified bit feature.

[0032] Further, when the length m of the to-be-identified bit feature is 8, the matching of the first byte in the L byte data in the current window is preferentially performed in the S4.

[0033] Further, the S4 comprises:

[0034] Firstly, the value of the first byte in the L byte data in the current window is extracted, and it is checked whether the first byte of the current window matches the to-be-identified bit feature, if yes, a matching result is output, and step S5 is executed;

[0035] Secondly, if no, the value of the second byte in the L byte data in the current window is extracted, and the set of possible bit offsets is obtained by querying the second byte quick mapping table;

[0036] Thirdly, based on the set of possible bit offsets, other bytes in the L byte data in the current window are valued and matched, and a matching result is output.

[0037] Further, the step of valuing and matching other bytes in the L byte data in the current window comprises:

[0038] For each possible bit offset k in the set of possible bit offsets, the byte coverage range of the to-be-identified bit feature in the current byte window is calculated based on the possible bit offset k;

[0039] According to the byte coverage range, the target byte and the corresponding bit mask that need to be verified are determined;

[0040] The bit mask is used for bit operation on the target byte to extract the actual bit value;

[0041] The extracted actual bit value is compared with the expected value of the to-be-identified bit feature at the corresponding position;

[0042] When the verification of all target bytes is passed, it is determined that the bit feature matching is successful.

[0043] Further, the calculation of the byte coverage range comprises:

[0044] The start bit of the bit feature is calculated: start_bit=k;

[0045] Calculate the end bit of the bit feature: end_bit=k+m-1;

[0046] Determine the start byte index: start_byte=start_bit / 8;

[0047] Determine the end byte index: end_byte=end_bit / 8.

[0048] Further, the determination of the target byte and its bit mask comprises:

[0049] Traverse all bytes from start_byte to end_byte;

[0050] For each byte, calculate the bit range covered by the bit feature to be identified in the byte;

[0051] Generate the corresponding bit mask according to the covered bit range;

[0052] Generate the expected value according to the value of the bit feature to be identified at the corresponding position.

[0053] Further, the bit operation verification comprises at least one of the following cases:

[0054] Verify the partial low bit of the first byte: compare after AND operation with the low bit mask with the expected value;

[0055] Verify the complete byte of the middle byte: directly compare the bytes;

[0056] Verify the partial high bit of the last byte: compare after AND operation with the high bit mask with the expected value.

[0057] Further, in the verification process for each possible bit offset k, an early termination strategy is adopted, when the verification of any target byte fails, the subsequent verification of the current bit offset k is immediately terminated.

[0058] In another aspect, the present application simultaneously discloses an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned bit feature efficient identification method based on byte anchoring when executing the computer program.

[0059] A computer readable storage medium is also disclosed, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned bit feature efficient identification method based on byte anchoring.

[0060] The technical scheme provided by the present application has the following advantages compared with the known prior art:

[0061] The present application uses byte-level sliding step (1 byte) to completely replace the low efficiency of bit-level step (1 bit) in the traditional method. In theory, only this improvement will reduce the basic operation frequency of window sliding by 8 times, greatly reducing the overhead of underlying data access and window movement. The number of matching times is reduced by orders of magnitude.

[0062] By introducing the second byte anchoring mechanism and the fast mapping table, the present application successfully reduces the number of necessary feature matching times from the order of O(n) (approximately N*8-m+1 times) of the traditional sliding window method to approximately constant level. In most cases, only 2-3 times of accurate verification is needed for a window data to complete the judgment, avoiding a large number of unnecessary full feature comparison, which is the core source of the efficiency improvement of the algorithm.

[0063] The present application avoids frequent bit stream conversion operations, reduces a large number of shift, mask and other bit operations. At the same time, the sharp reduction of the number of matching times directly reduces the comparison and calculation burden of the CPU, so that the CPU resources can be more effectively served to other tasks, or in the same hardware, the network traffic with higher bandwidth is processed. BRIEF DESCRIPTION OF DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0065] Figure 1 It is a flowchart of a byte anchor-based bit feature efficient identification method.

[0066] Figure 2 It is a second byte anchor principle diagram of bit feature length (9≤m<16).

[0067] Figure 3 It is a second byte anchor principle diagram of bit feature length (9≤m<16).

[0068] Figure 4 It is a second byte anchor principle diagram of bit feature length (m≥16).

[0069] Figure 5 It is a second byte fast mapping table of bit feature length (8≤m<16).

[0070] Figure 6 It is a second byte fast mapping table of bit feature length (m≥16). DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0072] In order to solve the problems of high computational complexity and low efficiency when directly performing bit pattern matching in a data stream. The traditional method needs to slide the window bit by bit and compare, which is slow. The method introduces the "byte anchoring" strategy, preferentially finds a high-probability anchor byte on the byte boundary, thereby quickly excludes a large number of impossible matching positions, and converts most of the bit-level matching operations into efficient byte queries and comparisons, significantly improving the matching speed.

[0073] As shown in Figure 1 The embodiment provides a byte anchoring-based bit feature efficient identification method, which comprises the following steps:

[0074] S1, setting a to-be-identified bit feature, determining a byte window length L according to the length m of the to-be-identified bit feature, wherein m≥8, L =⌊(m+7) / 8⌋+1, wherein ⌊·⌋ represents a down rounding function.

[0075] Through the setting of S1, it is ensured that the byte window with a length of L is sufficient to completely cover the entire bit feature with a length of m under any bit offset k (0≤k≤7), which provides a basis for the "second byte anchoring" mechanism and ensures that the second byte always contains feature information, so that a fast mapping table can be constructed and efficient filtering can be realized.

[0076] S2, constructing a second byte fast mapping table, constructing a second byte fast mapping table according to the to-be-identified bit feature, and the second byte fast mapping table is used for recording the mapping relationship between the value of the second byte and the possible bit offset k.

[0077] When m=8, the value of the possible bit offset k is an integer from 1 to 7, and the case of k=0 is directly matched by the first byte.

[0078] When m>8, the value of the possible bit offset k is an integer from 0 to 7.

[0079] This step is a preprocessing step, which aims to construct a mapping table for fast screening. The second byte in the current window is selected as the "anchor byte" in the embodiment. This is because the first byte has the most bit offset possibilities, which is not conducive to screening, while the second byte can provide good discrimination under different bit offsets.

[0080] S3, set a byte window with length L in the data stream, slide the byte window with step 1 byte, read L byte data in the current window after each slide.

[0081] S4, extract the value of the second byte from the L byte data in the current window, query the second byte fast mapping table according to the value of the second byte to determine whether there is a possible bit offset k, obtain a possible bit offset set, and based on the possible bit offset set, value and match other bytes in the L byte data in the current window, and output the matching result.

[0082] Specifically, in S4, the value of the second byte in the L byte data in the current window is extracted, and the value of the second byte is used as a key to query the fast mapping table constructed in step S2. If the value of the second byte is not in the fast mapping table, it means that there is no possibility to match the target bit feature at the current window position. Immediately determine that the matching fails, and jump to S5. If the value of the second byte exists in the fast mapping table, a possible bit offset set is obtained, and further fine verification is performed based on the possible bit offset set, and matched with the bit feature to be identified.

[0083] S5, adjust the window sliding step according to the matching result, and return to S3 for continuous execution.

[0084] If the matching is successful, the byte window is subsequently slid with a step of (L-1) bytes, because the feature length is m bits, which is approximately equal to L-1 bytes. After the current window is matched successfully, the start position of the next (L-1) byte window cannot form a complete match again (unless the feature itself has a special overlapping structure, and this strategy gives priority to efficiency). This is an optimization of "skipping impossible areas".

[0085] If the matching fails, the byte window is subsequently slid with a step of 1 byte, and the matching failure only indicates that it does not match under the current alignment, but the start position of the next byte may be a valid matching start point, so it is necessary to move 1 byte carefully for exploration.

[0086] The embodiment proposes an efficient bit feature recognition method based on byte window and second byte anchoring, which is specially designed for bit features with length m≥8, uses byte-level step instead of traditional bit-level step, and uses the anchoring characteristics of the second byte to quickly determine the possible matching position.

[0087] In the byte window with length L, the second byte is selected as the anchor point, and for the bit feature to be identified with length not less than 8, the screening efficiency is greatly improved.

[0088] As Figure 2As shown, for a bit feature with a length of m (m = 8), when the bit offset position of the feature in the window is greater than 0, the high bit part of 8 bits of the second byte must contain at least part of the bit feature.

[0089] As shown, for a bit feature with a length of m (m = 8), when the bit offset position of the feature in the window is greater than 0, the high bit part of 8 bits of the second byte must contain at least part of the bit feature. Figure 3 As shown, for a bit feature with a length of m (9≤m<16), regardless of the bit offset position of the feature in the window, the high bit part of 8 bits of the second byte must contain at least part of the bit feature.

[0090] As shown, for a bit feature with a length of m (9≤m<16), regardless of the bit offset position of the feature in the window, the high bit part of 8 bits of the second byte must contain at least part of the bit feature. Figure 4 As shown, for a bit feature with a length of m (9≤m<16), regardless of the bit offset position of the feature in the window, the high bit part of 8 bits of the second byte must contain at least part of the bit feature.

[0091] In summary, for a feature with m≥8, regardless of the possible bit offset k, the second byte must contain part of the bit feature, so the second byte can become a stable and reliable "anchor point" to predict the possible position of the entire feature, and the possible offset of the bit feature in the byte window can be determined through the value of the second byte, a fast mapping table is created, and then it is further determined whether the value of the other byte satisfies the bit feature through the possible offset, thereby realizing bit feature recognition.

[0092] In this embodiment, the core target of step S2 is to construct a fast mapping table, which is used to quickly deduce the possible bit offset k corresponding to the second byte value of the current window during scanning, thereby greatly reducing the candidate range that needs to be finely compared.

[0093] In S2, the steps of constructing the second byte fast mapping table include:

[0094] For each value of the possible bit offset k, calculate the value or value range of the second byte under the value; map the value or value range of the second byte to the corresponding possible bit offset k to form a mapping relationship.

[0095] When 8≤m<16, obtain the value range of the second byte according to each possible bit offset k, and map each value in the value range of the second byte to the corresponding possible bit offset k.

[0096] When 8≤m<16, in S2, the steps of constructing the second byte fast mapping table include:

[0097] First, obtain the basic parameters, including the byte window length L and the possible bit offset k, when m = 8, the value of the possible bit offset k is an integer from 1 to 7, and when m > 8, the value of the possible bit offset k is an integer from 0 to 7.

[0098] Second, the value range of the second byte corresponding to each possible bit offset k is calculated. First, the number of high bits of the second byte occupied by the bit feature to be identified is determined, and then the value of the high bits is fixed, and the value of the low bits is set to all 0 and all 1. For example, as shown in FIG. 2, when k = 1, the number of high 2 bits of the second byte occupied by the bit feature to be identified is determined, and then the value of the high 2 bits is fixed to obtain the value of the second byte as bHHxxxxxx, where H represents the value of the bit feature to be identified under the possible bit offset k, and x represents any value. Thus, the value range of the second byte under the possible bit offset k is [bHH000000, bHH111111]. Figure 5

[0099] Third, a fast mapping table is created. An array with a fixed length of 256 is created, the index of the array represents the value of the second byte, and the content of the array represents the set of possible bit offsets k. The default value is empty, indicating that the value does not find a possible bit offset k that satisfies the bit feature to be identified.

[0100] When m ≥ 16, the value of the second byte is uniquely determined for each possible bit offset k. The value of the second byte is obtained, and the second byte value is mapped to the corresponding possible bit offset k.

[0101] When m ≥ 16, the step of constructing the second byte fast mapping table in S2 includes:

[0102] First, the basic parameters are obtained, including the byte window length L, the possible bit offset k, and the value of k is an integer from 0 to 7.

[0103] Second, the value of the second byte corresponding to each possible bit offset k is calculated. Since the bit feature length m ≥ 16, the 8 bits of the second byte are completely covered by the bit feature to be identified. For each possible bit offset k, the exact value of the 8 bits of the second byte covered by the bit feature to be identified is directly calculated.

[0104] Third, a fast mapping table is created. An array with a fixed length of 256 is created, and for each possible bit offset k, the calculated unique second byte value is used as the array index, and the content of the array represents the set of possible bit offsets k. The default value is empty, indicating that the value does not find a possible bit offset k that satisfies the bit feature to be identified.

[0105] Specifically, as shown in FIG. 2, the value range of the second byte corresponding to each possible bit offset k is calculated. Figure 6 ​As shown, when k = 0, the only calculated second byte value is A, when k = 1, the only calculated second byte value is B, when k = 2, the only calculated second byte value is D, when k = 3, the only calculated second byte value is D, when k = 7, the only calculated second byte value is D, based on the above results, a fast mapping table is constructed, the content of the value A array is k = {0, 2}, the content of the value B array is k = {1}, and the content of the value D array is k = {3, 7}.

[0106] When the bit feature length to be identified m = 8, the matching of the first byte in the L byte data in the current window is preferentially performed in S4, when the feature length is exactly 8 bits, k = 0 is a special "complete byte matching" case, and the entire 8-bit feature is located on the first byte, and by using pure byte matching, the first byte is directly compared with the feature byte.

[0107] Specifically, S4 includes:

[0108] Firstly, the value of the first byte is extracted from the L byte data in the current window, it is checked whether the first byte of the current window matches the bit feature to be identified, if matched, the matching result is output, and step S5 is executed;

[0109] Secondly, if not matched, the value of the second byte is extracted from the L byte data in the current window, and the possible bit offset set is obtained by querying the second byte fast mapping table;

[0110] Thirdly, based on the possible bit offset set, the values and matching of other bytes in the L byte data in the current window are performed, and the matching result is output.

[0111] In the embodiment, the bit feature length m = 8, and the content is b10101011, and the specific implementation steps are as follows:

[0112] S1, the bit feature to be identified is set as b10101011, the byte window length L is determined according to the length m = 8 of the bit feature to be identified, L = (m + 7) / 8 + 1 = 2;

[0113] S2, a second byte fast mapping table is constructed, the possible bit offset range k = [1, 7], and the values of the second byte under different offsets are obtained:

[0114] Offset Second byte HEX Position of second byte in bit signature 1 [0x80, 0xFF] 1010101[1*******] 2 [0xC0, 0xFF] 101010[11******] 3 [0x60, 0x7F] 10101[011*****] 4 [0xB0, 0xBF] 1010[1011****] 5 [0x58, 0x5F] 101[01011***] 6 [0xAC, 0xAF] 10[101011**] 7 [0x56, 0x57] 1[0101011*]

[0115] A second byte-to-offset fast mapping table Relation is created, the Relation has a capacity of 255, and the following are some specific values: Relation[0xFF] = {1, 2}, Relation[0x80] = {1}, Relation[0xC0] = {2}, Relation[0xAC] = {1, 6}, Relation[0xAB] = {1}, Relation[0xBC] = {1, 4}.

[0116] S3, a byte window with a length of 2 is set in the data stream, and the byte window is slid by 1 byte as a step, and 2 bytes of data in the current window are read as [0xAB, 0xAA] after each sliding.

[0117] S4 includes: a first step, a value of a first byte is extracted from the 2 bytes of data in the current window, and it is checked whether the first byte of the current window matches the bit feature to be identified, if the first byte matches the bit feature to be identified, a matching result is output, and a step S5 is executed.

[0118] In the embodiment, the value of the first byte is 0xAA, which is compared with the bit feature and is not equal to the bit feature, and the matching fails.

[0119] A second step, the first step does not match, a value of a second byte is extracted as 0xBC, and a fast mapping table is queried to obtain possible offsets {1, 4}.

[0120] A third step, it is first verified whether the possible offset 1 satisfies the feature matching. Under the offset 1, the value of the first byte should be bx1010101, wherein a high 1-bit value is arbitrary, x is an arbitrary value, and a low 7-bit value is 1010101, and it is known through a bit operation condition (0xAA & 01010101 == 01010101) that the possible offset 1 does not satisfy the feature matching; it is further verified whether the possible offset 4 satisfies the feature matching. Under the offset 4, the value of the first byte should be bxxxx1010, wherein a high 4-bit value is arbitrary, and a low 4-bit value is 1010, and it is known through a bit operation condition (0xAA & 00001010 == 00001010) that the possible offset 4 satisfies the feature matching, and a matching result is recorded.

[0121] S5, a subsequent network data is continuously identified by executing S3.

[0122] In another embodiment, a bit feature length m is 9 bits (9≤m<16), and the content is b110011001, and specific implementation steps are as follows:

[0123] S1, a byte window length L=(m+7) / 8+1=3 bytes is set.

[0124] S2, construct the second byte fast mapping table, the possible bit offset range k=[0,7], according to Figure 3 and Figure 5 Get the value of the second byte under different offsets.

[0125] Offset Second byte HEX Position of second byte in bit signature 0 [0x80, 0xFF] 11001100[1*******] 1 [0x40, 0x7F] 1100110[01******] 2 [0x20, 0x3F] 110011[001*****] 3 [0x90, 0x9F] 11001[1001****] 4 [0xC8, 0xCF] 1100[11001***] 5 [0x64, 0x67] 110[011001**] 6 [0x32, 0x33] 11[0011001*] 7 0x99 1[10011001]

[0126] Create a fast mapping table Relation of the second byte to the offset, the capacity of Relation is 255, and the following are some specific values, Relation[0x80]={1}, Relation[0xC8]={0,4}, Relation[0x64]={5}, Relation[0x32]={2,6}, Relation[0x99]={0,7}.

[0127] S3, slide scanning with a step of 1 byte, read the network data [0xAA,0xBB,0x32] of the current window size;

[0128] S4, extract the second byte value 0xBB, query the fast mapping table to get the possible offset {0}, verify whether the possible offset 0 meets the to-be-identified bit feature, under the offset 0, the value of the first byte should be b11001100, and through the bit operation condition (0xAA & 11001100==11001100) it is known that the possible offset 0 does not meet the feature matching, and the matching fails;

[0129] S5, return to S3, match fails, slide scanning with a step of 1 byte, read the network data [0xBB,0x32,0x00] of the window size, and read the three bytes again.

[0130] Further extract the second byte value 0x32, query the fast mapping table to get the possible offset {2,6};

[0131] First, verify whether the possible offset 2 meets the feature matching. Under the offset 2, the value of the first byte should be bxx110011, wherein the high 2 bits have any value, and the low 6 bits have the value 110011, and through the bit operation condition (0xBB & 00110011==00110011) it is known that the possible offset 2 does not meet the feature matching; then verify whether the possible offset 6 meets the feature matching. Under the offset 6, the value of the first byte should be bxxxxxx11, wherein the high 6 bits have any value, and the low 2 bits have the value 11, and through the bit operation condition (0xBB & 00000011==00000011) it is known that the possible offset 6 meets the feature matching, and record the matching result; slide the window by L-1 bytes, and continue to identify the subsequent network data.

[0132] Another embodiment, bit feature length m is 20 bits (m≥16), the content is b10101011110011011110, the specific implementation steps are as follows:

[0133] S1, set the byte window length to the integer part, L=(m+7) / 8+1=4 bytes.

[0134] S2, construct the second byte fast mapping table, the possible bit offset range k=[0,7], according to Figure 4 And Figure 6 Get the value of the second byte under different offsets:

[0135] Offset Second byte HEX Position of second byte in bit signature 0 0xCD 10101011[11001101]1110 1 0xE6 1010101[11100110]11110 2 0xF3 101010[11110011]011110 3 0x79 10101[01111001]1011110 4 0xBC 1010[10111100]11011110 5 0x5E 101[01011110]011011110 6 0xAF 10[10101111]0011011110 7 0x57 1[01010111]10011011110

[0136] Create a fast mapping table Relation of the second byte to the offset, the capacity of Relation is 255, the following is the specific value, Relation[0xCD]={0}, Relation[0xE6]={1}, Relation[0xF3]={2}, Relation[0x79]={3}, Relation[0xBC]={4}, Relation[0x5E]={5}, Relation[0xAF]={6}, Relation[0x57]={7}.

[0137] S3, sliding scanning with a step of 1 byte, reading the window size network data [0xAA, 0x05, 0x5E, 0x6F];

[0138] S4, extract the second byte value 0x05, query the fast mapping table and find no possible offset, matching fails;

[0139] S5, return to S3, matching fails to slide scanning with a step of 1 byte, reading the window size network data [0x05, 0x5E, 0x6F, 0x00];

[0140] Further extract the second byte value 0x5E, query the fast mapping table to obtain the possible offset {5}, and verify whether the possible offset 5 meets the feature matching. Under the offset 5, the value of the first byte should be bxxxxx101, the high 5 bits have any value, and the low 3 bits have the value 101. It is known through the bit operation condition (0x05 & 00000101 == 00000101) that the first byte meets the feature matching. The value of the third byte should be b01101111, and it is known through the bit operation condition (0x6F & 01101111 == 01101111) that the third byte meets the feature matching. The value of the fourth byte should be b0xxxxxx, the high 1 bit has the value 0, and the low 7 bits have any value. It is known through the bit operation condition (0x00 & 00000000 == 00000000) that the fourth byte meets the feature matching. Thus, the possible offset 5 bit feature matching is successful, and the matching result is recorded; the window is slid by L-1 bytes, and the subsequent network data is continuously identified.

[0141] In order to improve the efficiency and accuracy of the value and matching of other bytes in the L byte data in the current window, in the embodiment, for each possible bit offset k in the possible bit offset set, the byte coverage range of the to-be-identified bit feature in the current byte window is calculated based on the possible bit offset k; according to the byte coverage range, the target byte and the corresponding bit mask that need to be verified are determined; the bit mask is used for bit operation on the target byte to extract the actual bit value; the extracted actual bit value is compared with the expected value of the to-be-identified bit feature at the corresponding position; when the verification of all target bytes is passed, it is determined that the bit feature matching is successful.

[0142] The calculation of the byte coverage range includes: calculating the start bit of the bit feature: start_bit = k; calculating the end bit of the bit feature: end_bit = k + m - 1; determining the start byte index: start_byte = start_bit / 8; determining the end byte index: end_byte = end_bit / 8.

[0143] The determination of the target byte and the bit mask includes: traversing all bytes from start_byte to end_byte; for each byte, calculating the bit range covered by the to-be-identified bit feature in the byte; generating the corresponding bit mask according to the covered bit range; generating the expected value according to the value of the to-be-identified bit feature at the corresponding position.

[0144] The bit operation verification includes at least one of the following: verifying partial low bits of the first byte: AND operation using a low bit mask and comparison with an expected value; verifying a complete byte of the middle byte: direct byte comparison; verifying partial high bits of the last byte: AND operation using a high bit mask and comparison with an expected value.

[0145] For the above embodiment m=8, the first byte matching fails (0xAA ≠ 0xAB), the second byte 0xBC is extracted, the possible offset set {1, 4} is obtained by querying the mapping table, and the matching process of the embodiment is as follows:

[0146] The possible bit offset k=1 is verified, and the coverage range is calculated: start_bit=1, end_bit=8 start_byte=0, end_byte=1;

[0147] Target byte verification:

[0148] Byte 0: mask 0x7F, expected value 0x55;

[0149] Calculation: (0xAA & 0x7F) = 0x2A ≠ 0x55 → verification failed.

[0150] Verify the possible bit offset k=4, and calculate the coverage range: start_bit=4, end_bit=11 start_byte=0, end_byte=1;

[0151] Target byte verification: byte 0: mask 0x0F, expected value 0x0A;

[0152] Calculation: (0xAA & 0x0F) = 0x0A = 0x0A → verification passed

[0153] Byte 1: mask 0xF0, expected value 0xB0;

[0154] Calculation: (0xBC & 0xF0) = 0xB0 = 0xB0 → verification passed

[0155] Matching result: possible bit offset k=4 matches successfully.

[0156] In this embodiment, the position of the feature in the byte window is accurately determined by start_bit / end_bit, and the corresponding bit mask is generated according to different offsets, so as to realize accurate bit operation verification.

[0157] In order to improve the matching efficiency, the early termination strategy is adopted in the verification process of each possible bit offset k in the embodiment, and when the verification of any target byte fails, the subsequent verification of the current bit offset k is terminated immediately.

[0158] Another embodiment is an electronic device, comprising a memory storing a computer program and a processor, wherein the processor implements the byte anchor based bit feature efficient identification method according to any one of the above embodiments when executing the computer program.

[0159] A computer readable storage medium, storing a computer program, wherein the computer program, when executed by a processor, implements the byte anchor based bit feature efficient identification method according to any one of the above embodiments.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by programs instructing relevant hardware, and the programs can be stored in a computer readable storage medium. When the programs are executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM) and the like.

[0161] The above only describes the preferred examples of the application and is not intended to limit the application. Although the application has been described in detail with reference to the foregoing examples, those skilled in the art can modify the technical solutions described in the foregoing examples or make equivalent replacements to some technical features. Any modification, equivalent replacement and the like within the spirit and principles of the application shall be included in the protection scope of the application.

Claims

1. A method for efficient bit feature identification based on byte anchoring, comprising the following steps: S1. Set the bit feature to be identified. Determine the byte window length L based on the length m of the bit feature to be identified, where m≥8, L =⌊(m+7) / 8⌋+1, where ⌊·⌋ represents the floor function. S2. Construct a second byte fast mapping table. Construct a second byte fast mapping table based on the bit features to be identified. The second byte fast mapping table is used to record the mapping relationship between the value of the second byte and the possible bit offset k. When m=8, the possible bit offset k takes the value of an integer from 1 to 7; When m > 8, the possible bit offset k takes the value of an integer from 0 to 7; S3. Set a byte window of length L in the data stream, slide the byte window in increments of 1 byte, and read L bytes of data in the current window after each slide; S4. Extract the value of the second byte from the L bytes of data in the current window, query the second byte fast mapping table based on the value of the second byte to determine whether there is a possible bit offset k, obtain the possible bit offset set, and based on the possible bit offset set, take the value and match the other bytes in the L bytes of data in the current window, and output the matching result. S5. Adjust the window sliding step according to the matching result, and return to S3 to continue execution; If a match is successful, the byte window will then slide in increments of (L-1) bytes. If a match fails, the byte window is then slid in increments of 1 byte.

2. The efficient bit feature identification method based on byte anchoring according to claim 1, characterized in that, In step S2, the steps for constructing the second byte fast mapping table include: For each possible bit offset k, calculate the value or range of the second byte under that value; map the value or range of the second byte to the corresponding possible bit offset k to form a mapping relationship.

3. The efficient bit feature identification method based on byte anchoring according to claim 2, characterized in that, When 8 ≤ m < 16, the step of constructing the second byte fast mapping table in S2 includes: The first step is to obtain basic parameters, including the byte window length L and the possible bit offset k; The second step is to calculate the value range of the second byte corresponding to each possible bit offset k. First, determine the number of high bits of the second byte occupied by the bit feature to be identified, then fix the values ​​of the high bits and set the values ​​of the low bits to all 0 and all 1, thereby obtaining the value range of the second byte under the possible bit offset k. The third step is to create a fast mapping table. Create an array of fixed length 256. The array index represents the value of the second byte, and the array content represents the set of possible bit offsets k. The default value is empty, which means that no possible bit offset k that satisfies the bit characteristics to be identified was found for that value.

4. The efficient bit feature identification method based on byte anchoring according to claim 2, characterized in that, When m≥16, the step of constructing the second byte fast mapping table in S2 includes: The first step is to obtain basic parameters, including the byte window length L and the possible bit offset k; The second step is to calculate the value of the second byte corresponding to each possible bit offset k. Since the bit feature length m≥16, the 8 bits of the second byte are completely covered by the bit feature to be identified. For each possible bit offset k, the exact value of the 8 bits of the bit feature to be identified covered on the second byte is directly calculated. The third step is to create a fast mapping table. Create an array of fixed length 256. For each possible bit offset k, use the calculated unique second byte value as the array index. The contents of the array represent the set of possible bit offsets k. The default value is empty, indicating that no possible bit offset k that satisfies the bit characteristics to be identified was found for that value.

5. The efficient bit feature identification method based on byte anchoring according to claim 1, characterized in that, When the length of the bit feature to be identified is m=8, in step S4, the first byte of the L bytes of data in the current window is matched first.

6. The efficient bit feature identification method based on byte anchoring according to claim 5, characterized in that, S4 includes: The first step is to extract the value of the first byte from the L bytes of data in the current window, check whether the first byte of the current window matches the bit feature to be identified, and if it matches, output the matching result and execute step S5. The second step, if there is no match, is to extract the value of the second byte from the L bytes of data in the current window, and query the second byte fast mapping table to obtain the possible set of bit offsets; The third step is to take the values ​​of other bytes in the L bytes of data in the current window and match them based on the possible set of bit offsets, and output the matching results.

7. The efficient bit feature identification method based on byte anchoring according to claim 1, characterized in that, In step S4, the steps of retrieving and matching the values ​​of other bytes in the L bytes of data within the current window include: For each possible bit offset k in the set of possible bit offsets, calculate the byte coverage of the bit feature to be identified within the current byte window based on the possible bit offset k; Based on the byte coverage range, determine the target byte to be verified and its corresponding bit mask; The target byte is subjected to bitwise operations using the bit mask to extract the actual bit value; The extracted actual bit value is compared with the expected value of the bit feature to be identified at the corresponding position; When all target bytes pass verification, the bit feature match is considered successful.

8. The efficient bit feature identification method based on byte anchoring according to claim 7, characterized in that, During the verification process for each possible bit offset k, an early termination strategy is adopted. When the verification of any target byte fails, the subsequent verification of the current bit offset k is immediately terminated.

9. An electronic device comprising a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the method as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-8.

Images