Methods, apparatus, computer-readable storage media and devices for matching corpus search

Abstract

This application discloses a method, apparatus, computer-readable storage medium, and device for searching matching corpora. The method involves aggregating search keywords from at least one search expression in a search expression library to obtain a first set of search keywords; deduplicating the search keywords in the first set to obtain a second set of deduplicated search keywords; identifying target search keywords that match the target search keywords in the second set for the corpus to be searched in the streaming corpus; searching the search expression library for target search keyword combinations that match the target search keyword combinations, where the target search keyword combinations are generated by combining the target search keywords; and determining the corpus to be searched as matching corpus if a matching target search expression exists. This allows for the rapid retrieval of target search keyword combinations from the search expression library, improving the efficiency of matching corpus searches.

Description

Technical Field

[0001] This application relates to the field of distributed data processing technology, specifically to a matching corpus search method, apparatus, computer-readable storage medium, and device. Background Technology

[0002] In recent years, real-time streaming computing has been widely applied in many business scenarios, such as financial services, the Internet of Things, and network monitoring. The successful application of these scenarios demonstrates the importance and adaptability of real-time streaming computing across various industries. With continuous technological advancements, the application scope of real-time streaming computing will further expand.

[0003] ETL (Extract, Transform, and Load) data processing technology has been widely used in real-time streaming computing to process business data required for business scenarios. For example, ETL data processing technology can be used to extract matching data from streaming corpora, transform matching data, and load the transformed matching data into the target system. However, as business scenarios become more complex, the rules of ETL data processing technology also become more and more cumbersome.

[0004] In related technologies, ETL data processing technology processes streaming corpora by iterating through each corpus and matching each preset search expression one by one to find matching corpora. The search process is cumbersome, slow, and requires a lot of computing resources, which can lead to a waste of computing resources on computer equipment and even computer equipment crashes. Summary of the Invention

[0005] This application provides a matching corpus search method, apparatus, computer-readable storage medium, and device, which can improve the efficiency of matching corpus search and save computing resources of computer devices.

[0006] To address the aforementioned technical problems, this application provides the following technical solutions:

[0007] A matching corpus search method is used to search for matching corpora in a streaming corpus that conform to any search expression in a search expression library, wherein the search expression is generated by concatenating search keywords using search operators, and the method includes:

[0008] The search keywords in at least one search expression in the search expression library are aggregated to obtain a first set of search keywords;

[0009] The search keywords in the first set of search keywords are deduplicated to obtain a second set of search keywords after deduplication.

[0010] For the corpus to be searched in the streaming corpus, determine the target search keywords that match the corpus to be searched in the second set of search keywords;

[0011] In the search expression library, a target search expression matching the target search keyword combination is found, wherein the target search keyword combination is generated by combining the target search keywords;

[0012] If a matching target search expression exists, then the corpus to be searched is determined to be the matching corpus.

[0013] A matching corpus search device is used to search for matching corpora in a streaming corpus that conform to any search expression in a search expression library, wherein the search expression is generated by connecting search keywords using search operators, and the device includes:

[0014] The aggregation unit is used to aggregate the search keywords in at least one search expression in the search expression library to obtain a first set of search keywords;

[0015] The deduplication unit is used to deduplicat the search keywords in the first search keyword set to obtain a deduplicated second search keyword set.

[0016] The first determining unit is used to determine the target search keywords that match the search corpus in the second set of search keywords for the search corpus in the streaming corpus;

[0017] The search unit is used to search for a target search expression that matches the target search keyword combination in the search expression library, wherein the target search keyword combination is generated by combining the target search keywords;

[0018] The second determining unit is used to determine the corpus to be searched as the matching corpus if a matching target search expression exists.

[0019] In some embodiments, the search unit includes:

[0020] The combination subunit is used to perform a full combination of the target search keywords to obtain a target search keyword combination.

[0021] The search subunit is used to search the search expression library for a target search expression that matches the combination of the target search keywords.

[0022] In some embodiments, the lookup subunit is used for:

[0023] Retrieve each search expression from the search expression library;

[0024] Each search expression is compared sequentially with the target search keyword combination;

[0025] Based on the comparison results, the search expression that matches the target search keyword combination is determined as the target search expression.

[0026] In some embodiments, the combined subunit is used for:

[0027] The target search keywords are combined in full to obtain the first search keyword combination;

[0028] The empty set of search keyword combinations in the first search keyword combination is deleted to obtain the target search keyword combination.

[0029] In some embodiments, the first determining unit is configured to:

[0030] For the searchable corpus in the streaming corpus, obtain each first search keyword from the second set of search keywords;

[0031] The search corpus is sequentially matched with each first search keyword, and the matched first search keyword is determined as the target search keyword.

[0032] In some embodiments, the apparatus further includes:

[0033] The acquisition unit is used to acquire the type information to which the target search expression belongs;

[0034] The loading unit is used to determine the corresponding loading processing rule based on the type information, and to load the matching corpus according to the loading processing rule to generate corresponding prompt information.

[0035] In some embodiments, the acquisition unit is configured to:

[0036] Obtain the vector identifier associated with the target search expression;

[0037] The type information to which the target search expression belongs is determined based on the vector identifier.

[0038] In some embodiments, the type information includes at least simple type information, unordered type information, and ordered type information, and the loading unit includes:

[0039] A simple loading subunit is used to determine the corresponding simple loading processing rule based on the simple type information if the type information is simple type information, and to load the matching corpus through the simple loading processing rule to generate the corresponding first prompt information.

[0040] An unordered loading subunit is used to determine the corresponding unordered loading processing rule based on the unordered type information if the type information is unordered type information, and to load the matching corpus through the unordered loading processing rule to generate the corresponding second prompt information.

[0041] An ordered loading subunit is used to determine the corresponding ordered loading processing rule based on the ordered type information if the type information is ordered type information, and to load the matching corpus through the ordered loading processing rule to generate the corresponding third prompt information;

[0042] Wherein, the search keyword of the search expression corresponding to the simple type information is one, and the trigger threshold is one; the search keyword of the search expression corresponding to the unordered type information is more than one, the trigger threshold is more than one, and the configuration parameters that occur sequentially are closed state parameters; the search keyword of the search expression corresponding to the ordered type information is more than one, and the configuration parameters that occur sequentially are open state parameters.

[0043] In some embodiments, the simple loading subunit is used for:

[0044] The first target search expression is obtained through the simple loading processing rule, and the first target search expression is a target search expression whose type information is simple type information.

[0045] The matching corpus is loaded and processed according to the first target search expression to generate the corresponding first prompt information.

[0046] In some embodiments, the unordered loading subunit is used for:

[0047] The second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding historical trigger count are obtained through the unordered loading processing rules. The type information of the second target search expression is the target search expression with unordered type information.

[0048] Increment the historical trigger count by one to obtain the updated historical trigger count;

[0049] The corresponding trigger detection time point is determined based on the length of the sliding time window.

[0050] At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

[0051] In some embodiments, the unordered loading subunit is further configured to:

[0052] The second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding historical trigger count are obtained through the unordered loading processing rules. The second target search expression is a target search expression with unordered type information.

[0053] Increment the historical trigger count by one to obtain the updated historical trigger count;

[0054] If the length of the sliding time window is less than or equal to the preset time, then the end time of the sliding time window is determined as the corresponding trigger detection time point;

[0055] If the length of the sliding time window is greater than the preset time, then the corresponding trigger detection time point is determined according to the preset time;

[0056] At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

[0057] In some embodiments, the ordered loading subunit is used for:

[0058] The third target search expression and the preset queue are obtained through the ordered loading processing rule. The type information of the third target search expression is the target search expression of ordered type information. The preset queue is used to store the search expressions corresponding to ordered type information.

[0059] Obtain the hit time of the third target search expression;

[0060] If the preset queue is empty, or if the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, and the matching corpus is loaded and processed according to the third target search expression to generate the corresponding third prompt information.

[0061] In some embodiments, the ordered loading subunit is further configured to:

[0062] The third target search expression and the preset queue are obtained through the ordered loading processing rule. The type information of the third target search expression is the target search expression of ordered type information. The preset queue is used to store the search expressions corresponding to ordered type information.

[0063] Obtain the hit time of the third target search expression;

[0064] If the preset queue is empty, or if the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, a timer is started, and the matching corpus is loaded and processed according to the third target search expression to generate the corresponding third prompt information.

[0065] The start time of the timer is the enqueue time of the third target search expression, and the end time of the timer is determined based on the enqueue time and the preset time.

[0066] A computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute the above-described matching corpus search method.

[0067] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described matching corpus search method.

[0068] A computer program product or computer program includes computer instructions stored in a storage medium. A processor of a computer device reads the computer instructions from the storage medium and executes the computer instructions to implement the above-described matching corpus search method.

[0069] This application embodiment aggregates the search keywords in at least one search expression in the search expression library to obtain a first search keyword set; deduplicates the search keywords in the first search keyword set to obtain a deduplicated second search keyword set; for the corpus to be searched in the streaming corpus, the target search keywords that match the corpus to be searched in the second search keyword set are determined; in the search expression library, a target search expression that matches the combination of target search keywords is searched, the target search keyword combination being generated by combining the target search keywords; if a matching target search expression exists, the corpus to be searched is determined to be the matching corpus.

[0070] Therefore, by pre-aggregating and deduplicating the search keywords in various search expressions in the search expression library, a second set of search keywords with no duplicates is obtained. Based on this, upon receiving the search corpus from the streaming corpus, the target search keyword matching the search corpus in the second set of search keywords can be quickly determined. Since the target search keyword combination generated from the target search keyword combination covers any search expression generated based on the target search keyword in the search expression library, matching target search keywords can be quickly found in the search expression library. The target search expression is the search expression that matches the corpus to be searched in the search expression library. This enables fast lookup of the target search expression, which means that the corpus to be searched meets the search conditions and is identified as the matching corpus. Compared with related technologies, which require matching and traversing each search expression in the search expression library for each corpus to find the matching corpus, the embodiments of this application can quickly determine the target search expression that the corpus to be searched matches, without having to match and traverse each search expression for the corpus to be searched. Therefore, it can save computing resources of computer equipment and improve the efficiency of matching corpus search.

[0071] Other features and advantages of this disclosure will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the disclosure. The objectives and other advantages of this disclosure may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0072] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0073] Figure 1 This is a schematic diagram of the Flink architecture provided for an embodiment of this application.

[0074] Figure 2 This is a schematic diagram of a matching corpus search system provided in an embodiment of this application.

[0075] Figure 3 This is a flowchart illustrating the matching corpus search method provided in the embodiments of this application.

[0076] Figure 4 A schematic diagram of a scenario for the matching corpus search method provided in the embodiments of this application.

[0077] Figure 5 This is a schematic diagram of another scenario for the matching corpus search method provided in the embodiments of this application.

[0078] Figure 6 Another flowchart illustrating the matching corpus search method provided in this application embodiment.

[0079] Figure 7 Another flowchart illustrating the matching corpus search method provided in this application embodiment.

[0080] Figure 8 This is a schematic diagram of the structure of the sliding time window provided in an embodiment of this application.

[0081] Figure 9 This is a schematic diagram of the overall process of the matching corpus search method provided in the embodiments of this application.

[0082] Figure 10 This is a schematic diagram of the structure of the matching corpus search device provided in the embodiments of this application.

[0083] Figure 11 This is a schematic diagram of the terminal structure provided in the embodiments of this application.

[0084] Figure 12 This is a schematic diagram of the server structure provided in an embodiment of this application. Detailed Implementation

[0085] To enable those skilled in the art to better understand the solutions of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0086] It is understood that in the specific implementation of this application, data such as corpus and search expressions are involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the subject is required, and the collection, use and processing of related data must comply with relevant laws, regulations and standards.

[0087] Furthermore, when this application embodiment needs to obtain data such as corpus and search expressions, it will obtain separate permission or separate consent for the data such as corpus and search expressions through pop-up windows or redirection to a confirmation page. After clearly obtaining separate permission or separate consent for the data such as corpus and search expressions, it will then obtain the necessary data such as corpus and search expressions for enabling the application embodiment to operate normally.

[0088] It should be noted that while some processes described in the specification, claims, and accompanying drawings contain multiple steps that appear in a specific order, it should be clearly understood that these steps may not be performed in the order they appear herein, or may be performed in parallel. The step numbers are merely used to distinguish different steps and do not represent any particular order of execution. Furthermore, descriptions such as "first," "second," or "objective" in this document are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0089] Before providing a further detailed description of the embodiments of this disclosure, the nouns and terms used in the embodiments of this disclosure are explained, and the nouns and terms used in the embodiments of this disclosure are subject to the following interpretations:

[0090] Real-time streaming computing is a data processing technique that enables the instantaneous processing of continuously generated data streams. These data streams are typically unbounded (without a definite end point), such as continuously generated data streams like sensor data, web log data, and financial data. Unlike traditional batch computing, which processes fixed-size datasets, real-time streaming computing focuses on real-time analysis and response to flowing data.

[0091] A streaming database is a type of database capable of processing real-time, continuous data streams for real-time streaming computing. It aims to process massive amounts of data with low latency and high throughput. In this application's embodiment, the streaming corpus is a streaming database. This corpus can be text, which can include sensor data, web logs, and financial data. In other words, the corpus database is used to process real-time, continuous data streams.

[0092] Flink (a distributed data stream engine) is an open-source stream processing engine that provides a rich set of application programming interfaces (APIs) for stream processing. It supports both event-time and processing-time semantics, making it easy to implement complex stream processing tasks such as window computation (e.g., calculating the total number of transactions in the past 5 minutes) and state management (for saving and updating intermediate results). Compared to other stream processing frameworks, Flink offers better performance and flexibility. For a better understanding of Flink, please refer to [further details needed]. Figure 1 As shown, Figure 1 The diagram below illustrates the architecture of Flink as provided in this application embodiment. The architecture includes a JobManager processor 1 and a TaskManager processor 2.

[0093] In Flink, the JobManager processor, also known as the Master, coordinates distributed execution. It schedules tasks, coordinates checkpoints, and recovers from coordination failures. A Flink runtime has at least one master processor; if configured for high availability, multiple master processors exist, one of which is the leader, while the others are standby. The TaskManager processor, also known as the Worker, executes tasks and buffers within a dataflow. A Flink runtime has at least one worker processor. A TaskManager is divided into multiple slots, each capable of running a maximum of one task or a chain of tasks. Multiple slots share the memory space of the current TaskManager. A slot is a tool for allocating resources to a TaskManager; each slot receives a fixed amount of resources upon TaskManager startup. A Task is a component of a Flink job. Each job is divided into multiple Tasks based on factors such as parallelism and operator type to enable real-time streaming computation.

[0094] ETL (Extract-Transform-Load) data processing technology describes the process of extracting, transforming, and loading data from a source to a destination. In this embodiment, ETL for a streaming corpus is implemented based on Flink, enabling streaming data processing and distribution.

[0095] Conditions are used to process streaming real-time data in Flink. By defining conditions to form rules, they are used to filter matching corpora. For example, in the scenario of device fault detection, anomalies can be identified by forming rules based on specific conditions. When a rule formed by a specific condition is met, a prompt is given. In this embodiment, the condition is the search related word, and the rule is the search expression, which is formed by connecting search keywords with search operators. The search operators can include the null operator, the AND operator, etc. That is, the corpora that satisfy the search expression are the matching corpora, which can be extracted for further processing.

[0096] Currently, ETL data processing technology can be used to extract matching data from streaming corpora, transform the matching data, and load the transformed matching data into the target system. However, as business scenarios become increasingly complex, the rules of ETL data processing technology are also becoming more and more cumbersome. The traditional way of processing streaming corpora is to iterate through each piece of data acquired in real time and match it with each search expression to find matching data.

[0097] In this context, each corpus represents real-time data at a specific point in time. For example, if the corpus is a collection of web logs gathered at a particular point in time, this collection would contain a large amount of log data. This collection consists of multiple log data sets collected through a distributed cluster, which can be a server cluster supporting business operations. Web logs are files automatically recorded by website servers to track user activity on the website. They act like the website's "diary," recording various events that occur during website operation. For instance, information such as when a user visited the website, which pages they visited, how long they stayed, and which browser they used would all be recorded. Log data refers to a series of records corresponding to various data, used to record operations, events, and state changes. Therefore, if each corpus in the form of a web log set were to be matched against each search expression one by one to find matching data, each corpus would require multiple matching iterations. This search process is cumbersome, slow, and requires significant computational processing, wasting computing resources. Furthermore, since streaming data computation involves continuous data processing, maintaining a high computational level can lead to computer crashes.

[0098] To address the aforementioned problems, this application proposes a scheme that can quickly determine the target search expression matched by the search corpus, eliminating the need to match and traverse the search corpus with each search expression. This saves computing resources and improves the efficiency of matching corpus searches. Please refer to the following specific embodiments for details.

[0099] Please see Figure 2 , Figure 2 This is a schematic diagram of a matching corpus search system provided in an embodiment of this application. It includes a terminal 140, an Internet 130, a gateway 120, a server 110, etc.

[0100] Terminal 140 includes, but is not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, and aircraft. Furthermore, it can be a single device or a collection of multiple devices. Terminal 140 can communicate with the Internet 130 via wired or wireless means to exchange data.

[0101] Server 110 refers to a computer system that can provide certain services to terminal 140. Compared to ordinary terminal 140, server 110 has higher requirements in terms of stability, security, and performance. Server 110 can be a single high-performance computer in a network platform, a cluster of multiple high-performance computers, a portion of a single high-performance computer (e.g., a virtual machine), or a combination of portions of multiple high-performance computers (e.g., virtual machines).

[0102] Gateway 120, also known as an internetwork connector or protocol converter, is a computer system or device that acts as a translator, enabling network interconnection at the transport layer. It bridges the gap between two systems using different communication protocols, data formats, languages, or even completely different architectures. Gateways can also provide filtering and security functions. Messages sent from terminal 140 to server 110 are forwarded to the corresponding server 110 via gateway 120. Messages sent from server 110 to terminal 140 are also forwarded to the corresponding terminal 140 via gateway 120.

[0103] The matching corpus search method of this disclosure can be implemented on server 110.

[0104] When the matching corpus search method is implemented on server 110, server 110 aggregates the search keywords in each search expression in the search expression library to obtain a first set of search keywords; deduplicates the search keywords in the first set of search keywords to obtain a deduplicated second set of search keywords; for the corpus to be searched in the streaming corpus, the target search keywords that match the corpus to be searched in the second set of search keywords are determined; in the search expression library, a target search expression that matches the target search keyword combination is searched, and the target search keyword combination is generated by the target search keyword combination; if a matching target search expression exists, the corpus to be searched is determined to be the matching corpus.

[0105] It should be noted that, Figure 2 The schematic diagram of the matching corpus search system shown is merely an example. The matching corpus search system and scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of matching corpus search and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0106] In this embodiment, the description will be from the perspective of a matching corpus search device. Specifically, the matching corpus search device can be integrated into a computer device that has a storage unit and a microprocessor installed, thus having computing power. The computer device can be a server, and in this embodiment, the computer device will be described as a server.

[0107] Please see Figure 3 , Figure 3 This is a flowchart illustrating the matching corpus search method provided in an embodiment of this application. The matching corpus search method includes:

[0108] In step 201, the search keywords in at least one search expression in the search expression library are aggregated to obtain a first set of search keywords.

[0109] Since real-time streaming computing processes continuously generated data streams in real time, and these data streams are unbounded, in this embodiment of the application, the data is the corpus, that is, the continuous corpus is extracted and processed. The corpus can be a sensor dataset formed from sensor data, a network log set formed from log data, or a financial dataset, etc. The above examples are only for better illustrating the corpus. The corpus can also be data streams from other business scenarios.

[0110] It should be noted that the embodiments of this application are based on Flink to perform ETL data processing on the corpus. The purpose of ETL is to extract and transform the corpus of a certain business scenario and load it onto the target end. It can be used to integrate the scattered and messy data of a specific enterprise in a business scenario according to rules, and provide an analytical basis for the enterprise's subsequent decision-making. Therefore, experts set up a rule base to filter out data that meets specific rules from the streaming corpus. This rule base then filters out matching data that matches the rules in the rule base. This matching data can be used to provide analytical basis for subsequent corporate decisions. The rules in this rule base consist of conditions, which are used to filter specific events. For example, a condition could be "log="traffic analysis," so if the data contains "log="traffic analysis, it's a match condition." Another example is "login="login failed," so if the data contains "login="login failed, it's a match condition." A third example is "error," so if the data contains "error," it's a match condition. Furthermore, the rule can be composed of at least one condition connected using operators; that is, there can be one or more conditions, and these operators can be null operators, AND operators, etc.

[0111] In this embodiment of the application, the rule base is the search expression base in the implementation of the application, the rule is the search expression, and the search expression base may include multiple search expressions. The corpus that satisfies any one of the search expressions is the matching corpus. The search expression is generated by connecting search keywords using search operators. The search operators are the aforementioned operators, and the search keywords are the conditions. That is, the search expression is generated by connecting at least one search keyword using search operators.

[0112] Traditional ETL data processing for streaming corpora involves iterating through each piece of data to be searched in real time and matching it against each search expression, searching for matching data that matches any search expression in the search expression library.

[0113] Since each corpus to be searched is real-time data at a certain point in time, assuming it is a set of network logs at a certain point in time, the network logs will carry a large amount of log data at that point in time. At this time, if the corpus corresponding to each network log is traversed and matched with each search expression one by one to find matching corpus, then the corpus corresponding to each network log needs to be matched multiple times. The process is very cumbersome and wastes the computing resources of computer equipment. Furthermore, since streaming data computing is a continuous data computing process, being at a high computing level all the time can also cause computer equipment to crash.

[0114] To overcome the above problems, in this embodiment of the application, all search keywords in each search expression in the search expression library are aggregated in advance to obtain a first set of search keywords, that is, the pattern analysis can be performed by aggregating all search keywords.

[0115] For a better illustration of the embodiments of this application, please refer to the following: Figure 4 As shown, Figure 4 This is a schematic diagram illustrating a scenario for the matching corpus search method provided in an embodiment of this application. Figure 4 The search expression library includes 7 search expressions: search expression 1: A, search expression 2: B, search expression 3: E, search expression 4: A+B, search expression 5: C+D, search expression 6: B+C, and search expression 7: C+D. The "+" is the AND operator.

[0116] The characters A, B, C, D, and E are all search keywords, i.e., different filtering conditions. For example, A can be "log="traffic analysis", B can be "login="login failed", C can be "log="defense", D can be "log="return to login", and E can be "log="purchase failed". These filtering conditions can be set according to business scenarios. This example is not intended as a specific limitation. For better illustration, this application uses characters instead of search keywords in subsequent examples. Based on this, search expression 1 is generated by connecting search keyword A with an empty operator; that is, if the corpus contains keyword A, search expression 1 is matched. Search expression 2 is generated by connecting search keyword B with an empty operator; that is, if the corpus contains keyword B, search expression 2 is matched. Equation 3 is generated by connecting search keyword E with an empty operator; that is, if the corpus contains keyword E, search expression 3 is matched. Search expression 4 is generated by connecting search keywords A and B with an AND operator; that is, if the corpus contains both keywords A and B, search expression 4 is matched. Search expression 5 is generated by connecting search keywords C and D with an AND operator; that is, if the corpus contains both keywords C and D, search expression 5 is matched. Search expression 6 is generated by connecting search keywords B and C with an AND operator; that is, if the corpus contains both keywords B and C, search expression 6 is matched. Search expression 7 is generated by connecting search keywords C and D with an AND operator; that is, if the corpus contains both keywords C and D, search expression 7 is matched.

[0117] Furthermore, the search keywords of the 7 search expressions in the search expression library are aggregated to obtain the first search keyword set A, B, E, A, B, C, D, B, C, C, D. According to the first search keyword set, it is easy to see that the search keywords in the search expressions will appear repeatedly in different search expressions. Therefore, in order to better analyze the search keywords in the future, the first search keyword set can be further deduplicated.

[0118] In step 202, the search keywords in the first set of search keywords are deduplicated to obtain the second set of search keywords after deduplication.

[0119] Since the search keywords in the first set of search keywords appear repeatedly, in order to better analyze and summarize the search keywords, the search keywords in the first set of search keywords can be deduplicated. That is, duplicate search keywords are removed, and only one unique search keyword is kept as the subsequent index, resulting in a deduplicated second set of search keywords. The search keywords in the second set of search keywords do not appear repeatedly. Based on this, the subsequent search corpus does not need to match and traverse every search expression in the search expression library one by one. Instead, it can quickly traverse the unique search keywords in the deduplicated second set of search keywords. Since deduplication has been performed beforehand, the target search keyword that matches the search corpus in the second set of search keywords can be quickly determined. Compared with the scheme of matching and traversing every search expression in the search expression library one by one, the embodiment of this application can index the subsequent search corpus better and faster.

[0120] For example, please continue reading Figure 4 As shown, the first set of search keywords A, B, E, A, B, C, D, B, C, C, D can be deduplicated, and the duplicate search keywords A, B, C, D can be deduplicated to obtain the second set of search keywords A, B, C, D, E. The second set of search keywords does not contain duplicate search keywords and can be used as an index for subsequent corpus matching.

[0121] In step 203, for the corpus to be searched in the streaming corpus, the target search keywords that match the corpus to be searched in the second set of search keywords are determined.

[0122] Unlike traditional ETL data processing methods that iterate through and match each piece of data to be searched against each search expression in real-time, determining whether it matches any search expression in the search expression library, this application establishes a second set of search keywords without duplicate search keywords through steps 201 and 202. Since this second set of search keywords contains all search keywords from the search expression library, the target search keyword triggered (i.e., matched) by the data to be searched from the streaming corpus can be determined by using this second set of search keywords as an index for matching.

[0123] It should be noted that this embodiment is based on the Flink framework, continuously extracting corpora from the business source that needs processing into a streaming corpus. Correspondingly, the Flink framework processes the search corpora sequentially according to their generation time in the streaming corpus. The search corpus can be extracted from the business source at a specific moment, carrying a large amount of data. If it needs to be matched sequentially with the search keywords contained in each search expression, it would waste the computing resources of the computer equipment. Furthermore, since streaming data computation is a continuous process, constantly operating at a high computational level could cause the computer equipment to crash.

[0124] Therefore, in this embodiment, the search corpus to be searched in the streaming corpus is matched with each search keyword in the second set of search keywords used as an index. When the search corpus to be searched triggers a search keyword in the second set of search keywords, the triggered search keyword is determined as the target search keyword. The number of target search keywords can be one or more, ranging from one to the total number of search keywords in the second set of search keywords. Correspondingly, when the search corpus to be searched does not trigger a search keyword in the second set of search keywords, it indicates that the search corpus to be searched is not a matching corpus, and the search processing of the search corpus to be searched can be skipped directly, and the next search corpus to be searched can be processed. Thus, compared with related technologies, which require matching and comparing each expression to be searched one by one, this embodiment of the application can quickly determine that the search corpus to be searched is not a matching corpus by directly matching the search corpus to be searched with the search keywords in the second set of search keywords, skipping the one-by-one search calculation of the current search corpus to be searched, greatly improving the efficiency of streaming processing and saving computing resources of computer equipment.

[0125] In some implementations, the step of determining the target search keywords that match the search corpus in the second set of search keywords for the search corpus in the streaming corpus may include:

[0126] (1) Obtain each first search keyword in the second set of search keywords;

[0127] (2) Match each first search keyword to the corpus to be searched in sequence, and determine the matched first search keyword as the target search keyword.

[0128] In order to better describe the embodiments of this application, the deduplicated search keywords in the second search keyword set are defined and described as first search keywords. Therefore, each first search keyword in the second search keyword set can be obtained firstly. For example, please continue to refer to... Figure 4As shown, each of the first search keywords in the second set of search keywords can be obtained, namely "A, B, C, D, E".

[0129] Furthermore, the corpus to be searched can be matched sequentially with each of the first search keywords. The corpus that matches a first search keyword is then identified as the target search keyword. Taking a web log set as an example, the log data in the web log set can be matched sequentially with each of the first search keywords, and the matched first search keywords are identified as the target search keywords. For example, please continue reading... Figure 4 As shown, the corpus to be searched can be matched sequentially with each first search keyword "A, B, C, D, E". If the first search keyword matched is A, then the first search keyword matched is A, and so on. This is not exhaustive.

[0130] Therefore, in this embodiment, it is only necessary to match each deduplicated first search keyword in the corpus to be searched sequentially. Compared with related technologies, which require matching and comparing the corpus to be searched and the expression to be searched one by one, this embodiment can save the amount of search computation, thereby saving the computing efficiency of computer equipment.

[0131] In step 204, the target search expression that matches the combination of target search keywords is searched in the search expression library.

[0132] Each search expression in the search expression library is generated by connecting search keywords using search operators. That is, the search expression can be generated by one empty operator and one search keyword, or by two or more search keywords connected with operators. Therefore, simply matching one or more target search keywords is not enough to determine whether a search expression in the search expression library has been matched; further searching is required.

[0133] Accordingly, since the target search keyword combinations generated from target search keyword combinations can cover any search expression generated based on the target search keywords in the search expression library, we can first generate target search keyword combinations by arbitrarily combining target search keywords. Then, in the search expression library, we search for target search expressions that match (i.e., hit) the target search keyword combination. This target search expression is the search expression that the search corpus matches from the search expression library. When a target search expression that matches the target search keyword combination exists, it means that the search corpus is a matching corpus. The number of target search expressions can be one or more. Correspondingly, when no target search expression matching the target search keyword combination exists, it indicates that the corpus to be searched is not a matching corpus. The search processing of the corpus to be searched can be skipped directly, and the next corpus to be searched can be processed. Thus, compared with related technologies that require matching and comparing each corpus to be searched one by one, the embodiments of this application directly search for the target search expression matching the target search keyword combination in the search expression. This can quickly determine that the corpus to be searched is not a matching corpus, skip the one-by-one search calculation of the current corpus to be searched, greatly improve the efficiency of streaming processing, and save the computing resources of computer equipment.

[0134] For example, please continue reading Figure 4 As shown, when the target search keywords are A and B, the generated target search keyword combination is {A}, {B}, {A, B}. That is, no matter how the target search keywords are combined in the search expression library to generate the target search expression, it is covered by this target search keyword combination. This target search keyword combination {A}, {B}, {A, B} covers search expression 1, search expression 2, and search expression 4. Therefore, search expression 1, search expression 2, and search expression 4 can be identified as the target search expression.

[0135] In some implementations, searching the search expression library for a target search expression that matches the target search keyword combination includes:

[0136] (1) Perform a full combination of the target search keywords to obtain the target search keyword combination;

[0137] (2) In the search expression library, find the target search expression that matches the target search keyword combination.

[0138] The total number of combinations refers to all possible combinations of selecting a subset from a given set of elements (including the case of selecting 0 elements, i.e., an empty set). If a set has n elements, then its total number of combinations is 2 to the power of n.

[0139] Since the target search keyword combination generated can cover any search expression generated based on the target search keywords in the search expression library, we can first perform a full combination of the target search to obtain the target search keyword combination. For example, please continue reading. Figure 4 As shown, when the target search keywords are A and B, the generated target search keyword combinations are {empty}, {A}, {B}, and {A, B}. Since the search expression does not contain empty sets of search keywords, empty sets in this target search keyword combination will be filtered out.

[0140] In some implementations, to achieve empty set combination filtering, the target search keywords are fully combined to obtain target search keyword combinations, including:

[0141] (1.1) Perform a full combination of the target search keywords to obtain the first search keyword combination;

[0142] (1.2) Delete the empty set search keyword combination in the first search keyword combination to obtain the target search keyword combination.

[0143] This allows you to perform a full combination operation on the target search keywords to obtain the first combination of search keywords. For example, see [link to article]. Figure 4 As shown, when the target search keywords are A and B, then by combining all the target search keywords, we can get the first search keyword combination {empty}, {A}, {B}, {A, B}.

[0144] Since the entire combination will select 0 elements, there will be empty set search keyword combinations. However, the search expression does not contain any search keywords with an empty set. Therefore, empty set search keyword combinations in the target search keyword combination will be filtered out. Specifically, the empty set search keyword combinations in the first search keyword combination can be deleted, and the remaining first search keyword combinations after deletion can be determined as the target search keyword combination. For example, please continue reading. Figure 4 As shown, the empty set search keyword combination {empty} in the first search keyword combination can be deleted, and the remaining first search keyword combinations {A}, {B}, and {A, B} after deletion can be determined as the target search keyword combination.

[0145] Furthermore, since this target search keyword combination exhaustively enumerates all search expressions, it allows for the rapid retrieval of target search expressions that match the target search keyword combination from the search expression library. These target search expressions are the specific search expressions found in the search expression library that match the corpus to be searched. For example, please continue reading... Figure 4As shown, search expression 1 matches the target search keyword combination {A}, search expression 2 matches the target search keyword combination {B}, and search expression 4 matches the target search keyword combination {A, B}. Therefore, search expression 1, search expression 2, and search expression 4 can be identified as the target search expressions. Compared to related technologies that require matching and comparing the search corpus and the search expressions one by one, this embodiment of the application can quickly search in the search expression library according to the determined target search keyword combination to find the target search expression that matches the search corpus. This skips the process of searching and calculating each search expression one by one, greatly improving the efficiency of streaming processing and saving computing resources.

[0146] In some implementations, searching the search expression library for a target search expression that matches the target search keyword combination includes:

[0147] (2.1) Obtain each search expression from the search expression library;

[0148] (2.2) Compare each search expression with the target search keyword combination in turn;

[0149] (2.3) Based on the comparison results, the search expression that matches the target search keyword combination is determined as the target search expression.

[0150] This allows you to retrieve each search expression from the search expression library. Since the target search keyword combination generated from the target search keyword combination can cover any search expression generated based on the target search keyword in the search expression library, each search expression can be compared with each target keyword combination in turn. When the search expression matches a target search keyword combination, the comparison result is a match; when the search expression does not match a target search keyword combination, the comparison result is a miss.

[0151] Based on this, and according to the comparison results, the search expression that matches the target search keyword combination is determined as the target search expression. For a better illustration of the embodiments of this application, please refer to [link to relevant documentation]. Figure 4 and one And see Figure 5 As shown, Figure 5This is a schematic diagram of another scenario for the matching corpus search method provided in this application embodiment. When the target search keywords are A, B, and E, and the target search keyword combinations are {A}, {B}, {E}, {A, B}, {A, E}, {B, E}, {A, B, E}, the search expression 1: A, search expression 2: B, search expression 3: E, search expression 4: A+B, search expression 5: C+D, search expression 6: B+C, and search expression 7: C+D are compared with each target search keyword combination in turn. Based on the comparison results, the search expression 1 that matches the target search keyword combination {A}, the search expression 2 that matches the target search keyword combination {B}, the search expression 3 that matches the target search keyword combination {E}, and the search expression 4 that matches the target search keyword combination {A, B} are determined as the target search expressions.

[0152] In step 205, if a matching target search expression exists, the corpus to be searched is determined to be the matching corpus.

[0153] If a matching target search expression exists, it means that the corpus to be searched has matched at least one search expression in the search expression library. Therefore, the corpus to be searched meets the condition and can be identified as matching corpus. Subsequently, appropriate suggestions can be provided for the matching corpus based on the matched target search expression.

[0154] As described above, this embodiment of the application obtains a first set of search keywords by aggregating the search keywords in each search expression in the search expression library; deduplicating the search keywords in the first set of search keywords to obtain a second set of deduplicated search keywords; determining the target search keywords that match the target search keywords in the second set of search keywords for the corpus to be searched in the streaming corpus; searching for target search expressions that match the target search keyword combination in the search expression library, wherein the target search keyword combination is generated by the target search keyword combination; and determining the corpus to be searched as the matching corpus if a matching target search expression exists.

[0155] Therefore, by pre-aggregating and deduplicating the search keywords in various search expressions in the search expression library, a second set of search keywords with no duplicates is obtained. Based on this, upon receiving the search corpus from the streaming corpus, the target search keyword matching the search corpus in the second set of search keywords can be quickly determined. Since the target search keyword combination generated from the target search keyword combination covers any search expression generated based on the target search keyword in the search expression library, matching target search keywords can be quickly found in the search expression library. The target search expression is the search expression that matches the corpus to be searched in the search expression library. This enables fast lookup of the target search expression, which means that the corpus to be searched meets the search conditions and is identified as the matching corpus. Compared with related technologies, which require matching and traversing each search expression in the search expression library for each corpus to find the matching corpus, the embodiments of this application can quickly determine the target search expression that the corpus to be searched matches, without having to match and traverse each search expression for the corpus to be searched. Therefore, it can save computing resources of computer equipment and improve the efficiency of matching corpus search.

[0156] In some implementations, after identifying the corpus to be searched as the matching corpus, and quickly filtering out the corpus that matches the search expression from the streaming corpus, the matching corpus and the corresponding matching search expression are directly distributed to the target end. This results in the need to distribute the corpus every time there is matching corpus, and the relevant developers on the target end need to manually classify the matching corpus and the corresponding matching search expression received from the streaming corpus in conjunction with the business scenario.

[0157] Current business scenarios include simple, unordered, and ordered scenarios. In simple scenarios, it's necessary to promptly output prompts for specific individual search keywords within the matching search expressions of the streamed matching corpus. For example, a single search keyword might be expressed as "log="password cracking," indicating that an object is cracking passwords within the streaming data. This matching corpus and its corresponding search expression need to be promptly distributed to the target end for notification. Current ETL distribution methods distribute all matching corpora and their corresponding search expressions to the target end, failing to identify specific search expressions and thus hindering ETL processing for this simple business scenario.

[0158] In unordered business scenarios, for search expressions formed by multiple specific search keywords, it is necessary to count the number of triggers. Only when the search expression reaches the trigger threshold should a prompt be given. For example, in a business scenario that requires password login, a prompt should only be given when the number of consecutive failed password logins reaches the trigger threshold. The ETL distribution methods of related technologies cannot recognize such search expressions, let alone implement ETL processing for such unordered business scenarios.

[0159] In ordered business scenarios, search expressions formed by multiple specific search keywords may occur frequently over a period of time. It's unnecessary to record them every time; they only need to be processed once. Once the search expression is triggered, the same type of search expression will not be received for a short period. For example, in system protection scenarios, when an attack is received, the system is temporarily shut down. During the period of system shutdown, no further attack-related alerts will be received. Current ETL distribution methods cannot recognize these types of search expressions, let alone handle ETL processing in such ordered business scenarios.

[0160] To address the ETL processing challenges in the three scenarios described above, this application proposes three types of information: simple type information, unordered type information, and ordered type information. Corresponding type information is then set for each search expression.

[0161] Simple type information indicates that the search keyword of the search expression belonging to this type is only one, and the trigger threshold is one. That is, the simple loading rule will immediately provide a prompt every time the search expression of simple type information is triggered.

[0162] Unordered type information indicates that the search expression of this type contains more than one search keyword, the trigger threshold is greater than one, and the sequentially occurring configuration parameters are in a closed state. For example, if the trigger threshold is 10 and the sequentially occurring configuration parameters are in a closed state, it represents that the search expression is of unordered type information. This means that unordered type search expressions need to be counted, and a prompt is given when the count reaches the trigger threshold. Accordingly, to avoid checking whether the count meets the trigger threshold for each unordered type search expression, an unordered loading rule can be set to iterate through unordered type search expressions using a sliding time window. No prompt is given for each trigger; only the historical trigger count is accumulated. Furthermore, the trigger threshold is checked at a set trigger detection time point. This avoids triggering the threshold check for each instance, saving computational resources.

[0163] Ordered type information indicates that the search expression of this type contains more than one search keyword, and the configuration parameters that occur sequentially are either off or on. This means that when an ordered type search expression is triggered, no other ordered type search expressions will be received for a short period. An ordered rule can be set to add ordered type search expressions to a preset queue (which can be a priority queue) and start a timer to update the watermark. Ordered type search expressions with timestamps below the watermark will not be received; that is, no ordered type search expressions will be received before the timer ends. Therefore, through the above simple loading rules, unordered loading rules, and ordered loading rules, ETL processing can be implemented for simple, unordered, and ordered business scenarios.

[0164] In some embodiments, see Figure 6 After determining that the corpus to be searched is the matching corpus, the process further includes:

[0165] Step 301: Obtain the type information of the target search expression;

[0166] Step 302: Determine the corresponding loading processing rule based on the type information, and load the matching corpus according to the loading processing rule to generate corresponding prompt information.

[0167] This allows you to pre-set the corresponding type information for each search expression. For example, please refer to [link / reference]. Figure 4 As shown, the type information of search expression 1, search expression 2 and search expression 3 can be set to simple type information, the type information of search expression 4 and search expression 5 can be set to unordered type information, and the type information of search expression 6 and search expression 5 can be set to ordered type information.

[0168] Based on this, the type information of the target search expression corresponding to the matching corpus can be directly obtained. In some embodiments, a unique vector identifier can be set for each type of information, and this vector representation can be associated with each search expression. Subsequently, the type information of each search expression can be quickly identified through the vector identifier. In some embodiments, see [reference needed]. Figure 7 Step 301 includes:

[0169] Step 3011: Label the vector identifier associated with the search expression;

[0170] Step 3012: Determine the type information to which the target search expression belongs.

[0171] Here, the vector identifier is a unique value used to represent type information. For example, the vector identifier associated with simple type information can be 0, the vector identifier associated with unordered type information can be 1, and the vector identifier associated with ordered type information can be 2. This vector identifier is used to distinguish different types of information because the search expressions for unordered type information and ordered type information may have the same search keywords. For example, please continue reading. Figure 4 As shown, search expressions 5 and 7 have the same search keywords, but their type information is different. Therefore, it is necessary to distinguish their types using vector identifiers. In this way, the vector identifier associated with each target search expression in the matching corpus can be directly obtained, and the type information of each target search expression can be determined based on the vector identifier. When the target search expressions are search expressions 1, 2, 3, and 4, the type information of search expressions 1, 2, and 3 can be determined to be simple type information based on the vector identifier, while the type information of search expression 4 is unordered type information.

[0172] Furthermore, the corresponding loading processing rules can be determined based on the type information. Specifically, simple type information determines the corresponding simple loading processing rules, and then the matching corpus is loaded according to these rules to generate corresponding prompts. Unordered type information determines the corresponding unordered loading processing rules, and then the matching corpus is loaded according to these rules to generate corresponding prompts. Similarly, ordered type information determines the corresponding ordered loading processing rules, and then the matching corpus is loaded according to these rules to generate corresponding prompts. In essence, the matching corpus is loaded using the aforementioned loading processing rules to generate corresponding prompts.

[0173] In some embodiments, the corresponding loading processing rule is determined based on the type information, and the matching corpus is loaded using the loading processing rule to generate corresponding prompt information, including:

[0174] (1) If the type information is simple type information, then the corresponding simple loading processing rule is determined according to the simple type information, and the matching corpus is loaded and processed by the simple loading processing rule to generate the corresponding first prompt information;

[0175] (2) If the type information is unordered type information, then the corresponding unordered loading processing rule is determined according to the unordered type information, and the matching corpus is loaded and processed by the unordered loading processing rule to generate the corresponding second prompt information;

[0176] (3) If the type information is ordered type information, then the corresponding ordered loading processing rule is determined according to the ordered type information, and the matching corpus is loaded and processed by the ordered loading processing rule to generate the corresponding third prompt information;

[0177] To address ETL processing in three scenarios, this application's embodiments design three types of information: simple type information, unordered type information, and ordered type information. Correspondingly, three loading rules are set for the search expressions of these three types of information: simple loading rules, unordered loading rules, and ordered loading rules.

[0178] Therefore, if the type information is simple type information, the loading rule can be directly determined as a simple loading rule based on the simple type information. The search expression corresponding to the simple type information of the matching corpus and the first prompt information generated by the matching corpus are then distributed to the target end through the simple loading rule, so that the developers on the target end can know in time that a simple event has been triggered for monitoring.

[0179] If the type information is unordered, the loading rule can be directly determined as an unordered loading rule based on this unordered type information. The search expression for unordered type information within the time window of the unordered loading rule is traversed through the sliding time window of the unordered loading rule to accumulate the historical trigger count. When the trigger time point is reached, a threshold judgment is performed. If the historical trigger count of the search expression for unordered type information meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the search expression for unordered type that meets the trigger threshold. The corresponding second prompt information is generated and distributed to the target end so that the developers on the target end can know in time that an unordered event has been triggered for system monitoring.

[0180] If the type information is unordered, the loading rule can be directly determined as an unordered loading rule based on this unordered type information. The search expression for unordered type information within the time window of the unordered loading rule is traversed through the sliding time window of the unordered loading rule to accumulate the historical trigger count. When the trigger time point is reached, a threshold judgment is performed. If the historical trigger count of the search expression for unordered type information meets the trigger threshold, the matching corpus is loaded based on the trigger detection time point and the search expression for unordered type that meets the trigger threshold. The corresponding second prompt information is generated and distributed to the target end so that the developers on the target end can know in time that an unordered event has been triggered for system monitoring.

[0181] If the type information is ordered, the loading rule can be directly determined as an ordered loading rule based on this ordered type information. The search expression for the ordered type information is then processed through a preset queue of ordered loading rules. When the search expression for the ordered type information is successfully added to the preset queue, the matching corpus is loaded using the search expression for the ordered type information added to the preset queue, generating the corresponding third-party prompt information. This allows developers on the target side to be promptly aware that an ordered event has been triggered, facilitating system monitoring.

[0182] In some implementations, the matching corpus is loaded using the simple loading processing rules to generate corresponding first prompt information, including:

[0183] (1.1) Obtain the first target search expression through the simple loading processing rules;

[0184] (1.2) Load the matching corpus according to the first target search expression to generate the corresponding first prompt information.

[0185] The first target search expression is a target search expression that matches the simple type information of the corpus. The first target search expression corresponding to the matching corpus can be directly obtained through the simple loading rule. Since the simple loading rule will immediately provide a prompt each time the simple type search expression is triggered, the matching corpus can be loaded and processed according to the first target search expression to generate the corresponding first prompt information and distribute it to the target end. For example, the first target search expression can be "log = type analysis", and the matching corpus is corpus 1. Then, the first prompt information that the corpus 1 has matched the simple type information "log = type analysis" can be generated.

[0186] In some implementations, the matching corpus is loaded using the unordered loading processing rules to generate corresponding second prompt information, including:

[0187] (2.1) Obtain the second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding number of historical triggers through the unordered loading processing rules. The second target search expression is a target search expression with unordered type information.

[0188] (2.2) Increment the historical trigger count by one to obtain the updated historical trigger count;

[0189] (2.3) Determine the corresponding trigger detection time point based on the time length of the sliding time window;

[0190] (2.4) At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

[0191] The second target search expression is a target search expression whose type information in the matching corpus is unordered. This second target search expression can be directly obtained through the unordered loading processing rule. Correspondingly, the unordered loading rule involves matching search expressions with unordered type information using a sliding time window. For example, please refer to [link / reference]. Figure 8 As shown, Figure 8 This is a schematic diagram of the sliding time window structure provided in an embodiment of this application. The time window of this sliding time window is 2T, and the step size is T, where T is in minutes, for example, 3 minutes. This design ensures that search expressions are not missed and has high computational efficiency. Specifically, within each sliding time window, the historical trigger count of search expressions for unordered information is counted, and at the trigger detection time point, it is checked whether the historical trigger count meets the trigger threshold. This trigger detection time point is the time node for checking whether the historical trigger count meets the trigger threshold, and can be the end time point of the sliding time window.

[0192] Therefore, it is also necessary to determine the sliding time window to which the second target search expression currently belongs and the corresponding number of historical triggers that have been triggered. Furthermore, since the second target search expression has been triggered once, the historical trigger count can be incremented by one to obtain the updated historical trigger count. To avoid checking whether the count value meets the trigger threshold every time a search expression of unordered information is processed, the detection can be performed uniformly at the trigger detection time point to obtain the duration of the sliding time window. Based on the duration and the start time of the currently belonging sliding time window, the end time point of the currently belonging sliding time window can be calculated, and this end time point can be used as the trigger detection time point.

[0193] In some implementations, to avoid missing a timely response opportunity due to the trigger detection time point, the trigger detection time point can be flexibly set according to the length of the sliding time window. Specifically, determining the corresponding trigger detection time point based on the length of the sliding time window includes:

[0194] (2.3.1) If the length of the sliding time window is less than or equal to the preset time, the end time of the sliding time window is determined as the corresponding trigger detection time point;

[0195] (2.3.2) If the length of the sliding time window is greater than the preset time, the corresponding trigger detection time point is determined according to the preset time.

[0196] The preset time is the critical value for determining whether a timely response opportunity has been missed. It can be flexibly set according to the actual business scenario, for example, 10 minutes. If the length of the sliding time window is less than or equal to the preset time, it means that the timely response opportunity will not be missed, and the end time of the sliding time window can be directly determined as the trigger detection time point. Conversely, if the length of the sliding time window is greater than the preset time, it means that the timely response opportunity will be missed. In this case, a strategy of setting the trigger detection time point at preset intervals can be adopted.

[0197] Furthermore, when the trigger detection time point is reached at the current time, if the historical trigger count of the second target search expression meets the trigger threshold, for example, if the historical trigger count is 10 times and meets the trigger threshold of 5 times, then the matching corpus is loaded according to the trigger detection time point and the second target search expression. For example, if the trigger detection time point is the 10th minute, the second target search expression is "log = login interface + log = login failed", and the matching corpus is corpus 2, then a second prompt message "log = login interface + log = login failed" that matches the unordered type information in the 10th minute can be generated.

[0198] In some implementations, the matching corpus is loaded using the ordered loading rules to generate corresponding third-party prompts, including:

[0199] (3.1) Obtain the third target search expression and the preset queue through the ordered loading processing rules;

[0200] (3.2) Obtain the hit time of the third target search expression;

[0201] (3.3) If the preset queue is empty, or the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, and the matching corpus is loaded according to the third target search expression to generate the corresponding third prompt information.

[0202] The third target search expression is a target search expression whose type information in the matching corpus is ordered. This third target search expression can be directly obtained through ordered loading rules. The ordered loading rules involve adding the ordered type search expressions to a preset queue (which can be a priority queue) and starting a timer to update the water level. Ordered type search expressions with timestamps below the water level will not be received; that is, ordered type search expressions will not be received before the timer expires. Therefore, a preset queue is also needed to store the corresponding search expressions for ordered type information.

[0203] Since search expressions for ordered information will not be received for a short period after being triggered, it is necessary to first obtain the hit time of the third target search expression. Furthermore, this preset time is a temporary time for defining when search expressions for ordered information will not be received. It can be flexibly set according to scenario requirements, for example, 1 second. If the preset queue is empty, or the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than the preset time, it indicates that the third target search expression can be added to the preset queue. The third target search expression is then added to the preset queue, and the matching corpus is loaded and processed according to the third target search expression. For example, if the matching corpus is matching corpus 3, and the third target search expression is "log = login successful + log = virtual resource transfer", then a third prompt message "log = login successful + log = virtual resource transfer" can be generated for matching corpus 3, indicating that the ordered information is hit.

[0204] Therefore, by pre-designing three types of information—simple, unordered, and ordered—along with the designed simple, unordered, and ordered loading rules, ETL processing for simple, unordered, and ordered business scenarios can be automatically implemented. This improves the efficiency of matching corpus classification processing, saves manual operation costs for business developers, and enhances the adaptability of corpus matching search.

[0205] In some implementations, adding the third target search expression to the preset queue includes: adding the third target search expression to the preset queue and starting a timer; wherein the start time of the timer is the enqueue time of the third target search expression, and the end time of the timer is determined based on the enqueue time and the preset time.

[0206] Adding the third target search expression to the preset queue indicates that an ordered business scenario has been triggered, requiring the activation of a timer. The start time of this timer is the enqueue time for the third target search expression to enter the preset queue, and the corresponding end time is the sum of the enqueue time and the preset time. Between the start time and the end time, the preset queue will not receive any search expressions of ordered type information. In other words, only one prompt will be made during this time period, avoiding repeated invalid prompt output and saving computing resources.

[0207] In some implementations, please refer to the following for better illustration of the embodiments of this application: Figure 9 As shown, Figure 9 This is a schematic diagram of the overall process of the matching corpus search method provided in the embodiments of this application. Figure 9 First, each search expression in the search expression library is preprocessed to filter out valid search expressions. Then, deduplication is performed to obtain a second set of search keywords. Further, search keyword matching is performed between the corpus to be searched and the second set of search keywords to find the target search keywords that match the corpus to be searched within the second set of search keywords. Then, in the search expression library, target search expressions that match the target search keyword combinations are searched. Based on the type information of the target search expression, simple association (simple loading rule processing), unordered association (unordered loading rule processing), and ordered keywords (ordered loading rule processing) are performed respectively. For specific implementation details, please refer to the previous embodiment description; they will not be elaborated here.

[0208] Please see Figure 10 , Figure 10 This is a schematic diagram of the structure of the matching corpus search device provided in the embodiments of this application. The matching corpus search device is applied to a computer device and is used to search for matching corpus in a streaming corpus that matches any search expression in a search expression library. The search expression is generated by connecting search keywords using search operators. The matching corpus search device may include a convergence unit 401, a deduplication unit 402, a first determination unit 403, a search unit 404, and a second determination unit 405, etc.

[0209] The aggregation unit 401 is used to aggregate the search keywords in at least one search expression in the search expression library to obtain a first set of search keywords.

[0210] The deduplication unit 402 is used to deduplicat the search keywords in the first set of search keywords to obtain a second set of search keywords after deduplication.

[0211] The first determining unit 403 is used to determine the target search keywords that match the search corpus in the second set of search keywords for the search corpus in the streaming corpus.

[0212] In some embodiments, the first determining unit 403 is configured to:

[0213] For the searchable corpus in the streaming corpus, obtain each first search keyword from the second set of search keywords;

[0214] The search corpus is sequentially matched with each first search keyword, and the matched first search keyword is determined as the target search keyword.

[0215] The search unit 404 is used to search for a target search expression that matches the target search keyword combination in the search expression library, wherein the target search keyword combination is generated by combining the target search keywords.

[0216] In some embodiments, the lookup unit 404 includes:

[0217] The combination subunit (unidentified) is used to perform a full combination of the target search keywords to obtain a combination of target search keywords;

[0218] The search subunit (unidentified) is used to search for a target search expression that matches the combination of the target search keywords in the search expression library.

[0219] In some embodiments, the lookup subunit (unidentified) is used for:

[0220] Retrieve each search expression from the search expression library;

[0221] Each search expression is compared sequentially with the target search keyword combination;

[0222] Based on the comparison results, the search expression that matches the target search keyword combination is determined as the target search expression.

[0223] In some embodiments, the combined subunit (unidentified) is used for:

[0224] The target search keywords are combined in full to obtain the first search keyword combination;

[0225] The empty set of search keyword combinations in the first search keyword combination is deleted to obtain the target search keyword combination.

[0226] The second determining unit 405 is used to determine the corpus to be searched as the matching corpus if a matching target search expression exists.

[0227] In some embodiments, the apparatus further includes:

[0228] The acquisition unit (unidentified) is used to acquire the type information to which the target search expression belongs;

[0229] The loading unit (unidentified) is used to determine the corresponding loading processing rule based on the type information, and to load the matching corpus according to the loading processing rule to generate corresponding prompt information.

[0230] In some embodiments, the acquisition unit (unidentified) is used for:

[0231] Obtain the vector identifier associated with the target search expression;

[0232] The type information to which the target search expression belongs is determined based on the vector identifier.

[0233] In some embodiments, the type information includes at least simple type information, unordered type information, and ordered type information, and the loading unit (unidentified) includes:

[0234] A simple loading subunit (unidentified) is used to determine the corresponding simple loading processing rule based on the simple type information if the type information is simple type information, and to load the matching corpus through the simple loading processing rule to generate the corresponding first prompt information;

[0235] An unordered loading subunit (unidentified) is used to determine the corresponding unordered loading processing rule based on the unordered type information if the type information is unordered type information, and to load the matching corpus through the unordered loading processing rule to generate the corresponding second prompt information.

[0236] An ordered loading subunit (unidentified) is used to determine the corresponding ordered loading processing rule based on the ordered type information if the type information is ordered type information, and to load the matching corpus through the ordered loading processing rule to generate the corresponding third prompt information;

[0237] Wherein, the search keyword of the search expression corresponding to the simple type information is one, and the trigger threshold is one; the search keyword of the search expression corresponding to the unordered type information is more than one, the trigger threshold is more than one, and the configuration parameters that occur sequentially are closed state parameters; the search keyword of the search expression corresponding to the ordered type information is more than one, and the configuration parameters that occur sequentially are open state parameters.

[0238] In some embodiments, the simple loading subunit (unidentified) is used for:

[0239] The first target search expression is obtained through the simple loading processing rule, and the first target search expression is a target search expression whose type information is simple type information.

[0240] The matching corpus is loaded and processed according to the first target search expression to generate the corresponding first prompt information.

[0241] In some embodiments, the unordered loading subunit (unidentified) is used for:

[0242] The second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding historical trigger count are obtained through the unordered loading processing rules. The type information of the second target search expression is the target search expression with unordered type information.

[0243] Increment the historical trigger count by one to obtain the updated historical trigger count;

[0244] The corresponding trigger detection time point is determined based on the length of the sliding time window.

[0245] At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

[0246] In some embodiments, the unordered loading subunit (unidentified) is further used for:

[0247] The second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding historical trigger count are obtained through the unordered loading processing rules. The type information of the second target search expression is the target search expression with unordered type information.

[0248] Increment the historical trigger count by one to obtain the updated historical trigger count;

[0249] If the length of the sliding time window is less than or equal to the preset time, then the end time of the sliding time window is determined as the corresponding trigger detection time point;

[0250] If the length of the sliding time window is greater than the preset time, then the corresponding trigger detection time point is determined according to the preset time;

[0251] At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

[0252] In some embodiments, the ordered loading subunit (unidentified) is used for:

[0253] The third target search expression and the preset queue are obtained through the ordered loading processing rule. The third target search expression is a target search expression with ordered type information. The preset queue is used to store the search expressions corresponding to the ordered type information.

[0254] Obtain the hit time of the third target search expression;

[0255] If the preset queue is empty, or if the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, and the matching corpus is loaded and processed according to the third target search expression to generate the corresponding third prompt information.

[0256] In some embodiments, the ordered loading subunit (unidentified) is further used for:

[0257] The third target search expression and the preset queue are obtained through the ordered loading processing rule. The type information of the third target search expression is the target search expression of ordered type information. The preset queue is used to store the search expressions corresponding to ordered type information.

[0258] Obtain the hit time of the third target search expression;

[0259] If the preset queue is empty, or if the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, a timer is started, and the matching corpus is loaded and processed according to the third target search expression to generate the corresponding third prompt information.

[0260] The start time of the timer is the enqueue time of the third target search expression, and the end time of the timer is determined based on the enqueue time and the preset time.

[0261] Reference Figure 11 , Figure 11 To implement the partial structural block diagram of the terminal 140 of this embodiment, the terminal 140 includes: a radio frequency (RF) circuit 510, a memory 515, an input unit 530, a display unit 540, a sensor 550, an audio circuit 560, a wireless fidelity (WiFi) module 570, a processor 580, and a power supply 590, etc. Those skilled in the art will understand that... Figure 11The terminal 140 structure shown does not constitute a limitation on a mobile phone or computer, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0262] The RF circuit 510 can be used to receive and transmit signals during information transmission or calls. In particular, it receives downlink information from the base station and processes it with the processor 580; in addition, it transmits uplink data to the base station.

[0263] The memory 515 can be used to store software programs and modules. The processor 580 executes various terminal functions and searches for matching corpora by running the software programs and modules stored in the memory 515.

[0264] The input unit 530 can be used to receive input numeric or character information, and to generate key signal inputs related to the terminal's settings and function control. Specifically, the input unit 530 may include a touch panel 531 and other input devices 532.

[0265] The display unit 540 can be used to display input or provided information, as well as various menus of the terminal. The display unit 540 may include a display panel 541.

[0266] Audio circuit 560, speaker 561, and microphone 562 provide an audio interface.

[0267] In this embodiment, the processor 580 included in the terminal 140 can execute the matching corpus search method of the previous embodiment.

[0268] The terminal 140 in this disclosure includes, but is not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, and aircraft. This invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0269] Figure 12This is a partial structural block diagram of a server 110 implementing an embodiment of the present disclosure. The server 110 can vary significantly due to different configurations or performance characteristics, and may include one or more central processing units (CPUs) 622 (e.g., one or more processors) and memory 632, and one or more storage media 630 (e.g., one or more mass storage devices) for storing application programs 642 or data 644. The memory 632 and storage media 630 may be temporary or persistent storage. The program stored in the storage media 630 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server 600. Furthermore, the CPU 622 may be configured to communicate with the storage media 630 and execute the series of instruction operations in the storage media 630 on the server 600.

[0270] Server 110 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input / output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0271] The central processing unit 622 in server 110 can be used to execute the matching corpus search method of this disclosure embodiment, namely: aggregating the search keywords in at least one search expression in the search expression library to obtain a first search keyword set; deduplicating the search keywords in the first search keyword set to obtain a deduplicated second search keyword set; for the corpus to be searched in the streaming corpus, determining the target search keywords that match the corpus to be searched in the second search keyword set; searching in the search expression library for a target search expression that matches the combination of the target search keywords, wherein the target search keyword combination is generated by combining the target search keywords; if a matching target search expression exists, then the corpus to be searched is determined to be the matching corpus.

[0272] This disclosure also provides a computer-readable storage medium for storing program code for executing the matching corpus search method of the foregoing embodiments, namely: aggregating the search keywords in at least one search expression in the search expression library to obtain a first search keyword set; deduplicating the search keywords in the first search keyword set to obtain a deduplicated second search keyword set; determining the target search keywords that match the search corpus in the second search keyword set for the search corpus to be searched in the streaming corpus; searching for a target search expression that matches the combination of target search keywords in the search expression library, wherein the target search keyword combination is generated by combining the target search keywords; and determining the search corpus to be searched as the matching corpus if a matching target search expression exists.

[0273] This disclosure also provides a computer program product comprising a computer program. A processor of a computer device reads and executes the computer program, causing the computer device to perform the above-described matching corpus search method.

[0274] Furthermore, the terms “comprising” and “including”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0275] It should be understood that in this disclosure, "at least one item" means one or more, and "more than one" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0276] It should be understood that in the description of the embodiments disclosed herein, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0277] In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0278] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0279] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0280] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0281] It should also be understood that the various implementation methods provided in this disclosure can be combined arbitrarily to achieve different technical effects.

[0282] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0283] The above is a detailed description of the embodiments of this disclosure. However, this disclosure is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this disclosure. All such equivalent modifications or substitutions are included within the scope defined by the claims of this disclosure.

Claims

1. A method for searching matching corpora, characterized in that, The method for searching a streaming corpus for matching data that conforms to any search expression in a library of search expressions, wherein the search expression is generated by concatenating search keywords using search operators, includes: The search keywords in at least one search expression in the search expression library are aggregated to obtain a first set of search keywords; The search keywords in the first set of search keywords are deduplicated to obtain a second set of search keywords after deduplication. For the corpus to be searched in the streaming corpus, determine the target search keywords that match the corpus to be searched in the second set of search keywords; In the search expression library, a target search expression matching the target search keyword combination is found, wherein the target search keyword combination is generated by combining the target search keywords; If a matching target search expression exists, then the corpus to be searched is determined to be the matching corpus.

2. The matching corpus search method according to claim 1, characterized in that, The step of searching for a target search expression that matches the combination of target search keywords in the search expression library includes: The target search keywords are combined in full to obtain the target search keyword combination; In the search expression library, find the target search expression that matches the combination of the target search keywords.

3. The matching corpus search method according to claim 2, characterized in that, The step of searching for a target search expression that matches the combination of target search keywords in the search expression library includes: Retrieve each search expression from the search expression library; Each search expression is compared sequentially with the target search keyword combination; Based on the comparison results, the search expression that matches the target search keyword combination is determined as the target search expression.

4. The matching corpus search method according to claim 2, characterized in that, The process of combining the target search keywords to obtain a target search keyword combination includes: The target search keywords are combined in full to obtain the first search keyword combination; The empty set of search keyword combinations in the first search keyword combination is deleted to obtain the target search keyword combination.

5. The matching corpus search method according to any one of claims 1 to 4, characterized in that, The step of determining the target search keyword that matches the search corpus in the second search keyword set includes: Retrieve each of the first search keywords from the second set of search keywords; The search corpus is sequentially matched with each first search keyword, and the matched first search keyword is determined as the target search keyword.

6. The matching corpus search method according to any one of claims 1 to 5, characterized in that, After determining that the corpus to be searched is the matching corpus, the method further includes: Obtain the type information of the target search expression; Based on the type information, the corresponding loading processing rules are determined, and the matching corpus is loaded using the loading processing rules to generate corresponding prompt information.

7. The matching corpus search method according to claim 6, characterized in that, The step of obtaining the type information of the target search expression includes: Obtain the vector identifier associated with the target search expression; The type information to which the target search expression belongs is determined based on the vector identifier.

8. The matching corpus search method according to claim 6 or 7, characterized in that, The type information includes at least simple type information, unordered type information, and ordered type information. The step of determining the corresponding loading processing rule based on the type information and loading the matching corpus according to the loading processing rule to generate corresponding prompt information includes: If the type information is simple type information, then the corresponding simple loading processing rule is determined according to the simple type information, and the matching corpus is loaded and processed according to the simple loading processing rule to generate the corresponding first prompt information; If the type information is unordered type information, then the corresponding unordered loading processing rule is determined according to the unordered type information, and the matching corpus is loaded and processed according to the unordered loading processing rule to generate the corresponding second prompt information; If the type information is ordered type information, then the corresponding ordered loading processing rule is determined according to the ordered type information, and the matching corpus is loaded and processed according to the ordered loading processing rule to generate the corresponding third prompt information; Wherein, the search keyword of the search expression corresponding to the simple type information is one, and the trigger threshold is one; the search keyword of the search expression corresponding to the unordered type information is more than one, the trigger threshold is more than one, and the configuration parameters that occur sequentially are closed state parameters; the search keyword of the search expression corresponding to the ordered type information is more than one, and the configuration parameters that occur sequentially are open state parameters.

9. The matching corpus search method according to claim 8, characterized in that, The process of loading and processing the matching corpus according to the simple loading rules to generate corresponding first prompt information includes: The first target search expression is obtained through the simple loading processing rule, and the first target search expression is a target search expression whose type information is simple type information. The matching corpus is loaded and processed according to the first target search expression to generate the corresponding first prompt information.

10. The matching corpus search method according to claim 8, characterized in that, The step of loading the matching corpus according to the unordered loading processing rule to generate corresponding second prompt information includes: The second target search expression, the sliding time window to which the second target search expression belongs, and the corresponding historical trigger count are obtained through the unordered loading processing rules. The type information of the second target search expression is the target search expression with unordered type information. Increment the historical trigger count by one to obtain the updated historical trigger count; The corresponding trigger detection time point is determined based on the length of the sliding time window. At the trigger detection time point, if the number of historical triggers meets the trigger threshold, the matching corpus is loaded according to the trigger detection time point and the second target search expression to generate the corresponding second prompt information.

11. The matching corpus search method according to claim 10, characterized in that, Determining the corresponding trigger detection time point based on the length of the sliding time window includes: If the length of the sliding time window is less than or equal to the preset time, then the end time of the sliding time window is determined as the corresponding trigger detection time point; If the length of the sliding time window is greater than the preset time, the corresponding trigger detection time point is determined according to the preset time.

12. The matching corpus search method according to claim 8, characterized in that, The step of loading the matching corpus according to the ordered loading processing rule to generate corresponding third prompt information includes: The third target search expression and the preset queue are obtained through the ordered loading processing rule. The third target search expression is a target search expression with ordered type information. The preset queue is used to store the search expressions corresponding to the ordered type information. Obtain the hit time of the third target search expression; If the preset queue is empty, or if the time interval between the hit time and the enqueue time of the last search expression in the preset queue is greater than a preset time, then the third target search expression is added to the preset queue, and the matching corpus is loaded and processed according to the third target search expression to generate the corresponding third prompt information.

13. The matching corpus search method according to claim 12, characterized in that, Adding the third target search expression to the preset queue includes: Add the third target search expression to the preset queue and start the timer; The start time of the timer is the enqueue time of the third target search expression, and the end time of the timer is determined based on the enqueue time and the preset time.

14. A matching corpus search device, characterized in that, The apparatus is used to search a streaming corpus for matching data that conforms to any search expression in a library of search expressions, wherein the search expression is generated by concatenating search keywords using search operators. The apparatus includes: The aggregation unit is used to aggregate the search keywords in at least one search expression in the search expression library to obtain a first set of search keywords; The deduplication unit is used to deduplicat the search keywords in the first search keyword set to obtain a deduplicated second search keyword set. The first determining unit is used to determine the target search keywords that match the search corpus in the second set of search keywords for the search corpus in the streaming corpus; The search unit is used to search for a target search expression that matches the target search keyword combination in the search expression library, wherein the target search keyword combination is generated by combining the target search keywords; The second determining unit is used to determine the corpus to be searched as the matching corpus if a matching target search expression exists.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the matching corpus search method according to any one of claims 1 to 13.

16. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the matching corpus search method according to any one of claims 1 to 13.

17. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the matching corpus search method according to any one of claims 1 to 13.

Images