Method, apparatus, electronic device, and computer program product for pattern matching

Abstract

Embodiments of this disclosure relate to methods, apparatus, electronic devices, and computer program products for pattern matching. The method includes obtaining a target string to be matched against a set of patterns, the set of patterns being divided into a first pattern subset and a second pattern subset, wherein the length of each pattern string in the second pattern subset is less than a predetermined length threshold. The method includes matching the target string using a first pattern matching algorithm based on the first pattern subset to determine a first matching result. The method also includes matching the target string using a second pattern matching algorithm based on the second pattern subset to determine a second matching result. Furthermore, the method includes generating a matching result for the target string based on the first and second matching results. Thus, by dividing the pattern set and matching them separately, the impact of short pattern strings on the overall matching efficiency is reduced, thereby improving the overall performance of multi-pattern matching.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more particularly to methods, apparatus, electronic devices, and computer program products for pattern matching. Background Technology

[0002] Pattern matching refers to searching for a specific pattern string in a given text, determining whether the target pattern appears in the text, and locating its position. Multi-pattern matching is a technique that simultaneously searches for multiple pattern strings in a text; its core is to process the matching of multiple patterns in parallel within the text. Unlike single-pattern matching, multi-pattern matching not only needs to determine whether multiple pattern strings appear in the text, but also needs to determine the matching position of each pattern string.

[0003] Multi-pattern matching technology efficiently identifies and finds matching patterns by scanning a large number of string rules in a single operation. This technology has wide applications in various fields. For example, in network security, particularly in firewalls, intrusion detection and prevention systems, and deep packet inspection, it can effectively identify malicious attacks and abnormal behaviors. Furthermore, in big data processing and database retrieval scenarios, multi-pattern matching can also improve the efficiency of data querying and analysis. The efficiency and wide applicability of multi-pattern matching make this technology of significant value in modern information processing and security protection. Summary of the Invention

[0004] Embodiments of this disclosure provide a method, apparatus, electronic device, and computer program product for pattern matching.

[0005] According to a first aspect of this disclosure, a reasoning method for pattern matching is provided. The method includes obtaining a target string to be matched against a set of patterns, wherein the set of patterns is divided into a first pattern subset and a second pattern subset, wherein the length of each pattern string in the second pattern subset is less than a predetermined length threshold. The method includes matching the target string using a first pattern matching algorithm based on the first pattern subset to determine a first matching result. The method includes matching the target string using a second pattern matching algorithm based on the second pattern subset to determine a second matching result. Furthermore, the method includes generating a matching result for the target string based on the first and second matching results. Thus, by dividing the pattern set and matching them separately, the impact of short pattern strings on matching efficiency is reduced. While maintaining the main functionality of the first pattern matching algorithm, the short pattern matching process is optimized, and the overall performance of multi-pattern matching is improved.

[0006] In some embodiments of this disclosure, a second pattern matching algorithm is used to match a target string and determine a second matching result. This includes: generating multiple input vectors based on the target string; generating multiple output vectors based on the multiple input vectors and a mask vector associated with a second pattern subset; and determining the second matching result based on the multiple output vectors, wherein the second matching result indicates the corresponding pattern string in the second pattern subset that matches each position of the target string. Thus, by generating input vectors and combining them with mask vectors to generate output vectors, the process of determining the matching result can be simplified, thereby efficiently matching short pattern strings and improving matching speed.

[0007] In some embodiments of this disclosure, the method further includes: assigning a corresponding identifier to each pattern string in the second pattern subset, wherein the corresponding identifier of each pattern string corresponds to a specific bit of a byte; generating a first mask vector by performing a bitwise OR operation on the identifiers of pattern strings with the same high-order bits in the second pattern subset; and generating a second mask vector by performing a bitwise OR operation on the identifiers of pattern strings with the same low-order bits in the second pattern subset. Thus, by assigning identifiers and generating mask vectors, matching calculations can be simplified while optimizing the processing performance of short pattern strings.

[0008] In some embodiments of this disclosure, generating multiple input vectors includes: generating a first input vector by performing a shift operation on the target string, wherein the first input vector is related to the high-order part of each character in the target string; and generating a second input vector by performing a masking operation on the target string, wherein the second input vector is related to the low-order part of each character in the target string. In this way, by generating high-order and low-order input vectors through shifting and masking operations respectively, feature information of the target string can be extracted, providing accurate and simplified input for the subsequent matching process and improving overall matching efficiency.

[0009] In some embodiments of this disclosure, generating multiple output vectors includes: generating a first output vector by using a first input vector as the control vector in a shuffling operation and based on a first mask vector; and generating a second output vector by using a second input vector as the control vector in a shuffling operation and based on a second mask vector. Thus, by combining the input vector and the mask vector and generating the output vector using a shuffling operation, the matching position in the target string can be quickly located, reducing computational complexity and improving matching efficiency.

[0010] In some embodiments of this disclosure, determining the second matching result includes: determining the second matching result by performing a bitwise AND operation based on the first output vector and the second output vector. In this way, performing a bitwise AND operation can quickly and accurately determine the matching result in the target string, simplifying the calculation process and improving matching efficiency.

[0011] In some embodiments of this disclosure, the first pattern matching algorithm includes a matching phase and a verification phase, and determining the first matching result includes: determining multiple candidate matching results based on a first pattern subset through the matching phase of the first pattern matching algorithm; and determining the first matching result based on the first pattern subset and the multiple candidate matching results through the verification phase of the first pattern matching algorithm. In this way, by quickly filtering candidate matching results through the matching phase and verifying their accuracy through the verification phase, unnecessary computational overhead can be effectively reduced, matching efficiency improved, and the accuracy of the matching results ensured.

[0012] In some embodiments of this disclosure, generating a matching result for a target string includes: merging a first matching result and a second matching result to generate a matching result, wherein the matching result indicates the pattern string in the pattern set that matches the target string and the corresponding matching position. Thus, by merging the first and second matching results, the matching information in the target string can be fully covered, ensuring the integrity of the matching result.

[0013] In some embodiments of this disclosure, the target string is network traffic data to be detected, and the pattern set is a set of intrusion feature patterns. Abnormal behavior is identified in the intrusion detection system by matching the pattern set against the target string. Thus, by applying a multi-pattern matching algorithm to the intrusion detection system, the performance of the intrusion detection system can be improved.

[0014] According to a second aspect of this disclosure, an apparatus for pattern matching is provided. The apparatus includes a target data acquisition module configured to acquire a target string to be matched against a pattern set, wherein the pattern set is divided into a first pattern subset and a second pattern subset, wherein the length of each pattern string in the second pattern subset is less than a predetermined length threshold. The apparatus includes a first matching determination module configured to match the target string based on the first pattern subset using a first pattern matching algorithm to determine a first matching result. The apparatus includes a second matching determination module configured to match the target string based on the second pattern subset using a second pattern matching algorithm to determine a second matching result. Furthermore, the apparatus includes a matching result determination module configured to generate a matching result for the target string based on the first and second matching results.

[0015] In a third aspect of this disclosure, an electronic device is provided. The electronic device includes at least one processor and a memory. The memory is coupled to the at least one processor and has instructions stored thereon. When executed by the at least one processor, the instructions cause the electronic device to perform the method according to a first aspect of this disclosure.

[0016] In a fourth aspect of this disclosure, a computer-readable storage medium is provided on which a computer program is stored. The computer program is executed by a processor to implement the method described according to a first aspect of this disclosure.

[0017] In a fifth aspect of this disclosure, a computer program product is provided, comprising computer-executable instructions. When executed by a processor, the instructions implement some or all of the steps of the method described according to a first aspect of this disclosure.

[0018] It is understood that the apparatus of the second aspect, the electronic device of the third aspect, the computer storage medium of the fourth aspect, or the computer program product of the fifth aspect provided above are all used to perform the method provided in the first aspect. Therefore, the explanations or descriptions regarding the first aspect also apply to the second, third, fourth, and fifth aspects. Furthermore, the beneficial effects achievable by the second, third, fourth, and fifth aspects can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0019] The summary section is intended to present the chosen concepts in a simplified form, which will be further described in the detailed description below. The summary section is not intended to identify key or principal features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. Attached Figure Description

[0020] The above and other features, advantages and aspects of the embodiments of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and the following detailed description.

[0021] In the accompanying drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0022] Figure 1 A schematic diagram of an example environment in which the apparatus and / or methods according to embodiments of the present disclosure may be implemented is shown;

[0023] Figure 2 An exemplary flowchart of a pattern matching method according to an embodiment of the present disclosure is shown;

[0024] Figure 3 An exemplary schematic diagram illustrates the process of implementing a multi-pattern matching algorithm using a hybrid model according to an embodiment of the present disclosure;

[0025] Figure 4 A schematic diagram illustrating the process of preprocessing short rules according to an embodiment of the present disclosure is shown;

[0026] Figure 5 A schematic diagram of the mixing and washing operation process according to an embodiment of the present disclosure is shown;

[0027] Figure 6AA schematic diagram of a bypass matching process according to an embodiment of the present disclosure is shown;

[0028] Figure 6B A schematic diagram of an example vector in bypass matching according to an embodiment of the present disclosure is shown;

[0029] Figure 7 A schematic diagram of a pattern matching apparatus according to an embodiment of the present disclosure is shown;

[0030] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0031] In all the accompanying figures, the same or similar reference numerals denote the same or similar elements. Detailed Implementation

[0032] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0033] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0034] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. As used herein, the statement of “connecting” or “coupling” two or more parts together shall mean that these parts are directly joined together or joined through at least one intermediate component.

[0035] To clarify the relevant technologies, pattern matching and multi-pattern matching are explained below. Pattern matching refers to searching for the existence of one or more given pattern strings in a target string, and determining the matching positions of these pattern strings in the target string. The target string is the input data to be processed, usually a continuous sequence of characters or a data stream; the pattern string is a predefined sequence of characters to be searched in the target string, usually with a fixed length and content. Multi-pattern matching is an extension of pattern matching, referring to searching for the matching positions of multiple pattern strings in a target string simultaneously. Each pattern string can be independent and may have a different length. The goal of multi-pattern matching is to locate the positions in the target string that match any one or more pattern strings, while ensuring the accuracy and completeness of the matching.

[0036] As mentioned earlier, multi-pattern matching plays an increasingly important role in various fields such as network security and big data processing. In related technologies, multi-pattern matching algorithms based on bit manipulation and verification mechanisms are commonly used. First, bit manipulation matching methods are performed to find input strings that may match certain pattern strings. Then, these candidate strings are verified to confirm exact matches. For example, such algorithms typically perform optimized sequence matching methods (e.g., shift-or algorithms) at the front end to find all occurrences of the pattern string in the input byte stream. However, since false matches can still occur at the sequence matching stage, it is necessary to perform exact verification at the back end to check whether candidate matches are exact matches, such as by performing hash calculations or exact string comparisons.

[0037] However, a significant performance degradation can be observed in certain scenarios. Analysis reveals a major factor contributing to this performance decline: the presence of short patterns (also known as short rules) in the pattern set. Short rules are pattern strings that are relatively short, typically consisting of only a few characters, sometimes even just one byte. When short rules are processed alongside regular rules, their high matching rate frequently disrupts the fast instruction pipeline of the multi-pattern matching algorithm's front end, triggering the relatively slow back end's precise verification. Both the front end's sequence matching operations and the back end's precise verification are redundant for short rules.

[0038] To address this, the present invention proposes a multi-pattern matching hybrid model in its embodiments. While retaining the advantages of the aforementioned multi-pattern matching algorithm, it optimizes and modifies the performance bottleneck caused by short rules. Short rules are separated from the original rule set, and a pattern matching algorithm specifically designed for short rules is used to process them, thereby eliminating redundant operations and ensuring the efficiency of instruction pipeline.

[0039] Therefore, the multi-pattern matching hybrid model according to the embodiments of this disclosure effectively reduces the performance bottleneck caused by short rules by separating short rules from regular rules and using independently optimized processing paths, thus improving the overall efficiency of multi-pattern matching. This is particularly evident in pattern sets where short rules constitute a large proportion, where it excels in reducing redundant operations and improving instruction pipeline efficiency. Observations from actual business scenarios show that separating short rules of only 1 byte in length can significantly improve the performance of the front-end algorithm and substantially optimize the overall system performance. Furthermore, the matching algorithm designed for short rules can quickly locate matching positions with low instruction cost, fully utilizing the parallel processing capabilities of vectorized instructions, and determining all matching positions of the input string with only a small number of instructions.

[0040] Figure 1 A schematic diagram of an example environment in which the apparatus and / or methods according to embodiments of the present disclosure may be implemented is shown. Figure 1 As shown, the example environment 100 may include a computing device 110, which may be a user terminal, mobile device, computer, etc., or it may be a computing system, a single server, a distributed server, or a cloud-based server. The computing device 110 can obtain a target string 112 to be matched against a pattern set 114, which is divided into a regular pattern set 116 and a short pattern set 118, with each pattern string in the short pattern set 118 having a length less than a predetermined length threshold. For example, the target string 112 (i.e., the input data to be matched) may be a data packet in network traffic, a log record stored in a file, or a string entered by the user, while the pattern set 114 may include sensitive words to be detected, virus signatures, or certain predefined keyword sets. The pattern strings in the regular pattern set 116 may have long character sequences, such as strings with a length of 10 bytes or longer. The pattern strings in the short pattern set 118 may contain only a few characters. In some embodiments, the predetermined length threshold can be 2, meaning that the length of each pattern string in the short pattern set 118 is 1 byte. In some embodiments, the target string 112 may be a network data packet containing several kilobytes, while the pattern set 114 may contain a large number of sensitive information detection rules. In this case, by separating the short pattern from the regular pattern and designing a separate processing path for the short pattern, the speed of data packet processing can be improved, resource consumption can be reduced, and the accuracy of the matching results can be guaranteed.

[0041] The computing device 110 can match the target string 112 against the regular pattern set 116 using the main matching algorithm 120 to determine the main matching result 122. For example, the FDR (Franklin Delano Roosevelt) algorithm can be used as the main matching algorithm 120. The front end of the FDR algorithm can perform multi-pattern matching on the regular pattern set using a sequence matching algorithm, generating multiple candidate matches. Then, precise verification needs to be performed at the back end to determine the main matching result. The main matching result 122 can include the pattern string in the target string 112 that matches the regular pattern set 116 and the corresponding matching position. For example, when the target string 112 contains a pattern string (e.g., "SensitiveKeyword") from the regular pattern set 116, the main matching result 122 generated by the main matching algorithm 120 can include the matched pattern string "SensitiveKeyword" and its corresponding starting position. Furthermore, if the target string 112 does not contain any pattern string from the regular pattern set 116, the main matching result 122 may be empty.

[0042] The computing device 110 can match the target string 112 using a bypass matching algorithm 124 based on the short pattern set 118 to determine the bypass matching result 126. The pattern strings in the short pattern set 118 are typically short, making it more likely that short patterns will appear in the target string 112. To avoid interference from the high matching frequency of short patterns on the regular pattern matching path, the bypass matching algorithm 124 separates the processing of short patterns from the processing of regular patterns. In some embodiments, the bypass matching algorithm can be implemented based on a shuffling operation. The bypass matching result 126 can include the pattern strings in the target string 112 that match the short pattern set 118 and their corresponding matching positions. For example, suppose the target string 112 is "AgggDd3366666666", and the short pattern set 118 contains pattern strings 'A', 'B', 'C', 'D', 'c', 'd', 'e', ​​and 'f'. The bypass matching result 126 can include the following information: the matching pattern string 'A' at offset 0; the matching pattern string 'D' at offset 4; and the matching pattern string 'd' at offset 5.

[0043] The computing device 110 can generate a matching result 128 for the target string 112 based on the main matching result 122 and the bypass matching result 126. For example, the matching result 128 can be obtained by summarizing the main matching result 122 and the bypass matching result 126, where the main matching result 122 indicates the pattern strings in the target string 112 that match the regular pattern set 116 and their matching positions, and the bypass matching result 126 indicates the pattern strings in the target string 112 that match the short pattern set 118 and their matching positions. In some embodiments, the computing device 110 can merge the main matching result 122 and the bypass matching result 126 to generate a unified matching result 128, which may include all pattern strings in the target string 112 that match the pattern set 114 and their corresponding matching positions. For example, if the main matching result 122 indicates that the target string 112 contains a match for the pattern string "SensitiveKeyword", and the side matching result 126 indicates that the target string 112 contains matches for the patterns 'A' and 'D', then the matching result 128 may include the pattern string "SensitiveKeyword" and its matching position, the pattern string 'A' and its matching position, and the pattern string 'D' and its matching position.

[0044] It should be understood that the architecture and functionality in example environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure. Embodiments of this disclosure can also be applied to other environments with different structures and / or functionalities.

[0045] The following will combine Figures 2 to 8 The process according to embodiments of this disclosure is described in detail. For ease of understanding, the specific data mentioned in the following description are exemplary and not intended to limit the scope of this disclosure. It is understood that the embodiments described below may also include additional actions not shown and / or actions shown may be omitted, and the scope of this disclosure is not limited in this respect.

[0046] Figure 2 An exemplary flowchart of a pattern matching method 200 according to an embodiment of the present disclosure is shown. Example method 200 may be derived, for example, from... Figure 1 The computing device 110 shown performs the operation. It should be understood that method 200 may also include additional actions not shown, and the scope of this application is not limited in this respect. The following is in conjunction with... Figure 1 The example environment 100 is used to describe method 200 in detail. At box 202, the target string to be matched against the pattern set can be obtained, where the pattern set is divided into a first pattern subset and a second pattern subset, wherein the length of each pattern string in the second pattern subset is less than a predetermined length threshold. For example, combined with... Figure 1As described, computing device 110 can obtain target string 112 to be matched with pattern set 114, wherein pattern set 114 is divided into regular pattern set 116 and short pattern set 118, and the length of each pattern string in short pattern set 118 is less than a predetermined length threshold.

[0047] At box 204, the target string can be matched using the first pattern matching algorithm based on the first pattern subset to determine the first matching result. For example, combining... Figure 1 To describe, computing device 110 can match the target string 112 based on the regular pattern set 116 using the main matching algorithm 120 to determine the main matching result 122. At box 206, the target string can be matched based on a second pattern subset using a second pattern matching algorithm to determine the second matching result. For example, combined with... Figure 1 As described, computing device 110 can match target string 112 based on short pattern set 118 using bypass matching algorithm 124 to determine bypass matching result 126. At box 208, a matching result for the target string can be generated based on the first and second matching results. For example, combining... Figure 1 As described, computing device 110 can generate a matching result 128 for target string 112 based on main matching result 122 and bypass matching result 126.

[0048] Therefore, the method 200 according to the embodiments of this disclosure effectively reduces the performance bottleneck caused by short rules by separating short rules from regular rules and using independently optimized processing paths, thus improving the overall efficiency of multi-pattern matching. This is particularly evident in pattern sets where short rules account for a high proportion, where it excels in reducing redundant operations and improving instruction pipeline efficiency. Observations from actual business scenarios show that separating short rules of only one or more lengths (e.g., 1 byte) can significantly improve the performance of the front-end algorithm and substantially optimize the overall system performance. Furthermore, the matching algorithm designed for short rules can quickly locate matching positions with low instruction cost, fully utilizing the parallel processing capabilities of vectorized instructions, and determining all matching positions of the input string with only a small number of instructions.

[0049] Figure 3 An exemplary schematic diagram of a process 300 for a multi-pattern matching algorithm implemented according to an embodiment of the present disclosure is shown. Figure 3As shown, the string rule set can be divided into regular rules 302 (also known as the first pattern subset) and short rules 304 (also known as the second pattern subset). As mentioned earlier, string rules are also called rule strings or pattern strings. In multi-pattern matching, it is necessary to simultaneously search for matching positions of multiple string rules from the input string (also known as the target string). For example, the rule set can contain 10,000 rule strings, from which 8 short rules {'A','B','C','D','c','d','e','f'} can be separated. Therefore, regular rules 302 contain 9,992 rules, and short rules 304 contain 8 rules, and these 8 rules are all 1-byte rules. It should be understood that the rule set given herein is only an example and does not limit the content of this disclosure. In other embodiments of this disclosure, regular rules and short rules may contain fewer or more rules.

[0050] Overall, Figure 3 The hybrid model shown has two processing pathways. When input data 312 arrives, the front-end can use sequence matching algorithm 306 to match regular rule 302. This pathway generates multiple candidate matches, which are then verified in the back-end using precise validation 308 to determine the final accurate matching result. This processing pathway can be called the main algorithm. Furthermore, for short rule 304, a shuffling matching algorithm 310 can generate corresponding matching results; this processing pathway can be called the bypass algorithm. Finally, by summarizing the matching results from the main algorithm and the bypass algorithm, the final matching result 314 is determined.

[0051] In some embodiments, the FDR algorithm can be used as the main algorithm. For example, the sequence matching algorithm 306 in the front-end can employ an instruction-optimized shift-or algorithm to generate multiple candidate matching positions. Subsequently, in the back-end precise verification 308, these candidate matching results can be verified by hash calculation. However, as mentioned earlier, the high matching rate of short rules frequently interrupts the fast instruction pipeline of the front-end, thereby triggering the relatively slow back-end precise verification and causing performance degradation. Therefore, it is necessary to specifically handle the matching task of short rules in the bypass matching to avoid such bottlenecks.

[0052] The shuffling matching algorithm for short rules can include two stages: first, the short rules need to be preprocessed to generate preprocessed results; then, the input data is matched based on the preprocessed results. Figure 4 The preprocessing process for short rules will be described in detail. Figure 5 This section will introduce the shuffling operation process in the shuffling matching algorithm, and Figure 6A and Figure 6B This section describes how to combine preprocessing results and shuffling operations to perform a bypass matching process for short rules.

[0053] pass Figure 3 The hybrid model implemented in this paper implements a multi-pattern matching algorithm that, while maintaining the main algorithm's efficient processing of regular rules, utilizes a bypass algorithm to specifically handle short rules, eliminating performance bottlenecks caused by short rules. Specifically, this hybrid model effectively separates and optimizes the matching path for short rules, avoiding interference from the high matching rate of short rules on the main algorithm, thereby improving overall system performance. Real-world business scenarios demonstrate that using the hybrid model improves matching performance by 50% with only a small increase in front-end overhead, performing particularly well in scenarios with a high proportion of short rules. Furthermore, by employing an algorithm based on shuffling instructions to process short rules, matching time is further shortened, and computational resource consumption is reduced, thus providing a reliable solution for large-scale multi-pattern matching tasks.

[0054] In some embodiments, the schemes according to the present disclosure can be applied to intrusion detection scenarios to identify potential abnormal behavior or attack patterns. For example, in network traffic monitoring, the target string can be real-time captured data packets or data streams, while the pattern set can include known intrusion characteristic patterns, such as virus signatures, abnormal network request sequences, or other malicious behavior characteristic patterns. In this case, by dividing the pattern set into regular patterns and short patterns, and processing them respectively using the main matching algorithm and the bypass matching algorithm, abnormal patterns in the data stream can be quickly identified, improving the speed and accuracy of intrusion detection.

[0055] In some embodiments, the solutions according to the present disclosure can be applied to database management scenarios to perform operations such as complex queries, data filtering, or data integrity verification. For example, in a database query, the target string can be a record or field value in the database, while the pattern set can include predefined query conditions. In this case, by dividing the pattern set into regular patterns and short patterns, and processing them respectively using the main matching algorithm and the side-channel matching algorithm, records that meet the conditions can be quickly located, improving the efficiency of database queries.

[0056] Figure 4 A schematic diagram of a process 400 for preprocessing short rules according to an embodiment of the present disclosure is shown. For example, the short rule can be {'A', 'B', 'C', 'D', 'c', 'd', 'e', ​​'f'}, which will be discussed below in conjunction with... Figure 4The preprocessing process for this short rule is described. It should be understood that the short rule shown herein is merely an example, and the solutions of this disclosure can handle any other short rule. In the preprocessing stage, each short rule is first assigned a unique group ID, with each group ID represented by different bits, allowing for rule processing through bitwise operations. Specifically, these group IDs are {0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80}, corresponding one-to-one with the short rule. For example, the group ID for "A" is 0x01, the group ID for "B" is 0x02, and so on.

[0057] Then, the entire ASCII table can be constructed into a 16×16 table format, where characters with the same high 4-bit value are in the same row, and characters with the same low 4-bit value are in the same column, such as... Figure 4 The table 402 is shown below. For example, for rule 'A', its ASCII code value is 65, and its corresponding binary representation is 01000001. Its high 4 bits are 0100 (corresponding to row 4) and its low 4 bits are 0001 (corresponding to column 1), so 'A' is filled in row 4, column 1 of table 402. Similarly, for rule 'f', its ASCII code value is 102, and its corresponding binary representation is 01100110. Its high 4 bits are 0110 (corresponding to row 6) and its low 4 bits are 0110 (corresponding to column 6), so 'f' is filled in row 6, column 6 of table 402.

[0058] Then, a bitwise OR operation can be performed on the values ​​in each row of Table 402 to obtain the mask vector (also called the first mask vector) shown in the second column of Table 402, denoted as maskHigh. Furthermore, a bitwise OR operation can be performed on the values ​​in each column of Table 402 to obtain the mask vector (also called the second mask vector) shown in the second row of Table 402, denoted as maskLow. The generated maskHigh and maskLow are as follows: Figure 4 Table 404 is shown in the table. Specifically, maskHigh is a 128-bit vector of 16 bytes, where each byte corresponds to a row in table 402. For example, maskHigh[4] can be calculated by bitwise ORing the group IDs of rules 'A', 'B', 'C' and 'D', as shown in formula (1):

[0059] maskHigh[4] = 00000001 | 00000010 | 00000100 | 00001000 = 00001111 = 0x0F (1)

[0060] Similarly, maskHigh[6] can be calculated by performing a bitwise OR operation on the group IDs of rules 'c', 'd', 'e' and 'f', as shown in formula (2):

[0061] maskHigh[6] = 00010000 | 00100000 | 01000000 | 10000000 = 11110000 = 0xF0 (2)

[0062] Since no rules were entered in the other rows of Table 402, all other positions in maskHigh are 0, thus obtaining... Figure 4 The maskHigh vector shown in Table 404.

[0063] Similarly, maskLow is a 128-bit vector of 16 bytes, where each byte corresponds to a column in table 402. For example, since the first column of table 402 contains only rule 'A', the value of maskLow[1] is the same as the group ID of rule 'A', i.e., maskLow[1] = 00000001 = 0x01. For the second column, which contains only rule 'B', maskLow[2] is the same as the group ID of rule 'B', i.e., maskLow[2] = 00000010 = 0x02. For the third column, which contains rules 'C' and 'c', the value of maskLow[3] can be obtained by performing a bitwise OR operation on the group IDs of rules 'C' and 'c', as shown in formula (3):

[0064] maskLow[3] = 00000100 | 00010000 = 00010100 = 0x14 (3)

[0065] maskLow[4] can be obtained by performing a bitwise OR operation on the group IDs of rules “D” and “d”, as shown in formula (4):

[0066] maskLow[4] = 00001000 | 00100000 = 00101000 = 0x28 (4)

[0067] Furthermore, since column 5 of table 402 contains only rule 'e', ​​maskLow[5] has the same group ID as rule 'e', ​​i.e., maskLow[5] = 01000000 = 0x40; since column 6 of table 402 contains only rule 'f', maskLow[6] has the same group ID as rule 'f', i.e., maskLow[6] = 10000000 = 0x80.

[0068] The preprocessing steps described above generate two vectors, maskHigh and maskLow, which will serve as source vectors for the shuffling operation in the subsequent matching stage. For example, maskHigh can represent the high 4 bits of the input data's matching relationship, and maskLow can represent the low 4 bits of the input data's matching relationship. The input data, acting as a control vector, works in conjunction with these two mask vectors through the shuffling operation to quickly determine the matching position of short rules.

[0069] Figure 5 A schematic diagram of a mixing and washing operation process 500 according to an embodiment of the present disclosure is shown. Figure 5 As shown, the shuffling operation has two inputs: a source vector 502 and a control vector 504, and one output: a target vector 506. Using the lower 4 bits of each byte in the control vector 504 as an index, the value at the index position in the source vector 502 is placed into the corresponding position in the target vector 506. Specifically, the source vector 502 consists of a set of bytes of data, for example... Figure 5 The source vector 502 contains characters 'A', 'B', 'C', 'D', 'E', 'F', 'G', etc. In a real-world scenario, the content of source vector 502 might be the preprocessing result of a certain rule or pattern, such as a mask vector associated with a short rule or a lookup value of other specific data. Control vector 504 controls the rules for the shuffling operation; the lower 4 bits of each byte serve as an index pointing to a specific position in source vector 502. Based on this index value, the character at the corresponding position in source vector 502 will be copied to the corresponding position in target vector 506.

[0070] For example, if the lower 4 bits of the first byte of control vector 504 are 0x1 (hexadecimal representation), then the character at index 1 in source vector 502 (i.e., 'B') will be copied to the first position of target vector 506. Similarly, if the lower 4 bits of the second byte of control vector 504 are 0x5, then the value at index 5 in source vector 502 (i.e., 'F') will be copied to the second position of target vector 506. As another example, if the lower 4 bits of the third byte of control vector 504 are 0xa (hexadecimal, value 10), pointing to the position at index 10 in source vector 502 (character 'K'), then 'K' will be filled into the third position of target vector 506. And so on, with each byte in control vector 504, the contents of source vector 502 are rearranged in order into target vector 506.

[0071] The shuffling operation is essentially a parallel table lookup operation, and its efficiency is reflected in the vectorized instructions supported by the hardware. For example, in the ARM architecture, the shuffling operation can be implemented using 128-bit shuffling instructions (such as the tbl instruction), which can simultaneously rearrange multiple bytes in the source vector. Figure 5In the process of shuffling, after the shuffling operation, the content of the target vector 506 forms a new sequence according to the instructions of the control vector 504. For example, the data in the target vector 506 is rearranged into 'B', 'F', 'K', 'D', 'A', 'C', etc. By combining the control vector 504 and the source vector 502, the shuffling operation can effectively and flexibly rearrange the input data to generate the target vector 506 by utilizing the parallel characteristics of hardware instructions. Thus, the shuffling operation can realize the rearrangement of large-scale data with extremely high efficiency, which is suitable for scenarios that require fast data processing. This operation method can improve the speed and efficiency of data processing and provides a foundation for multi-pattern matching in the embodiments of this disclosure.

[0072] Figure 6A A schematic diagram of a bypass matching process 600A according to an embodiment of the present disclosure is shown. Figure 6A As shown, elliptical boxes represent elements related to data, while rectangular boxes represent elements related to instruction operations. It can be clearly seen that this process only requires executing 5 instruction operations to quickly determine the matching results at all positions in the input data. The bypass matching algorithm based on shuffling operations combines... Figure 4 Preprocessing results and Figure 5 The shuffling operation shown rapidly calculates the matching position of short rules using a small number of instructions. The bypass matching process starts with input data 602, generates control vectors 606 and 610 through a series of operations, and combines them with source vectors 612 and 614 generated in the preprocessing stage (e.g., ...). Figure 4 The mask vectors maskLow and maskHigh in the data are as follows: Figure 5 The shuffling operation in the middle quickly determines the matching position of short rules. Figure 6B A schematic diagram illustrating example vector 600B in bypass matching is shown below. Figure 6B To describe Figure 6A The process of bypass matching.

[0073] First, we can obtain the input data 602. For example, the input data 602 could be... Figure 6B The input data is 602 "AgggDd3366666666", where each character corresponds to one byte of data. The first step of the bypass matching is to perform a shift operation 604 (e.g., a right shift operation) on the input data 602 to generate a control vector 606. Since this control vector 606 is generated from the input data 602 through a shift operation, it is also called the first input vector, denoted as inputHigh. Figure 6B To illustrate the specific operation, shift operation 604 shifts the high 4 bits of each byte in input data 602 to the low 4 bits. For example, Figure 6BThe character 'A' in input data 602 has a hexadecimal representation of 0x41. Shifting it right by 4 bits yields 0x4, which corresponds to... Figure 6B The value at index 0 in the control vector 606 is also shown. Similarly, the high 4 bits of each byte of other characters in the input data 652 can be shifted to the low 4 bits. For example, the hexadecimal representation of the character 'g' is 0x67, which becomes 0x6 after the shift operation. Since the shift operation 604 can process all bytes of the input data 602 in parallel, the complete control vector 606 can be generated in a single operation.

[0074] Next, another control vector 610 is generated by performing an AND operation 608 (i.e., bitwise AND operation) between the high-order mask and the input data 602. Since the control vector 610 is generated from the input data 602 via a bitwise AND operation, it is also called the second input vector, denoted as inputLow. Figure 6B To illustrate the specific operation, the AND operation 608 is used to erase the high 4 bits of each byte in the input data 602, retaining only the low 4 bits. For example, for Figure 6B The character 'A' in input data 602, whose hexadecimal representation is 0x41, can be bitwise ANDed with the high-order mask 0x0F to obtain 0x1, which corresponds to... Figure 6B The value at index 0 in the control vector 610 is used. Similarly, the lower 4 bits of other characters in the input data 602 can also be preserved through an AND operation. For example, the hexadecimal representation of the character 'g' is 0x67, which becomes 0x7 after an AND operation. Similar to the shift operation 604, the AND operation 608 can also process all bytes in the input data 602 in parallel, thus generating the complete control vector 610 in a single operation.

[0075] Next, by performing a shuffling operation 614 on the source vector 612 and the control vector 606, the target vector 616 (also known as the first output vector) can be obtained. The control vector 606 serves as the control input for the shuffling operation, while the source vector 612 corresponds to... Figure 4 The first mask vector, maskHigh, is generated during preprocessing. The shuffling operation 614 uses the lower 4 bits of each byte in control vector 606 as an index to extract the corresponding value from the source vector 612 and fill it into the target vector 616. Figure 6BTaking the example data in the example, the first byte of control vector 606 is 0x4, and its lower 4 bits are 4. Therefore, the value at index 4 in source vector 612 (i.e., 0x0F) is copied to the first position in target vector 616. Similarly, the second byte of control vector 606 is 0x6, and its lower 4 bits are 6. Therefore, the value at index 6 in source vector 612 (i.e., 0xF0) is copied to the second position in target vector 616. And so on, the shuffling operation 614 extracts the corresponding values ​​from source vector 612 in parallel according to the values ​​in control vector 606, ultimately generating target vector 616. For example, Figure 6B The target vector 616 is {0x0F,0xF0,0xF0,0xF0,0x0F,0xF0,0xF0,...,0}.

[0076] Furthermore, by performing another shuffling operation 620 on the source vector 618 and the control vector 610, another target vector 622 (also referred to as the first output vector) can be generated. The control vector 610 serves as the control input for the shuffling operation, while the source vector 618 corresponds to... Figure 4 The second mask vector, maskLow, is generated during preprocessing. The shuffling operation 620 extracts the corresponding values ​​from the source vector 618 based on the lower 4 bits of each byte in the control vector 610 and fills them into the target vector 622. Figure 6B Taking the example data in the example, the first byte of control vector 610 is 0x1, and its lower 4 bits are 1. Therefore, the value at index 1 in source vector 618 (i.e., 0x01) is copied to the first position in target vector 622. Similarly, the second byte of control vector 610 is 0x7, and its lower 4 bits are 7. Therefore, the value at index 7 in source vector 618 (i.e., 0) is copied to the second position in target vector 622. And so on, the shuffling operation 620 extracts the corresponding values ​​from source vector 618 in parallel according to the values ​​in control vector 610, ultimately generating target vector 622. For example, Figure 6B The target vector 622 is {0x01,0,0,0,0x28,0x28,0x14,...,0x80}.

[0077] Next, by performing an AND operation 624 on target vectors 616 and 622, the final matching result 626 can be obtained. Combined with... Figure 6BIn the example data, when both the values ​​in target vector 616 and target vector 622 are not 0, it indicates that there is a short rule match at that position. For example, at index 0, the value of target vector 616 is 0x0F, and the value of target vector 622 is 0x01. After performing a bitwise AND operation, we get 0x01, corresponding to the short rule 'A' with group ID 0x01; at index 4, the bitwise AND operation results in 0x08, corresponding to the short rule 'D' with group ID 0x08; at offset 5, the bitwise AND operation results in 0x20, corresponding to the short rule 'd' with group ID 0x20. Therefore, the final matching result directly indicates the position of the short rule match in the target string and the corresponding group ID, containing all the accurate matching information, eliminating the need for further verification or calculation.

[0078] In some embodiments, the multi-pattern matching algorithm implemented by the hybrid model can be implemented as a basic acceleration library utilizing CPU instruction sets and applied in various scenarios, such as firewalls, intrusion detection and prevention, deep packet inspection, big data processing, and database management. In firewall and intrusion detection and prevention scenarios, the hybrid model can quickly detect potential threats in network traffic. In deep packet inspection scenarios, the hybrid model can be used to parse packet content and identify sensitive information or specific data patterns. In big data processing and database management scenarios, the hybrid model can quickly locate records that meet certain conditions within big data, significantly improving the efficiency of data processing and analysis. In database management, the hybrid model can quickly filter records that meet query conditions while reducing the computational overhead of the database system. Furthermore, by implementing it as a basic acceleration library based on CPU instruction sets, it can fully utilize the vectorized instructions of the hardware (such as the tbl instruction in the ARM architecture) to achieve parallel data processing.

[0079] Figure 7 A schematic diagram of a pattern matching apparatus 700 according to an embodiment of the present disclosure is shown. Figure 7 As shown, the device 700 includes a target data acquisition module 702, configured to acquire a target string to be matched with a pattern set, wherein the pattern set is divided into a first pattern subset and a second pattern subset, wherein the length of each pattern string in the second pattern subset is less than a predetermined length threshold. The device 700 also includes a first matching determination module 704, configured to match the target string using a first pattern matching algorithm based on the first pattern subset to determine a first matching result. The device 700 further includes a second matching determination module 706, configured to match the target string using a second pattern matching algorithm based on the second pattern subset to determine a second matching result. Furthermore, the device 700 includes a matching result determination module 708, configured to generate a matching result for the target string based on the first matching result and the second matching result.

[0080] In some embodiments of this disclosure, the second matching determination module 706 includes: an input vector generation module configured to generate a plurality of input vectors based on the target string; an output vector generation module configured to generate a plurality of output vectors based on the plurality of input vectors and a mask vector associated with the second pattern subset; and a second matching result determination module configured to determine a second matching result based on the plurality of output vectors, wherein the second matching result indicates a corresponding pattern string in the second pattern subset that matches each position of the target string.

[0081] In some embodiments of this disclosure, the apparatus 700 further includes: a pattern identifier allocation module configured to allocate a corresponding identifier to each pattern string in the second pattern subset, wherein the corresponding identifier of each pattern string corresponds to a specific bit of a byte; a first mask generation module configured to generate a first mask vector by performing a bitwise OR operation on the identifiers of pattern strings with the same high-order bits in the second pattern subset; and a second mask generation module configured to generate a second mask vector by performing a bitwise OR operation on the identifiers of pattern strings with the same low-order bits in the second pattern subset.

[0082] In some embodiments of this disclosure, the input vector generation module includes: a first input vector generation module configured to generate a first input vector by performing a shift operation on the target string, wherein the first input vector is related to the high-order part of each character in the target string; and a second input vector generation module configured to generate a second input vector by performing a mask operation on the target string, wherein the second input vector is related to the low-order part of each character in the target string.

[0083] In some embodiments of this disclosure, the output vector generation module includes: a first output vector generation module configured to generate a first output vector by using the first input vector as a control vector in a shuffling operation and based on the first mask vector; and a second output vector generation module configured to generate a second output vector by using the second input vector as a control vector in a shuffling operation and based on the second mask vector.

[0084] In some embodiments of this disclosure, the second matching result determination module includes: a bitwise logic matching module configured to determine the second matching result by a bitwise AND operation based on the first output vector and the second output vector.

[0085] In some embodiments of this disclosure, the first matching determination module 704 includes: a candidate matching determination module, configured to determine multiple candidate matching results based on the first pattern subset and through the matching phase of the first pattern matching algorithm; and a first matching result determination module, configured to determine the first matching result based on the first pattern subset and the multiple candidate matching results and through the verification phase of the first pattern matching algorithm.

[0086] In some embodiments of this disclosure, the matching result determination module 708 includes a matching result merging module, configured to generate the matching result by merging the first matching result and the second matching result, wherein the matching result indicates the pattern string in the pattern set that matches the target string and the corresponding matching position.

[0087] In some embodiments of this disclosure, the target string is network traffic data to be detected, and the pattern set is a set of intrusion feature patterns. Abnormal behavior is identified in the intrusion detection system by matching the pattern set in the target string.

[0088] Figure 8 A block diagram of an electronic device 800 according to an embodiment of the present disclosure is shown. As shown, the electronic device 800 includes a processing unit 801, which can perform various appropriate actions and processes according to computer program instructions stored in random access memory (RAM) 803 and / or read-only memory (ROM) 802 or computer program instructions loaded from storage unit 808 into RAM 803 and / or ROM 802. Various programs and data required for the operation of the electronic device 800 may also be stored in RAM 803 and / or ROM 802. The processing unit 801 and RAM 803 and / or ROM 802 are interconnected via bus 804. An input / output (I / O) interface 805 is also connected to bus 804.

[0089] Multiple components in electronic device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of displays, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows electronic device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0090] Processing unit 801 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processing unit 801 include, but are not limited to, CPUs, GPUs, NPUs, various special-purpose AI computing chips, various processing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processing unit 801 performs the various methods and processes described above, such as method 200. For example, in some embodiments, method 200 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 800 via RAM and / or ROM and / or communication unit 809. When the computer program is loaded into RAM and / or ROM and executed by processing unit 801, one or more actions of the various methods and processes described above may be performed. Alternatively, in other embodiments, processing unit 801 may be configured to perform one or more actions of the methods and processes described above by any other suitable means (e.g., by means of firmware).

[0091] This disclosure can be a method, apparatus, system, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0092] A computer-readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium can be, for example—but not limited to—an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), and any suitable combination thereof. The computer-readable storage medium as used herein is not to be construed as a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0093] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0094] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0095] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0096] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0097] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0099] Unless otherwise expressly indicated by the context, the singular form of words used herein and in the appended claims includes the plural form, and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Where the term “example” is used herein, particularly when it follows a set of terms, the “example” is merely exemplary and illustrative and should not be considered exclusive or pervasive.

[0100] Further aspects and scope of adaptation become apparent from the description provided herein. It should be understood that various aspects of this application may be implemented individually or in combination with at least one other aspect. It should also be understood that the descriptions and specific embodiments herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0101] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A pattern matching method, comprising: Obtain the target string to be matched with the pattern set, wherein the pattern set is divided into a first pattern subset and a second pattern subset, and the length of each pattern string in the second pattern subset is less than a predetermined length threshold; Based on the first pattern subset, the target string is matched using the first pattern matching algorithm to determine the first matching result; Based on the second pattern subset, the target string is matched using the second pattern matching algorithm to determine the second matching result; as well as Based on the first matching result and the second matching result, a matching result for the target string is generated.

2. The method according to claim 1, wherein matching the target string using the second pattern matching algorithm to determine the second matching result includes: Based on the target string, generate multiple input vectors; Based on the multiple input vectors and the mask vector associated with the second mode subset, multiple output vectors are generated; as well as Based on the plurality of output vectors, a second matching result is determined, wherein the second matching result indicates the corresponding pattern string in the second pattern subset that matches each position of the target string.

3. The method according to claim 2, further comprising: Assign a corresponding identifier to each pattern string in the second pattern subset, wherein the corresponding identifier of each pattern string corresponds to a specific bit of a byte; A first mask vector is generated by performing a bitwise OR operation on the identifiers of pattern strings with the same high-order bits in the second pattern subset. as well as A second mask vector is generated by performing a bitwise OR operation on the identifiers of pattern strings with the same low-order portion in the second pattern subset.

4. The method of claim 3, wherein generating the plurality of input vectors comprises: A first input vector is generated by performing a shift operation on the target string, wherein the first input vector is related to the high-order part of each character in the target string; as well as A second input vector is generated by performing a masking operation on the target string, wherein the second input vector is related to the low-order part of each character in the target string.

5. The method of claim 4, wherein generating the plurality of output vectors comprises: The first output vector is generated by using the first input vector as the control vector in the shuffling operation and based on the first mask vector; as well as The second output vector is generated by using the second input vector as the control vector in the shuffling operation and based on the second mask vector.

6. The method of claim 5, wherein determining the second matching result comprises: The second matching result is determined by a bitwise AND operation based on the first output vector and the second output vector.

7. The method according to claim 1, wherein the first pattern matching algorithm includes a matching phase and a verification phase, and determining the first matching result includes: Based on the first pattern subset, multiple candidate matching results are determined through the matching stage of the first pattern matching algorithm; as well as Based on the first pattern subset and the multiple candidate matching results, the first matching result is determined through the verification phase of the first pattern matching algorithm.

8. The method of claim 1, wherein generating the matching result for the target string comprises: The matching result is generated by merging the first matching result and the second matching result. The matching result indicates the pattern string in the pattern set that matches the target string and the corresponding matching position.

9. The method according to claim 1, wherein the target string is network traffic data to be detected, the pattern set is an intrusion feature pattern set, and abnormal behavior is identified in the intrusion detection system by matching the pattern set in the target string.

10. A pattern matching apparatus, comprising: The target data acquisition module is configured to acquire target strings to be matched with a pattern set, wherein the pattern set is divided into a first pattern subset and a second pattern subset, and the length of each pattern string in the second pattern subset is less than a predetermined length threshold. The first matching determination module is configured to match the target string based on the first pattern subset using a first pattern matching algorithm to determine the first matching result; The second matching determination module is configured to match the target string based on the second pattern subset using a second pattern matching algorithm to determine the second matching result; as well as The matching result determination module is configured to generate a matching result for the target string based on the first matching result and the second matching result.

11. An electronic device, comprising: At least one processor; as well as A memory coupled to the at least one processor and having instructions stored thereon, which, when executed by the at least one processor, cause the electronic device to perform the method according to any one of claims 1-9.

12. A computer program product tangibly stored on a non-transient computer-readable medium and comprising machine-executable instructions for performing the method according to any one of claims 1-9.

Images