CN103414701B - A kind of rule matching method and device - Google Patents

Abstract

Embodiment of the invention discloses that a kind of rule matching method and device, it is related to electronic information field, it is possible to increase rule matching efficiency.The method includes：Extract the rule of message, extract the tagged word of message rule and generate the relam identifier of message rule；The hash function computing that the tagged word of message rule and relam identifier are carried out predetermined number generates the cryptographic Hash of predetermined number；Search the data of storage in the address of corresponding cryptographic Hash respectively in the corresponding Hash table of each hash function, if the data of storage is preset value in the address of each cryptographic Hash, the match is successful for message rule, and otherwise it fails to match for message rule.The present invention is used for the coupling of rule.

Description

A rule matching method and device

technical field

The invention relates to the field of electronic information, in particular to a rule matching method and equipment.

Background technique

The explosive development of IP (Internet Protocol, Internet Protocol) services and the rapid growth of broadband services have brought opportunities and challenges to operators. In terms of network and service security, the number of malicious signature rules in the protocol is large, and it continues to increase with the development of network services. Moreover, the location of malicious signature rules is not fixed, and the exact location cannot be predicted, which brings challenges to the identification of malicious data segments.

DPI (Deep Packet Inspection, deep packet inspection) technology, as an enhanced filter for network equipment, gradually integrates user management, security control, fine service control and other capabilities organically, and realizes dynamic perception and strategy of various services. Functions such as control, QOS (Quality of Service, quality of service) guarantee, and network and service security guarantee reduce the capital expenditure and operating expenditure of operators, and provide operators with a basic operation platform for telecom services.

The key to DPI technology is to efficiently identify various applications on the network. Recognition technology includes feature word recognition, application layer gateway recognition, and behavior pattern recognition. Feature word recognition technology has become one of the main methods of recognition technology, and "rule matching technology" is the key technology of feature word recognition. Therefore, the development of "rule matching technology" has become an important part of identifying malicious segments and maintaining network security.

However, in the existing technology, because only the feature words of the rules are extracted for hash function operation and then matched, the matching accuracy of the rules is insufficient and the efficiency is low, which affects the filtering of malicious segments in network information Effect.

Contents of the invention

Embodiments of the present invention provide a rule matching method and device, which can improve the accuracy and efficiency of rule matching.

In order to achieve the above object, embodiments of the present invention adopt the following technical solutions:

In the first aspect, a rule matching method includes:

The rule matching device extracts message rules from the message;

The rule matching device extracts feature words from the message rules, and generates domain identifiers of the message rules;

The rule matching device performs a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule to generate a preset number of hash values;

Respectively look up the data stored in the address of the corresponding hash value in the hash table corresponding to each of the hash functions;

If the data stored in the address of each hash value is a preset value, the message rule matching is successful; otherwise, the message rule matching fails.

In a first possible implementation manner, in combination with the first aspect, before the rule matching device extracts the message rule from the message, it further includes:

The rule matching device extracts the feature word of the rule to be matched from the rule to be matched, and generates a domain identifier of the rule to be matched;

performing the preset number of hash function operations on the feature word of the rule to be matched and the domain identifier of the rule to be matched to generate a preset number of standard hash values;

Respectively look up the address of the corresponding standard hash value in the hash table corresponding to each of the hash functions, and change the data stored in the address of each standard hash value into the preset set value.

In a second possible implementation manner, in combination with the first possible implementation manner of the first aspect, the rule matching device extracts a characteristic word from the message rule, and generates a domain identifier of the message rule After that, also include:

The rule matching device performs a preset primary hash function operation on the feature word of the message rule and the domain identifier of the message rule to obtain a primary hash value;

Using the main hash value as the row address of the entry Entry table, in the row corresponding to the row address of the Entry table, look up the feature word of the message rule and the domain identifier of the message rule;

If the feature word of the message rule and the domain identifier of the message rule are found, the message rule is successfully matched; otherwise, the message rule is not matched.

In a third possible implementation manner, in combination with the second possible implementation manner of the first aspect, the rule matching device extracts the feature words of the rule to be matched from the rule to be matched, and generates the rule to be matched After the domain identifier of the , also include:

The rule matching device selects a hash function from the preset number of hash functions as the preset main hash function;

performing the preset primary hash function operation on the feature word of the rule to be matched and the domain identifier of the rule to be matched to obtain a standard primary hash value;

The standard main hash value is used as the preset row address of the Entry table, and the feature word of the rule to be matched and the domain identifier of the rule to be matched are stored in the preset row address of the Entry table to correspond Rows of the Entry table.

In a fourth possible implementation manner, in combination with the third possible implementation manner of the first aspect, the method further includes:

The rule matching device acquires the group identifier of the rule to be matched according to the rule to be matched, the group identifier of the rule to be matched is related to the feature word of the rule to be matched and the domain identifier of the rule to be matched one-to-one correspondence;

The rule matching device stores the group identifier of the rule to be matched into the row of the Entry table corresponding to the preset row address of the Entry table, so that the group identifier of the rule to be matched can be entered in the Entry table according to the group identifier of the rule to be matched. Search for the feature word of the message rule and the domain identifier of the message rule in the row corresponding to the row address of .

In a fifth possible implementation manner, in combination with the fourth possible implementation manner of the first aspect, the rule matching device presets the feature word of the message rule and the domain identifier of the message rule The number of hash function operations before generating a preset number of hash values also includes:

The rule matching device acquires an offset value of the message rule according to the message rule;

The rule matching device performs a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule to generate a preset number of hash values, including:

The rule matching device performs the preset number of hash function operations on the feature word of the message rule, the domain identifier of the message rule, and the offset value of the message rule to generate a preset number of said hash value;

Before the rule matching device performs the preset number of hash function operations on the feature word of the rule to be matched and the domain identifier of the rule to be matched to generate a preset number of standard hash values, it further includes:

The rule matching device acquires an offset value of the rule to be matched according to the rule to be matched;

The rule matching device performs the preset number of hash function operations on the feature word of the rule to be matched and the domain identifier of the rule to be matched to generate a preset number of standard hash values, including:

The rule matching device performs the preset number of hash function operations on the feature word of the rule to be matched, the domain identifier of the rule to be matched and the offset value of the rule to be matched to generate a preset number of The standard hash value.

In a sixth possible implementation manner, in combination with the fifth possible implementation manner of the first aspect, the rule matching device presets the feature word of the message rule and the domain identifier of the message rule The main hash function operation of the main hash value is used to obtain the main hash value, and the main hash value is used as the row address of the Entry table, and the message rule is searched in the row of the Entry table corresponding to the row address of the Entry table The feature word and the domain identifier of the message rule include:

The rule matching device performs the preset primary hash function operation on the feature word of the message rule, the domain identifier of the message rule, and the offset value of the message rule to obtain the primary hash function Hash value, using the main hash value as the row address of the Entry table, in the row of the Entry table corresponding to the row address of the Entry table, look up the feature word of the message rule, the message rule domain identifier and the offset value of the message rule;

performing the preset primary hash function operation on the feature word of the rule to be matched and the domain identifier of the rule to be matched to obtain a standard primary hash value, and using the standard primary hash value as the The default row address of the Entry table, the characteristic word of the rule to be matched and the domain identifier of the rule to be matched are stored in the row of the Entry table corresponding to the preset row address of the Entry table, including:

The rule matching device performs the preset main hash function operation on the feature word of the rule to be matched, the domain identifier of the rule to be matched and the offset value of the rule to be matched to obtain the standard main Hash value, using the standard main hash value as the preset row address of the Entry table, using the feature word of the rule to be matched, the domain identifier of the rule to be matched, and the offset of the rule to be matched The shift value is stored in the row of the Entry table corresponding to the preset row address of the Entry table.

In the seventh possible implementation manner, in combination with the first possible implementation manner of the first aspect, the second possible implementation manner of the first aspect, the third possible implementation manner of the first aspect, the first aspect In the fourth possible implementation of the first aspect and the fifth possible implementation of the first aspect, before the rule matching device extracts the feature word of the rule to be matched from the rule to be matched, it further includes:

The rule matching device rewrites the starting character of the matching rule whose position is not fixed to a preset starting character;

The rule matching device groups the matching rules with the initial characters rewritten into preset starting characters, so that the rule matching device uses the grouped matching rules as the rules to be matched.

In an eighth possible implementation manner, in combination with the seventh possible implementation manner of the first aspect, the rule matching device groups the matching rules for rewriting the initial character into a preset initial character, including:

The rule matching device selects a preset feature word from the feature words of the matching rule whose position is not fixed, and extracts the preset feature word;

The rule matching device groups rules that share the preset feature word among the matching rules whose positions are not fixed into a group.

In a ninth possible implementation manner, in combination with the eighth possible implementation manner of the first aspect, the rule matching device further includes :

The rule matching device extracts a matching rule containing the same character reaching a threshold length among the matching rules whose positions are not fixed;

The rule matching device uses the same character whose length reaches the threshold as a matching rule to replace the matching rule containing the same character whose length reaches the threshold. .

In a tenth possible implementation manner, in combination with the eighth possible implementation manner of the first aspect, the rule matching device divides the rules that have a common preset feature word among the matching rules whose positions are not fixed into a group ,Also includes:

The rule matching device calculates the maximum offset value of the same preset feature word in different matching rules whose positions are not fixed;

The rule matching device rewrites the offset value of the preset feature word into the maximum offset value in each matching rule whose position is not fixed in the same group.

In the second aspect, a rule matching device includes:

An extracting unit, configured to extract a message rule from a message, extract a feature word from the message rule, and generate a domain identifier of the message rule, and combine the feature word of the message rule with the message The domain identifier of the text rule is transmitted to the matching unit;

The matching unit is configured to receive the feature word of the message rule and the field identifier of the message rule transmitted by the extraction unit, and combine the feature word of the message rule with the field identifier of the message rule Performing a preset number of hash function operations on the identifier to generate a preset number of hash values, respectively searching the data stored in the address of the corresponding hash value in the hash table corresponding to each of the hash functions, If the data stored in the address of each hash value is a preset value, the message rule matching is successful; otherwise, the message rule matching fails.

In the first possible implementation, combined with the first aspect,

The extraction unit is further configured to extract the feature words of the rules to be matched from the rules to be matched, and generate a domain identifier of the rules to be matched, and combine the feature words of the rules to be matched with the The domain identifier of the matching rule is transmitted to the matching unit;

The matching unit is further configured to receive the feature word of the rule to be matched and the domain identifier of the rule to be matched transmitted by the extraction unit, and combine the feature word of the rule to be matched with the domain identifier of the rule to be matched Performing the preset number of hash function operations on the domain identifier to generate a preset number of standard hash values, and searching for the corresponding standard hash values in the hash table corresponding to each of the hash functions address, and change the data stored in the address of each standard hash value to the preset value.

In the second possible implementation, combined with the first possible implementation of the first aspect,

The matching unit is further configured to perform a preset primary hash function operation on the feature word of the message rule and the domain identifier of the message rule to obtain a primary hash value, and use the primary hash value as The row address of the entry Entry table, in the row of the Entry table corresponding to the row address of the Entry table, look up the feature word of the message rule and the domain identifier of the message rule, if the message is found If the feature word of the rule matches the domain identifier of the message rule, the message rule is successfully matched; otherwise, the message rule is not matched.

In the third possible implementation, combined with the second possible implementation of the first aspect,

The matching unit is further configured to select a hash function from the preset number of hash functions as the preset main hash function, and combine the feature word of the rule to be matched with the rule to be matched Perform the preset main hash function operation on the domain identifier to obtain a standard main hash value, use the standard main hash value as the preset row address of the Entry table, and use the feature word of the rule to be matched The field identifier of the rule to be matched is stored in the row of the Entry table corresponding to the preset row address of the Entry table.

In the fourth possible implementation, combined with the third possible implementation of the first aspect,

The extracting unit is further configured to obtain the group identifier of the rule to be matched according to the rule to be matched, and transmit the group identifier of the rule to be matched to the matching unit, and the group identifier of the rule to be matched The character is in one-to-one correspondence with the feature word of the rule to be matched and the domain identifier of the rule to be matched;

The matching unit is further configured to receive the group identifier of the rule to be matched transmitted by the extraction unit, and store the group identifier of the rule to be matched into the Entry table corresponding to the preset row address of the Entry table row, so that the matching unit searches the feature word of the message rule and the domain identifier of the message rule in the row corresponding to the row address of the Entry table according to the group identifier of the rule to be matched .

In the fifth possible implementation, combined with the fourth possible implementation of the first aspect,

The extracting unit is further configured to obtain an offset value of the message rule according to the message rule, and transmit the offset value of the message rule to the matching unit;

The matching unit is further configured to receive the offset value of the message rule transmitted by the extracting unit, and combine the feature word of the message rule, the domain identifier of the message rule and the message rule performing the preset number of hash function operations on the offset value to generate a preset number of the hash values;

The extracting unit is further configured to obtain an offset value of the rule to be matched according to the rule to be matched, and transmit the offset value of the rule to be matched to the matching unit;

The matching unit is further configured to receive the offset value of the rule to be matched transmitted by the extraction unit, and combine the feature word of the rule to be matched, the domain identifier of the rule to be matched and the rule to be matched Perform the preset number of hash function operations on the offset value to generate the preset number of standard hash values.

In the sixth possible implementation, combined with the fifth possible implementation of the first aspect,

The matching unit is further configured to perform the preset main hash function operation on the feature word of the message rule, the domain identifier of the message rule and the offset value of the message rule to obtain the The main hash value, using the main hash value as the row address of the Entry table, in the row of the Entry table corresponding to the row address of the Entry table, search for the feature word of the message rule, the The domain identifier of the message rule and the offset value of the message rule;

The matching unit is further configured to perform the preset main hash function operation on the feature word of the rule to be matched, the domain identifier of the rule to be matched and the offset value of the rule to be matched to obtain the The standard main hash value, using the standard main hash value as the preset row address of the Entry table, using the feature word of the rule to be matched, the domain identifier of the rule to be matched and the address to be matched The offset value of the rule is stored in the row of the Entry table corresponding to the preset row address of the Entry table.

In the seventh possible implementation manner, in combination with the first possible implementation manner of the first aspect, the second possible implementation manner of the first aspect, the third possible implementation manner of the first aspect, the first aspect In the fourth possible implementation of the first aspect and the fifth possible implementation of the first aspect, the rule matching device further includes a grouping unit;

The grouping unit is configured to rewrite the starting character of the matching rule whose position is not fixed into a preset starting character;

The grouping unit is further configured to group the matching rules of rewriting the initial character into a preset initial character, so that the matching unit can use the grouped matching rules as the rules to be matched.

In the eighth possible implementation manner, in combination with the seventh possible implementation manner of the first aspect,

The grouping unit is further configured to select a preset feature word from the feature words of the matching rules whose positions are not fixed, extract the preset feature words, and combine the preset feature words in the matching rules whose positions are not fixed. Set the rules of feature words into one group.

In the ninth possible implementation, combined with the eighth possible implementation of the first aspect,

The grouping unit is further configured to extract a matching rule containing the same character reaching a threshold length from the matching rules whose positions are not fixed, and use the same character reaching the threshold length as a matching rule to replace the matching rule containing the same character reaching the threshold length. Matching rules for characters of the same length.

In the tenth possible implementation manner, in combination with the eighth possible implementation manner of the first aspect,

The grouping unit is also used to calculate the maximum offset value of the same preset feature word in different matching rules whose positions are not fixed, and each of the matching rules whose positions are not fixed in the same group In the rule, the offset value of the preset feature word is rewritten as the maximum offset value.

The rule matching method and equipment provided by the embodiments of the present invention generate a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively, in each Find the data stored in the address of the corresponding hash value in the hash table corresponding to a hash function. If the data stored in the address of each hash value is the preset value, the message rule matches successfully, otherwise it reports text rule matching failure, thus improving the efficiency of rule matching.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings that are required in the description of the embodiments or the prior art.

Fig. 1 is a kind of rule matching method provided by the embodiment of the present invention;

FIG. 2 is a rule matching method provided by another embodiment of the present invention;

Fig. 3 is a rule grouping method in the rule matching method provided by the embodiment of the present invention;

FIG. 4 is a rule matching device provided by an embodiment of the present invention;

Fig. 5 is a rule matching device provided by another embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention.

At present, most of the rule matching technologies are implemented based on FPGA (Field-Programmable Gate Array, Field Programmable Gate Array) chip, which appears as a semi-custom circuit in the field of ASIC (Application Specific Integrated Circuit, application specific integrated circuit) . Embodiments of the present invention provide a rule matching method under the background of FPGA chips, as shown in FIG. The use of FPGA chips as the hardware basis, the method includes the following steps:

101. The rule matching device extracts a packet rule from the packet.

102. The rule matching device extracts the characteristic words in the message rule, and generates a domain identifier of the message rule.

Wherein, the feature word of the message rule is a part of the character string of the message rule, which contains the unique features of its own rule that can be distinguished from other rules. The domain identifier of the message rule contains the location information where the message rule appears. Adding the domain identifier improves the accuracy and efficiency of rule matching.

103. The rule matching device performs a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule to generate a preset number of hash values.

104. The rule matching device respectively searches the data stored in the address of the corresponding hash value in the hash table corresponding to each hash function. If the data stored in the address of each hash value is a preset value, the message rule matching is successful; otherwise, the message rule matching fails.

The preset number of hash functions here are multiple different hash algorithms, generally 4 hash functions, and each hash function corresponds to a hash table. The four hash tables are all stored in the chip. The width of the table is generally 1 bit, and the depth can be set by yourself, generally 32K. The hash table can map the keyword (here, the feature word of the message rule and the domain identifier of the message rule) to an address in the table (that is, the line number of the hash table), preferably, it will pass the hash The function value obtained by the function operation is directly used as the row number to establish a mapping relationship. If there is no preset value stored in the address of the function value mapping, it means that this rule does not appear, that is, the matching fails.

The rule matching method provided by the embodiment of the present invention generates a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively in each hash Find the data stored in the address of the corresponding hash value in the hash table corresponding to the hash function. If the data stored in the address of each hash value is the default value, the message rule matches successfully, otherwise the message rule The matching fails, thus improving the efficiency of rule matching.

Further, another embodiment of the present invention provides a rule matching method, as shown in FIG. 2, the method includes:

201. The rule matching device extracts a feature word of the rule to be matched from the rule to be matched, generates a domain identifier of the rule to be matched, and obtains a group identifier of the rule to be matched.

If the rule to be matched has a fixed offset, its keyword also includes the offset value of the rule to be matched.

Specifically, the rule matching device extracts the feature words of the rules to be matched from the rules to be matched, generates the domain identifier of the rules to be matched and the offset value of the rules to be matched according to the rules to be matched, and obtains the group of rules to be matched according to the rules to be matched identifier. The offset value of the rule to be matched represents the number of characters offset by the position of the rule to be matched, and the group identifier of the rule to be matched represents which group the rule to be matched belongs to. There is a one-to-one correspondence between the group identifier of the rule to be matched, the offset value of the rule to be matched, the feature word of the rule to be matched, and the domain identifier of the rule to be matched.

202. The rule matching device performs a preset number of hash function operations on the feature word of the rule to be matched and the domain identifier of the rule to be matched to generate a preset number of standard hash values.

If the rule to be matched has an offset value, the characteristic word of the rule to be matched, the domain identifier of the rule to be matched and the offset value of the rule to be matched shall be subjected to a preset number of hash function operations to generate a preset number of standard hashes Greek value.

203. The rule matching device looks up the address of the corresponding standard hash value in the hash table corresponding to each hash function, and changes the data stored in the address of each standard hash value to a preset value.

Optionally, in the embodiment of the present invention, the width of the hash table is 1 bit, the initial value stored in the address of the hash table is 0, and the initial value is changed to 1 as the default value.

204. The rule matching device selects a hash function from a preset number of hash functions as a preset main hash function, and performs a preset main hash on the feature word of the rule to be matched and the domain identifier of the rule to be matched The function operation obtains the standard primary hash value.

If the rule to be matched has an offset value, the characteristic word of the rule to be matched, the domain identifier of the rule to be matched and the offset value of the rule to be matched shall be subjected to a preset main hash function operation to obtain a standard main hash value,

205. The rule matching device uses the standard primary hash value as the preset row address of the Entry table, and stores the characteristic word of the rule to be matched, the domain identifier of the rule to be matched, and the group identifier of the rule to be matched into the preset row address of the Entry table. The row of the Entry table corresponding to the row address.

If the rule to be matched has an offset value, the offset value of the rule to be matched should also be stored in the row corresponding to the preset row address of the Entry table.

Wherein, the Entry table is a fixed-width table stored outside the chip, and its depth is consistent with that of the hash table, and the line number of the Entry table is also consistent with the line number of the hash table of the preset main hash function. The Entry table is used to store the keywords of the rules for exact matching.

206. The rule matching device extracts a message rule from the message, extracts a feature word of the message rule from the message rule, and generates a domain identifier of the message rule according to the message rule.

If the position of the message rule is fixed, the offset value of the message rule is also obtained according to the message rule.

207. The rule matching device performs a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule to generate a preset number of hash values.

If the message rule has an offset value, the signature word of the message rule, the domain identifier of the message rule and the offset value of the message rule are subjected to a preset number of hash function operations to generate a preset number of hashes value.

208. The rule matching device respectively searches the data stored in the address of the corresponding hash value in the hash table corresponding to each hash function. If the data stored in the address of each hash value is a preset value, the message rule matching is successful; otherwise, the message rule matching fails.

Compared with step 202, optional, the default value is 1. If the stored data is 1, it means that the rule to be matched contains this rule, that is, the message rule matches successfully. If the stored data is 0, it means that the rule to be matched does not If this rule is included, the packet rule is not matched successfully.

209. The rule matching device performs a preset primary hash function operation on the feature word of the message rule and the domain identifier of the message rule to obtain a primary hash value.

If the message rule has an offset value, the signature word of the message rule, the domain identifier of the message rule and the offset value of the message rule are subjected to a preset primary hash function operation to obtain a primary hash value.

210. The rule matching device uses the main hash value as the row address of the Entry table, and in the row corresponding to the row address of the Entry table, searches for the feature word of the message rule and the field identifier of the message rule according to the group identifier of the rule to be matched symbol.

If the message rule has an offset value, the rule matching device searches the feature word of the message rule, the field identifier of the message rule, and the message in the row corresponding to the row address of the Entry table according to the group identifier of the rule to be matched. The offset value of the packet rule of the rule.

If the feature word of the message rule and the field identifier of the message rule are found, or the feature word of the message rule, the field identifier of the message rule, and the offset value of the message rule are found, it means that in the rule to be matched If this rule is included, the message rule matching is successful; otherwise, it means that the rule to be matched does not contain this rule, and the message rule matching fails.

Optionally, as shown in FIG. 3, before the rule matching device obtains the keyword of the rule to be matched, the method also includes a method for grouping rules whose positions are not fixed, including the following steps:

301. The rule matching device rewrites a start character of a matching rule whose position is not fixed to a preset start character.

Generally, the starting character of the rule whose position is not fixed is *, and in the embodiment of the present invention, preferably, the starting character can be changed to ^.

302. The rule matching device extracts, from the matching rules whose positions are not fixed (that is, the rules whose starting character is a preset character), the matching rules containing the same character whose length reaches a threshold value.

303. The rule matching device uses the same character whose length reaches the threshold as a matching rule to replace the matching rule containing the same character whose length reaches the threshold.

For example, rule (1) ^abcdede, rule (2) ^abcdegid, these two rules can be combined into a new rule ^abcde, that is, the common part of two similar rules is extracted as a new rule to participate in grouping.

304. The rule matching device selects preset feature words from the feature words of the matching rules whose positions are not fixed, extracts the preset feature words, and divides the rules having the same preset feature words among the matching rules whose positions are not fixed into a group.

In the embodiment of the present invention, when selecting a preset feature word, preferably, a feature word with a small number of corresponding rules can be selected, and the feature word that is often hit when matching is kept, and only when there are no other feature words Select frequently hit feature words.

305. The rule matching device calculates the maximum offset value of the same preset feature word in different matching rules whose positions are not fixed, and in the same group of matching rules where each position is not fixed, the offset value of the preset feature word Rewrite it as the maximum offset value, that is, add "^.{MaxOffset-Current Offset}", where "." means adding the string for any rule, so that the maximum offset value of the preset feature word in different rules Both are Max Offset.

The rule matching method provided by the embodiment of the present invention generates a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively in each hash Find the data stored in the address of the corresponding hash value in the hash table corresponding to the hash function. If the data stored in the address of each hash value is the default value, the message rule matches successfully, otherwise the message rule The matching fails, thus improving the efficiency of rule matching.

An embodiment of the present invention provides a rule matching device. Referring to FIG. 4 , the rule matching device 40 includes an extraction unit 401 and a matching unit 402 connected to each other.

Wherein, the extracting unit 401 is used to extract the message rules in the message, extract the feature words in the message rules, and generate the domain identifier of the message rules, and combine the feature words of the message rules with the domain identifiers of the message rules The character is transmitted to the matching unit 402.

The matching unit 402 is configured to receive the feature word of the message rule and the domain identifier of the message rule transmitted by the extraction unit 401, and perform a preset number of hash functions on the feature word of the message rule and the domain identifier of the message rule The operation generates a preset number of hash values, and the data stored in the address of the corresponding hash value is searched in the hash table corresponding to each hash function. If the data stored in the address of each hash value is If the preset value is set, the packet rule matches successfully; otherwise, the match fails.

The rule matching device provided by the embodiment of the present invention generates a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively in each hash Find the data stored in the address of the corresponding hash value in the hash table corresponding to the hash function. If the data stored in the address of each hash value is the default value, the message rule matches successfully, otherwise the message rule The matching fails, thus improving the efficiency of rule matching.

Optionally, the extraction unit 401 extracts the feature words of the rules to be matched from the rules to be matched, and generates a domain identifier of the rules to be matched, and transmits the feature words of the rules to be matched and the domain identifier of the rules to be matched to the matching unit 402 .

The matching unit 402 receives the feature word of the rule to be matched and the domain identifier of the rule to be matched transmitted by the extraction unit 401, and performs a preset number of hash function operations on the feature word of the rule to be matched and the domain identifier of the rule to be matched to generate a preset Set the number of standard hash values, look up the address of the corresponding standard hash value in the hash table corresponding to each hash function, and change the data stored in the address of each standard hash value to the preset value .

Optionally, the matching unit 402 is also configured to select a hash function from a preset number of hash functions as a preset main hash function, and compare the feature word of the rule to be matched with the domain identifier of the rule to be matched The preset main hash function is calculated to obtain the standard main hash value, and the standard main hash value is used as the preset row address of the Entry table, and the feature word of the rule to be matched and the domain identifier of the rule to be matched are stored in the entry table The row of the Entry table corresponding to the preset row address.

The matching unit 402 is also used to perform a preset main hash function operation on the feature word of the message rule and the domain identifier of the message rule to obtain the main hash value, and use the main hash value as the row address of the Entry table, in In the row of the Entry table corresponding to the row address of the Entry table, search for the feature word of the message rule and the field identifier of the message rule. If the feature word of the message rule and the field identifier of the message rule are found, the message The rule matching is successful, otherwise the packet rule matching fails.

Specifically, the extracting unit 401 is also used to obtain the group identifier of the rule to be matched according to the rule to be matched, and transmit the group identifier of the rule to be matched to the matching unit 402. The group identifier of the rule to be matched and the feature of the rule to be matched There is a one-to-one correspondence between the word and the domain identifier of the rule to be matched.

The matching unit 402 receives the group identifier of the rule to be matched transmitted by the extracting unit 401, and stores the group identifier of the rule to be matched into the row of the Entry table corresponding to the preset row address of the Entry table, so that the matching unit 402 can match the rule according to the rule to be matched. Find the feature word of the message rule and the domain identifier of the message rule in the row corresponding to the row address of the Entry table.

Further, the extracting unit 401 is further configured to obtain the offset value of the rule to be matched according to the rule to be matched, and transmit the offset value of the rule to be matched to the matching unit 402 .

The matching unit 402 receives the offset value of the rule to be matched transmitted by the extraction unit 401, performs a preset number of hash function operations on the feature word of the rule to be matched, the domain identifier of the rule to be matched, and the offset value of the rule to be matched to generate A preset number of standard hashes.

The extracting unit 401 is further configured to obtain an offset value of the message rule according to the message rule, and transmit the offset value of the message rule to the matching unit 402 .

The matching unit 402 receives the offset value of the message rule transmitted by the extraction unit 401, performs a preset number of hash function operations on the feature word of the message rule, the domain identifier of the message rule, and the offset value of the message rule to generate A preset number of hashes.

Further optionally, the matching unit 402 is also configured to perform a preset primary hash function operation on the feature word of the rule to be matched, the domain identifier of the rule to be matched, and the offset value of the rule to be matched to obtain a standard primary hash value , use the main hash value as the preset row address of the Entry table, store the feature word of the rule to be matched, the domain identifier of the rule to be matched, and the offset value of the rule to be matched into the entry corresponding to the preset row address of the Entry table the rows of the table.

The matching unit 402 is also configured to perform a preset primary hash function operation on the feature word of the message rule, the domain identifier of the message rule, and the offset value of the message rule to obtain a primary hash value, and convert the primary hash value to As the row address of the Entry table, in the row of the Entry table corresponding to the row address of the Entry table, search for the feature word of the message rule, the domain identifier of the message rule, and the offset value of the message rule.

Optionally, the rule matching device 40 further includes a grouping unit 403 .

The grouping unit 403 is used to rewrite the initial character of the rule to be matched whose position is not fixed to a preset initial character;

The grouping unit 403 extracts the matching rules containing the same character reaching the threshold length from the matching rules whose positions are not fixed; takes the same character having the threshold length as a matching rule to replace the matching rule containing the same character reaching the threshold length.

The grouping unit 403 selects a preset feature word from the feature words of the matching rules whose position is not fixed, extracts the preset feature word, and divides the rules having the same preset feature word among the matching rules whose position is not fixed into a group.

The grouping unit 403 calculates the maximum offset value of the same preset feature word in different matching rules whose positions are not fixed, and rewrites the offset value of the preset feature word as Maximum offset value.

The rule matching method and equipment provided by the embodiments of the present invention generate a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively, in each Find the data stored in the address of the corresponding hash value in the hash table corresponding to a hash function. If the data stored in the address of each hash value is the preset value, the message rule matches successfully, otherwise it reports text rule matching failure, thus improving the efficiency of rule matching.

Another embodiment of the present invention provides a rule matching device, as shown in FIG. 5 . The device can be embedded or itself is a microprocessor computer, such as: a general-purpose computer, a custom machine, a mobile phone terminal or a tablet machine and other portable devices. The rule matching device 5001 includes: at least one processor 5011, a memory 5012, and a bus 5013. At least one processor 5011 and memory 5012 are connected through a bus 5013 to complete mutual communication.

The bus 5013 may be an ISA (Industry Standard Architecture, industry standard architecture) bus, a PCI (Peripheral Component, external device interconnection) bus, or an EISA (Extended Industry Standard Architecture, extended industry standard architecture) bus, etc. The bus 5013 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 5 , but it does not mean that there is only one bus or one type of bus. in:

The memory 5012 is used to store executable program codes, which include computer operation instructions. The memory 5012 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

The processor 5011 may be a central processing unit 5011 (Central Processing Unit, referred to as CPU), or a specific integrated circuit (Application Specific Integrated Circuit, referred to as ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention circuit. In the present invention, the processor 5011 is used to call the program code in the memory 5012 to execute the operations of the extraction unit, the matching unit, and the grouping unit in the above-mentioned device embodiments. For a specific description, refer to the device embodiment corresponding to FIG. 4 , which will not be repeated here. repeat.

The rule matching method and equipment provided by the embodiments of the present invention generate a preset number of hash values by performing a preset number of hash function operations on the feature word of the message rule and the domain identifier of the message rule, respectively, in each Find the data stored in the address of the corresponding hash value in the hash table corresponding to a hash function. If the data stored in the address of each hash value is the preset value, the message rule matches successfully, otherwise it reports text rule matching failure, thus improving the efficiency of rule matching.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (22)

1. a kind of rule matching method it is characterised in that

Rule match equipment extracts message rule in messages；

Described rule match equipment extracts tagged word in described message rule, and generates described report The relam identifier of literary composition rule；

Described rule match equipment is by the domain of the tagged word of described message rule and described message rule Identifier carries out the cryptographic Hash of the hash function computing generation predetermined number of predetermined number；

Search corresponding described Hash in the corresponding Hash table of each described hash function respectively The data of storage in the address of value；

If in the address of each described cryptographic Hash, the data of storage is preset value, described message Rule match success；Otherwise it fails to match for described message rule.

2. method according to claim 1 is it is characterised in that described rule match equipment Before extracting message rule in messages, also include：

Described rule match equipment extracts the feature of described rule to be matched in rule to be matched Word, and generate the relam identifier of described rule to be matched；

The relam identifier of the tagged word of described rule to be matched and described rule to be matched is carried out institute The hash function computing stating predetermined number generates the Standard Hash value of predetermined number；

Search corresponding described respectively in the corresponding described Hash table of each described hash function The address of Standard Hash value, and the data of storage in the address of each described Standard Hash value is changed For described preset value.

3. method according to claim 2 is it is characterised in that described rule match equipment Extract tagged word in described message rule, and after generating the relam identifier of described message rule, Also include：

Described rule match equipment is by the domain of the tagged word of described message rule and described message rule Identifier carries out default main hash function computing and obtains main cryptographic Hash；

Using described main cryptographic Hash as entrance Entry table row address, in the row of described Entry table In the corresponding row in address, search the tagged word of described message rule and the domain mark of described message rule Know symbol；

If finding the tagged word of described message rule and the relam identifier of described message rule, The match is successful for described message rule；Otherwise it fails to match for described message rule.

4. method according to claim 3 is it is characterised in that described rule match equipment Extract the tagged word of described rule to be matched in rule to be matched, and generate described rule to be matched After relam identifier then, also include：

Described rule match equipment selects a Hash letter in the hash function of described predetermined number Number is as described default main hash function；

The relam identifier of the tagged word of described rule to be matched and described rule to be matched is carried out institute State default main hash function computing and obtain the main cryptographic Hash of standard；

Using main for described standard cryptographic Hash as the default row address of described Entry table, treat described Join the tagged word of rule and the relam identifier of described rule to be matched is stored in the pre- of described Entry table If the row of row address corresponding Entry table.

5. method according to claim 4 is it is characterised in that methods described also includes：

The group of described rule match equipment rule to be matched according to described Rule to be matched Identifier, the group identifier of described rule to be matched and described regular tagged word to be matched and institute The relam identifier stating rule to be matched corresponds；

The group identifier of described rule to be matched is stored in described Entry by described rule match equipment The row of the default row address corresponding Entry table of table, in order to the group according to described rule to be matched Identifier searches the feature of described message rule in the corresponding row of row address of described Entry table Word and the relam identifier of described message rule.

6. method according to claim 5 it is characterised in that

Described rule match equipment is by the domain of the tagged word of described message rule and described message rule Before identifier carries out the cryptographic Hash of hash function computing generation predetermined number of predetermined number, also Including：

Described rule match equipment obtains the skew of described message rule according to described message rule Value；

Described rule match equipment is by the domain of the tagged word of described message rule and described message rule Identifier carries out the cryptographic Hash of the hash function computing generation predetermined number of predetermined number, including：

Described rule match equipment is by the domain of the tagged word of described message rule, described message rule The deviant of identifier and described message rule carries out the hash function computing life of described predetermined number Become the described cryptographic Hash of predetermined number；

Described rule match equipment is by tagged word and the described rule to be matched of described rule to be matched Relam identifier carry out described predetermined number hash function computing generate predetermined number standard breathe out Before uncommon value, also include：

Described rule match equipment according to described Rule to be matched to be matched rule inclined Shifting value；

Described rule match equipment is by tagged word and the described rule to be matched of described rule to be matched Relam identifier carry out described predetermined number hash function computing generate predetermined number standard breathe out Uncommon value, including：

Described rule match equipment by described to be matched rule tagged word, described rule to be matched Relam identifier and the deviant of described rule to be matched carry out the hash function of described predetermined number Computing generates the described Standard Hash value of predetermined number.

7. method according to claim 6 it is characterised in that

Described rule match equipment is by the domain of the tagged word of described message rule and described message rule Identifier carries out default main hash function computing and obtains main cryptographic Hash, and described main cryptographic Hash is made For the row address of described Entry table, in the row address corresponding Entry table of described Entry table In row, search the tagged word of described message rule and the relam identifier of described message rule, including：

Described rule match equipment is by the domain of the tagged word of described message rule, described message rule The deviant of identifier and described message rule carries out described default main hash function computing and obtains Described main cryptographic Hash, using described main cryptographic Hash as described Entry table row address, described In the row of row address corresponding Entry table of Entry table, the tagged word of the described message rule of lookup, The relam identifier of described message rule and the deviant of described message rule；

The described tagged word by described rule to be matched is entered with the relam identifier of described rule to be matched The described default main hash function computing of row obtains the main cryptographic Hash of standard, by main for described standard Hash Value as described Entry table default row address, by described to be matched rule tagged word with described The relam identifier of rule to be matched is stored in the default row address corresponding Entry table of described Entry table Row, including：

Described rule match equipment by described to be matched rule tagged word, described rule to be matched Relam identifier and the deviant of described rule to be matched carry out described default main hash function fortune Calculation obtains the main cryptographic Hash of described standard, and main for described standard cryptographic Hash is pre- as described Entry table If row address, by the relam identifier of the tagged word of described rule to be matched, described rule to be matched The default row address being stored in described Entry table with the deviant of described rule to be matched is corresponding The row of Entry table.

8. the method according to any one of claim 2-6 is it is characterised in that described rule Before matching unit extracts the tagged word of described rule to be matched in rule to be matched, also include：

The bebinning character of unfixed for position matched rule is rewritten as pre- by described rule match equipment If bebinning character；

The matched rule that bebinning character is rewritten as default bebinning character is entered by described rule match equipment Row packet, in order to described rule match equipment using the matched rule after described packet as described Rule to be matched.

9. method according to claim 8 is it is characterised in that described rule match equipment The matched rule that bebinning character is rewritten as default bebinning character is grouped, including：

Described rule match equipment selects in the tagged word of the unfixed matched rule in described position Default tagged word, extracts described default tagged word；

Described rule match equipment is jointly described by having in unfixed for described position matched rule The rule of default tagged word is divided into one group.

10. method according to claim 9 is it is characterised in that described rule match sets Before the standby default tagged word of selection in the tagged word of the unfixed matched rule in described position, also Including：

Described rule match equipment, in the unfixed matched rule in described position, extracts containing reaching Matched rule to the identical characters of threshold length；

The described identical characters reaching threshold length are mated by described rule match equipment as one Rule replaces the described matched rule containing the identical characters reaching threshold length.

11. methods according to claim 9 are it is characterised in that described rule match sets It is divided into one for by having the rule jointly presetting tagged word in unfixed for described position matched rule Group, also includes：

Described rule match equipment calculates same described default tagged word in different described positions Maximum deviation value in unfixed matched rule；

Described rule match equipment is on the described position of described same group each unfixed coupling rule In then, the deviant of described default tagged word is rewritten as described maximum deviation value.

A kind of 12. rule match equipment are it is characterised in that include：

Extraction unit, for extracting message rule in messages, extracts in described message rule Tagged word, and generate the relam identifier of described message rule, by the tagged word of described message rule Transmit to matching unit with the relam identifier of described message rule；

Described matching unit, for receiving the spy of the described message rule of described extraction unit transmission Levy the relam identifier of word and described message rule, by the tagged word of described message rule and described report The relam identifier of literary composition rule carries out the Hash of the hash function computing generation predetermined number of predetermined number Value, searches corresponding described Hash respectively in the corresponding Hash table of each described hash function The data of storage in the address of value, if the data of storage is in the address of each described cryptographic Hash Preset value, then the match is successful for described message rule；Otherwise it fails to match for described message rule.

13. equipment according to claim 12 it is characterised in that

Described extraction unit, is additionally operable to extract the spy of described rule to be matched in rule to be matched Levy word, and generate described regular relam identifier to be matched, by the feature of described rule to be matched Word is transmitted to described matching unit with the relam identifier of described rule to be matched；

Described matching unit, is additionally operable to receive the rule described to be matched of described extraction unit transmission Tagged word with described to be matched rule relam identifier, by described to be matched rule tagged word The hash function computing carrying out described predetermined number with the relam identifier of described rule to be matched generates The Standard Hash value of predetermined number, respectively in the corresponding described Hash of each described hash function The address of corresponding described Standard Hash value is searched in table, and by each described Standard Hash value In address, the data of storage is changed to described preset value.

14. equipment according to claim 13 it is characterised in that

Described matching unit, is additionally operable to the tagged word of described message rule and described message rule Relam identifier carry out default main hash function computing and obtain main cryptographic Hash, by described main Hash It is worth the row address as entrance Entry table, in the corresponding Entry of row address of described Entry table In the row of table, search the tagged word of described message rule and the relam identifier of described message rule, If finding the tagged word of described message rule and the relam identifier of described message rule, described The match is successful for message rule；Otherwise it fails to match for described message rule.

15. equipment according to claim 14 it is characterised in that

Described matching unit, is additionally operable to select a Kazakhstan in the hash function of described predetermined number Uncommon function as described default main hash function, by the tagged word of described rule to be matched and institute The relam identifier stating rule to be matched carries out described default main hash function computing and obtains standard master Cryptographic Hash, using main for described standard cryptographic Hash as described Entry table default row address, will be described The tagged word of rule to be matched is stored in described Entry table with the relam identifier of described rule to be matched Default row address corresponding Entry table row.

16. equipment according to claim 15 it is characterised in that

Described extraction unit, is additionally operable to rule to be matched according to described Rule to be matched Group identifier, by described to be matched rule group identifier transmit to described matching unit, institute State the group identifier of rule to be matched and the tagged word of described rule to be matched and described rule to be matched Relam identifier then corresponds；

Described matching unit, is additionally operable to receive the rule described to be matched of described extraction unit transmission Group identifier, the group identifier of described rule to be matched is stored in the default row of described Entry table The row of address corresponding Entry table, in order to described matching unit according to described rule to be matched Group identifier searches the spy of described message rule in the corresponding row of row address of described Entry table Levy the relam identifier of word and described message rule.

17. equipment according to claim 16 it is characterised in that

Described extraction unit, is additionally operable to obtain the inclined of described message rule according to described message rule Shifting value, and the deviant of described message rule is transmitted to described matching unit；

Described matching unit, is additionally operable to receive the described message rule of described extraction unit transmission Deviant, by the tagged word of described message rule, the relam identifier of described message rule and described The hash function computing that the deviant of message rule carries out described predetermined number generates predetermined number Described cryptographic Hash；

Described extraction unit, is additionally operable to rule to be matched according to described Rule to be matched Deviant, and by described to be matched rule deviant transmit to described matching unit；

Described matching unit, is additionally operable to receive the rule described to be matched of described extraction unit transmission Deviant, by described to be matched rule tagged word, described to be matched rule relam identifier The hash function computing carrying out described predetermined number with the deviant of described rule to be matched generates pre- If the described Standard Hash value of quantity.

18. equipment according to claim 17 it is characterised in that

Described matching unit, is additionally operable to the tagged word of described message rule, described message rule Relam identifier and the deviant of described message rule carry out described default main hash function computing Obtain described main cryptographic Hash, using described main cryptographic Hash as described Entry table row address, in institute State in the row of row address corresponding Entry table of Entry table, search the feature of described message rule The deviant of word, the relam identifier of described message rule and described message rule；

Described matching unit, is additionally operable to the tagged word, described to be matched of described rule to be matched The deviant of the relam identifier of rule and described rule to be matched carries out described default main Hash letter Number computing obtains the main cryptographic Hash of described standard, using main for described standard cryptographic Hash as described Entry table Default row address, by described to be matched rule tagged word, described to be matched rule domain mark It is corresponding with the default row address that the deviant of described rule to be matched is stored in described Entry table to know symbol Entry table row.

19. equipment according to any one of claim 13-17 are it is characterised in that described rule Then matching unit also includes grouped element；

Described grouped element, for being rewritten as the bebinning character of unfixed for position matched rule Default bebinning character；

Described grouped element, is additionally operable to bebinning character is rewritten as the coupling rule of default bebinning character Then it is grouped, in order to described matching unit using the matched rule after described packet as described Rule to be matched.

20. equipment according to claim 19 it is characterised in that

Described grouped element, is additionally operable in the tagged word of the unfixed matched rule in described position Select default tagged word, extract described default tagged word, by unfixed for described position coupling rule The rule having described default tagged word jointly in then is divided into one group.

21. equipment according to claim 20 it is characterised in that

Described grouped element, is additionally operable in the unfixed matched rule in described position, extraction contains There is the matched rule of the identical characters reaching threshold length, reach the identical of threshold length by described Character replaces the described coupling containing the identical characters reaching threshold length as a matched rule Rule.

22. equipment according to claim 20 it is characterised in that

Described grouped element, is additionally operable to calculate same described default tagged word described in different Maximum deviation value in the unfixed matched rule in position, in described same group each institute's rheme Put in unfixed matched rule, the deviant of described default tagged word is rewritten as described maximum Deviant.