CN101901268A - Rule matching method and device - Google Patents
Rule matching method and device Download PDFInfo
- Publication number
- CN101901268A CN101901268A CN 201010244613 CN201010244613A CN101901268A CN 101901268 A CN101901268 A CN 101901268A CN 201010244613 CN201010244613 CN 201010244613 CN 201010244613 A CN201010244613 A CN 201010244613A CN 101901268 A CN101901268 A CN 101901268A
- Authority
- CN
- China
- Prior art keywords
- state machine
- character
- rule
- state
- positional information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 49
- 230000014509 gene expression Effects 0.000 claims description 57
- 230000008878 coupling Effects 0.000 claims description 26
- 238000010168 coupling process Methods 0.000 claims description 26
- 238000005859 coupling reaction Methods 0.000 claims description 26
- 238000003860 storage Methods 0.000 claims description 20
- 230000013011 mating Effects 0.000 claims description 4
- 108010001267 Protein Subunits Proteins 0.000 claims 2
- 230000009191 jumping Effects 0.000 abstract 1
- 238000010586 diagram Methods 0.000 description 12
- 238000012360 testing method Methods 0.000 description 8
- 238000005516 engineering process Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- BULLHNJGPPOUOX-UHFFFAOYSA-N chloroacetone Chemical compound CC(=O)CCl BULLHNJGPPOUOX-UHFFFAOYSA-N 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000004880 explosion Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 239000012467 final product Substances 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Landscapes
- Machine Translation (AREA)
Abstract
The embodiment of the invention discloses a rule matching method and a device which are used for improving rule matching efficiency. The method comprises: receiving a character in a character string and the position information of the character in the character string; according to the character and the position information, matching in a state machine, wherein the jumping condition of each state in the state machine comprises the character and the position information; and according to matching, outputting a matching result. The embodiment of the invention can reduce the output of an ineffective matching result and improve the rule matching efficiency.
Description
Technical field
The present invention relates to communication technical field, be specifically related to a kind of rule matching method and device.
Background technology
The rule match technology is as a kind of tagged word recognition technology of key, be widely used in the IP network deep message detect (Deep Packet Inspection, DPI) in the middle of.Wherein, tagged word identification is promptly discerned some specific character strings in the message; these specific character strings are used some special rules and are represented; usually can use regular expression (Regular Expression) to represent the character string that these are specific; for example, regular expression to (nite|knight|night) is used for representing that needing the characters matched string is tonite or toknight or tonight.Whether so-called rule match promptly exists the target string that meets these regular expressions by searching in the middle of given character string.
A kind of rule matching method is provided in the prior art, and this method comprises:
1, receive the rule of input, this rule comprises deviation post and character string;
2, the state machine matching engine is finished rule match and is exported matching result according to above-mentioned character string in state machine;
3, location counter calculates this regular side-play amount according to above-mentioned deviation post;
For example, this regular deviation post is 0, and when importing first character of this rule, the location counter calculated value is 0; During second character in receiving character string, the location counter calculated value is 1; The rest may be inferred, and till receiving all characters of this rule, the aggregate-value of location counter is this regular side-play amount.
4, the side-play amount of the rule that matches of rule match object module this regular side-play amount that location counter is calculated and state machine matching engine compares, if equate, and then whole rule match success, otherwise whole rule match is failed.
The inventor is in realizing process of the present invention, and there are the following problems at least to find prior art:
When the rule of input has a large amount of short when regular, for example x00 x00 x00 (represent three of 16 systems zero, but because be not the character of text display, so use x carry out escape and express), in the actual rule coupling, very easily match, the state machine matching engine has a large amount of matching result output, and matching result through effective coupling remaining after the filtration of side-play amount seldom, caused a large amount of invalid couplings.
Summary of the invention
A kind of rule matching method and device are provided in the embodiment of the invention, can improve rule matching efficiency.
A kind of rule matching method comprises:
Receive character and the positional information of described character in described character string in the character string;
Mate in state machine according to described character and positional information, the redirect condition of each state comprises character and positional information in the described state machine;
According to coupling output matching result.
A kind of rule match device comprises:
Receiving element is used for receiving the character and the positional information of described character in described character string of character string;
Matching unit is used for mating at state machine according to described character and positional information, and according to coupling output matching result; The redirect condition of each state comprises character and positional information in the described state machine.
Compared with prior art, the embodiment of the invention has following beneficial effect:
In the embodiment of the invention,, and then after receiving character and the positional information of this character in character string, can in state machine, mate and export matching result with character and positional information redirect condition as each state in the state machine.The rule matching method that utilizes the embodiment of the invention to provide even comprise a plurality of identical rules in the character string, also need not to export a plurality of matching results, and only the character in output and the redirect condition and the matching result of the corresponding rule of positional information get final product.Compared with prior art, the embodiment of the invention can reduce the output of ineffective matching result, improves rule matching efficiency.
Description of drawings
In order to be illustrated more clearly in the embodiment of the invention or technical scheme of the prior art, to do to introduce simply to the accompanying drawing of required use among the embodiment below, apparently, accompanying drawing in describing below only is some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
The process flow diagram of a kind of rule matching method of providing in the embodiment of the invention is provided Fig. 1;
The process flow diagram of a kind of state machine generation method of providing in the embodiment of the invention is provided Fig. 2;
The synoptic diagram of a kind of state machine of providing in the embodiment of the invention is provided Fig. 3;
The process flow diagram of a kind of state machine generation method of providing in the embodiment of the invention is provided Fig. 4;
The process flow diagram of a kind of rule matching method of providing in the embodiment of the invention is provided Fig. 5;
The synoptic diagram of the another kind of state machine that provides in the embodiment of the invention is provided Fig. 6;
The synoptic diagram of the another kind of state machine that provides in the embodiment of the invention is provided Fig. 7;
The synoptic diagram of the another kind of state machine that provides in the embodiment of the invention is provided Fig. 8;
The structural drawing of a kind of rule match device of providing in the embodiment of the invention is provided Fig. 9;
The structural drawing of the another kind of rule match device that provides in the embodiment of the invention is provided Figure 10.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the invention, the technical scheme in the embodiment of the invention is clearly and completely described, obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills belong to the scope of protection of the invention not making the every other embodiment that is obtained under the creative work prerequisite.
Embodiment one:
See also Fig. 1, the process flow diagram of a kind of rule matching method of providing in the embodiment of the invention is provided Fig. 1.As shown in Figure 1, this method can may further comprise the steps:
101, character and the positional information of this character in character string in the reception character string;
Wherein, the input of character string can be a character format, for example: " Example ", this class character string can be represented all displayable ASCII character; In addition, the input of character string also can be with the ASCII character of xhh escape, for example: " x01 x02 x0a ", this class character string mainly is to be used to represent the ASCII character that can't show, for example, carriage return, line feed etc.
Wherein, the input of positional information can be a system arbitrarily.For example, for example d (ddd) represent decimal number (ddd representative concrete numerical value), x (hhh) represent 16 system numbers (hhh represents concrete numerical value).If have only two, can " () ".For example d10 represent decimal number 10.
Illustrate the positional information of character in character string below.Suppose that character string is abc, then the positional information of first character a in character string can be set to the positional information of 0, the second character b in character string and be set to the positional information of 1, the three character c in character string and be set to 2.In other words, in a character string, the positional information that the positional information of back one character equals last character adds 1, and the positional information of first character is traditionally arranged to be 0.
In the present embodiment, can dispose a location counter, be used to the character in each character string that receives to count, generate the positional information of this character in character string.For example, when location counter received first character in the character string, the location counter calculated value was 0 (positional information of 0 first character of expression in character string); During second character in receiving character string, the location counter calculated value is 1 (positional information of 1 second character of expression in character string); The rest may be inferred, till receiving all characters of character string.
102, mate in state machine according to above-mentioned character and positional information, wherein, the redirect condition of each state comprises character and positional information in this state machine;
Wherein, mate in state machine according to the character that receives and positional information and be specifically as follows:
Whether the character that comprises in the character that judge to receive and the redirect condition is identical, and whether the positional information that comprises in the positional information that receives and the redirect condition is identical, if all identical, judges whether the state that this redirect condition is pointed to is the reception attitude again, if the reception attitude then determines to match rule; If not receiving attitude, then determine not match as yet rule.
Otherwise, if the character that comprises in character that receives and the redirect condition is inequality, perhaps the positional information that comprises in positional information of Jie Shouing and the redirect condition is inequality, or the character that comprises in character that receives and the redirect condition is inequality, and the positional information that comprises in positional information that receives and the redirect condition is inequality, then character and the positional information thereof that receives abandoned, continue to receive next character and positional information thereof.
Wherein, according to practical application carrier difference, state machine can adopt modes such as data table items, chained list, instruction list item, constitutional diagram to represent that present embodiment does not limit.
103, according to coupling output matching result.
Wherein, if the rule of matching can be exported the sign of the rule that matches,, can export the matching error prompting if mate less than rule.
In the present embodiment, can before above-mentioned steps 101, generate state machine.As shown in Figure 2, generating state machine specifically can may further comprise the steps:
201, input rule is carried out syntax parsing, and be rewritten into the required state machine rule of state machine structure;
Wherein, input rule is carried out syntax parsing, if this input rule is the pure character string that has reference position, then this input rule can be rewritten into state machine and make up required state machine rule " .{m}XXX ", wherein, " .{m} " represents reference position, and " XXX " represents character.For example, reference position Wei d60, character string makes up required state machine rule for the input rule of " http " can be rewritten into state machine: " .{60}http ".
Wherein, input rule is carried out syntax parsing, if this input rule begins with reference position " .{m} ", and comprise " [] ", " () ", the regular expression of at least one grammer in " | " then is rewritten into this input rule several state machine rules corresponding with at least one above-mentioned grammer; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned input rule.
Particularly, the meaning of grammer " [] " expression scope, the i.e. character of any one in the character set shown in the square bracket, for example [a-z] expression a any one in the z; Character string in " () " expression round bracket is done as a whole, indivisible, and for example (abc) expression abc is as an indivisible integral body; " | " expression " or " the meaning, for example a|b representative is a or b.
When illustrating input rule below and being regular expression, how input rule is carried out syntax parsing, and is rewritten into state machine and makes up required state machine rule:
For example one, input rule is carried out syntax parsing,, and comprise the regular expression of grammer " [] ", then this input rule is rewritten into several state machine rules if this input rule is with reference position " .{m} " beginning; Wherein, the quantity of several state machine rules is corresponding with grammer " [] " scope; Each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned input rule.
For example, input rule is a regular expression: " .{10}[abc] ", then this input rule is rewritten into and corresponding 3 the state machine rules of grammer " [] " scope, be respectively " .{10}a ", " .{10}b " and " .{10}c ".Wherein, each state machine rule comprises the part character of above-mentioned input rule respectively.
Give an example two, input rule is carried out syntax parsing,, and comprise the regular expression of grammer " | ", then this input rule is rewritten into several state machine rules if this input rule begins with reference position " .{m} "; Wherein, the quantity of the quantity of several state machine rules grammer " | " that equals to occur in the input rule adds 1; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned input rule.
For example, input rule is a regular expression: " .{10}a|b|c ", then this input rule is rewritten into 3 state machine rules, be respectively: " .{10}a ", " .{10}b ", " .{10}c ".Wherein, the quantity of state machine rule is 3, and the quantity that equals 2 grammers " | " adds 1, and each state machine rule comprises the part character of above-mentioned input rule respectively.
For example, input rule is a regular expression: " .{3}abc|.{6}mnx ", then this input rule is rewritten into 2 state machine rules, be respectively: " .{10}abc " and " .{6}mnx ".Wherein, the quantity of state machine rule is 2, and the quantity that equals 1 grammer " | " adds 1, and each state machine rule comprises the part character of above-mentioned input rule respectively.
Give an example three, input rule is carried out syntax parsing, if this input rule begins with reference position " .{m} ", and comprise grammer " [] ", the regular expression of " () " then is rewritten into this input rule and above-mentioned grammer " [] ", " several state machine rules that () is corresponding; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned input rule.
For example, input rule is a regular expression: " .{10}[abc] (ef) ", then this input rule is rewritten into and above-mentioned grammer " [] ", " 3 state machine rules that () is corresponding; be respectively: " .{10}aef ", " .{10}bef ", " .{10}cef "; wherein, each state machine rule comprises the part character of above-mentioned input rule respectively.
Give an example four, input rule is carried out syntax parsing, if this input rule begins with reference position " .{m} ", and comprise grammer " [] ", " () ", the regular expression of " | " then is rewritten into this input rule and above-mentioned grammer " [] ", " () ", several state machine rules that " | " is corresponding; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned input rule.
For example, input rule is a regular expression: " .{10}[abc] (ef) g|h ", then this input rule is rewritten into and above-mentioned grammer " [] ", " () ", 6 state machine rules that " | " is corresponding, be respectively: " .{10}aefg ", " .{10}befg ", " .{10}cefg ", " .{10}aefh ", " .{10}befh ", " .{10}cefh ", and each state machine rule comprises the part character of above-mentioned input rule respectively.
202, carrying out state machine according to the state machine rule makes up;
Wherein, carrying out the state machine structure according to the state machine rule is specifically as follows:
Positional information in the state machine rule makes up state machine according to each character in the state machine rule and each character; Wherein, the redirect condition of initial state to the second state in the state machine comprises the initial character in the state machine rule and the positional information of initial character; Second state in the state machine to the redirect condition of the third state comprises the inferior character in the state machine rule and the positional information of inferior character; The rest may be inferred, and the penult state in the state machine to the redirect condition of last state comprises last character in the state machine rule and the positional information of last character.
Illustrate below and how to carry out the state machine structure according to the state machine rule:
Supposing, have 3 state machine rules that begin with reference position .{0} under the starting condition, is respectively " .{0}unset ", " .{2}setup " and " .{8}test ".Wherein, state machine rule " .{0}unset " be designated r＜1, state machine rule " .{2}setup " be designated r＜2, state machine rule " .{8}test " be designated r＜3, then carry out state machine according to these 3 state machine rules respectively and make up and be specifically as follows:
See also Fig. 3, under state 0 (claiming initial state again), first character " u " and the positional information " 0 " thereof of accepting state machine rule " .{0}unset " input, and with character " u " and positional information " 0 " thereof as the redirect condition of state 0 to state 1; As shown in Figure 3, state 0 can be expressed as to the redirect condition of state 1: and 0, u}; In the present embodiment, ASCII character " 0x75 " expression also can be used in character " u ";
So far, making up state machine according to state machine rule " .{0}unset " finishes.As shown in Figure 3, comprise sign r＜1 in the state 5 〉, be used for expression state 5 for receiving attitude, promptly can match for 5 times and be designated r＜1 at state rule " .{0}unset ".
See also Fig. 3, under state 0 (claiming initial state again), first character " s " and the positional information " 2 " thereof of accepting state machine rule " .{2}setup " input, and with character " s " and positional information " 2 " thereof as the redirect condition of state 0 to state 6; As shown in Figure 3, state 0 can be expressed as to the redirect condition of state 6: and 2, s}; In the present embodiment, ASCII character " 0x73 " expression also can be used in character " s ";
State 7 times, the 3rd character " t " and the positional information " 4 " thereof of accepting state machine rule " .{2}setup " input, and with character " t " and positional information " 4 " thereof as the redirect condition of state 7 to state 8; As shown in Figure 3, state 7 can be expressed as to the redirect condition of state 8: and 4, t}; In the present embodiment, ASCII character " 0x74 " expression also can be used in character " t ";
So far, making up state machine according to state machine rule " .{2}setup " finishes.As shown in Figure 3, comprise sign r＜2 in the state 10 〉, be used for expression state 10 for receiving attitude, promptly can match for 10 times and be designated r＜2 at state rule " .{2}setup ".
See also Fig. 3, under state 0 (claiming initial state again), first character " t " and the positional information " 8 " thereof of accepting state machine rule " .{8}test " input, and with character " t " and positional information " 8 " thereof as the redirect condition of state 0 to state 11; As shown in Figure 3, state 0 can be expressed as to the redirect condition of state 11: and 8, t}; In the present embodiment, ASCII character " 0x74 " expression also can be used in character " t ";
State 12 times, the 3rd character " s " and the positional information " 10 " thereof of accepting state machine rule " .{8}test " input, and with character " s " and positional information " 10 " thereof as the redirect condition of state 12 to state 13; As shown in Figure 3, state 12 can be expressed as to the redirect condition of state 13: and 10, s}; In the present embodiment, ASCII character " 0x73 " expression also can be used in character " s ";
State 13 times, the 4th character " t " and the positional information " 11 " thereof of accepting state machine rule " .{8}test " input, and with character " t " and positional information " 11 " thereof as the redirect condition of state 13 to state 14; As shown in Figure 3, state 13 can be expressed as to the redirect condition of state 14: and 11, t}; In the present embodiment, ASCII character " 0x74 " expression also can be used in character " t ".
So far, making up state machine according to state machine rule " .{8}test " finishes.As shown in Figure 3, comprise sign r＜3 in the state 14 〉, be used for expression state 14 for receiving attitude, promptly can match for 14 times and be designated r＜3 at state rule " .{8}test ".
Suppose also to exist under the starting condition state machine rule " .{0}unsetup " that begins with reference position .{0}, then can be state 5 times, continue the 6th character " u " and the positional information " 5 " thereof of accepting state machine rule " .{0}unsetup " input, and with character " u " and positional information " 5 " thereof as the redirect condition of state 5 to state 9; As shown in Figure 3, state 5 can be expressed as to the redirect condition of state 9: and 5, u}; In the present embodiment, ASCII character " 0x75 " expression also can be used in character " u ".Be state machine rule " .{0}unsetup " with state machine rule " .{0}setup " when making up state machine, the afterbody of existence machine merges (MergeTail), can further optimize state machine.
203, the state machine that makes up is converted to needed form of matching engine and storage.
In the practical application, the implementation of matching engine is diversified.For example matching engine can be used software, and (Field-Programmable Gate Array, FPGA), or special-purpose commercial chip etc. is realized coupling to field programmable gate array.Different implementations needs different state machine forms.Therefore, according to the difference of the implementation of matching engine, can generate following state machine form and in being stored in storer (Memory):
(1) if matching engine directly uses software to realize coupling, then can directly state machine be stored in the Memory with the chain sheet form;
(2) if matching engine uses FPGA to realize coupling, then Memory can mate characteristics according to FPGA, converts the specific format storage to;
(3) if matching engine uses commercial chip to realize coupling, then Memory can store state machine with the instruction of commercial chip understanding.
With state machine shown in Figure 3 is example, and in the time need mating the character string unset of input, concrete operations are as follows:
First input: character is u, and positional information is 0, and matching engine jumps to state 1 from state 0;
Second input: character is n, and positional information is 1, and matching engine jumps to state 2 from state 1;
The 3rd input: character is s, and positional information is 2, and matching engine jumps to state 3 from state 2;
The 4th input: character is e, and positional information is 3, and matching engine jumps to state 4 from state 3;
The 5th input: character is t, and positional information is 4, and matching engine jumps to state 5 from state 4.
Because state 5 is to receive attitude, matching engine reports and has matched rule " .{0}unset ".
In the present embodiment,, and then after receiving character and the positional information of this character in character string, can in state machine, mate and export matching result with character and positional information redirect condition as each state in the state machine.For example for rule " .{2}abc ", if utilize the matching process of prior art to mate, when input of character string comprises 4 identical rules " abc ", be that input of character string is when being " abcabcabcabc ", then can match 4 times " abc " and export matching result, and only have " abc " that match for the second time to meet the reference position of rule " .{2}abc ", really successfully match rule " .{2}abc ".The method of utilizing example of the present invention to provide, in first abc input, because positional information is not right, state machine can not start; In the time of second abc input, positional information is correct, and state machine starts and the match is successful; Because positional information is not right, state machine can not start when three, the 4th abc imported.So the embodiment of the invention can be mated in state machine according to the character and the positional information that receive, reduces the output of ineffective matching result, improves rule matching efficiency.
Embodiment two:
See also Fig. 4, the process flow diagram of a kind of state machine generation method of providing in the embodiment of the invention is provided Fig. 4.In state machine generation method shown in Figure 4, adopt the state machine compiler to generate state machine.As shown in Figure 4, this state machine generation method can may further comprise the steps:
401, the state machine compiler obtains rule;
In the present embodiment, rule can be stored in the rule base of server or local storage in advance.The state machine compiler can reception server or the rule of local storage output, and for example, server or local storage be input rule periodically; Perhaps, the state machine compiler also can initiatively read rule by other modes from server or local storage.
In the present embodiment, rule has reference position.For example, the rule of reference position+pure character string, regular expression " .{10}a|b|c ", " .{3}abc|.{6}mnx " or the like.
402, the rule that will obtain of state machine compiler is carried out syntax parsing, if grammer is correct, then execution in step 403; If grammar mistake then reports miscue;
Wherein, the state machine compiler can be realized the syntax parsing of input rule by its parsing module.If parsing module is resolved the grammer of discovery input rule and the regular grammar (as the PCRE grammer) of system's employing is not inconsistent, the grammar mistake of input rule is described then; Otherwise,, illustrate that then the grammer of input rule is correct if conform to.
403, the rule that will obtain of state machine compiler is carried out syntax parsing, and is rewritten into state machine and makes up required state machine rule;
Wherein, the rule that the state machine compiler obtains may be the pure character string that has reference position, also may begin with reference position " .{m} ", and comprise " [] ", " () ", the regular expression of " | " these grammers.
Particularly, if the rule that the state machine compiler obtains is the pure character string that has reference position, then this input rule can be rewritten into state machine and makes up required state machine rule " .{m}XXX ", wherein, " .{m} " represents reference position, and " XXX " represents character.For example, reference position Wei d60, character string makes up required state machine rule for the input rule of " http " can be rewritten into state machine: " .{60}http ".
Particularly, if the rule that the state machine compiler obtains begins with reference position " .{m} ", and comprises " [] ", " () ", the regular expression of " | " these grammers then is rewritten into this regular expression several state machine rules corresponding with these grammers; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of above-mentioned regular expression.In the above embodiments one, what illustrated in greater detail how will be with reference position " .{m} " beginning, and comprise " [] ", " () ", the regular expression of " | " these grammers is rewritten into state machine and makes up required state machine rule, and present embodiment is not repeated.
Wherein, the rule that the state machine compiler will obtain is carried out syntax parsing, and is rewritten into state machine and makes up required state machine rule and specifically can adopt following method to realize:
1) after the rule that will obtain of state machine compiler is carried out syntax parsing, can directly deletion from processing queue for the rule of grammar mistake, and can deposit in the rule set create-rule collection R for the correct rule of grammer;
2) on the basis of the rule set R that step 1) generates, again further with among the rule set R with reference position " .{m} " beginning, comprise " [] ", " () ", the regular expression of " | " these grammers is rewritten into state machine and makes up required state machine rule, these state machine rules and remaining rule of rule set R (the pure character string that promptly has reference position) formation rule collection R1;
Wherein, above-mentioned step 2) specifically can adopt following method to realize:
A) build a null set R2;
B) the rule set R that generates for step 1) continues rule is carried out grammatical analysis;
C) if include " [] " in the rule, " () ", " | " these grammers then are rewritten into this rule and add among the R2 after state machine makes up required state machine rule, and should rule delete from rule set R;
D) otherwise, continue traversal rule collection R;
E) whether traveled through rule set R, if travel through, repeating step B then) to step D), otherwise the continuation later step;
F) R2 and the R that has deleted regular expression are merged the back and generate R1.
404, the state machine compiler carries out the state machine structure with the state machine rule;
Wherein, the state machine compiler can be according to above-mentioned step 2) the rule set R1 that generates, make up state machine;
Wherein, the rule among the rule set R1 is that state machine makes up required state machine rule, for example " .{60}http ", " .{0}abc " and " .{0} x00 x00 x00 " or the like.
Wherein, the state machine compiler carries out state machine with the state machine rule and makes up and specifically can adopt following method to realize:
(1) traversal above-mentioned steps 2) the rule set R1 that generates;
(2), set up branch according to the character and the positional information of rule from state 0 beginning for each bar rule;
Wherein, the positional information of first character of rule is identical with the reference position of rule, and the positional information of a back character equals the positional information of previous character+ 1.
(3) if there has been the redirect condition that comprises above-mentioned character and positional information in current state, then advance positional information+1, character reach along existing branch;
(4) if current state does not have to have the redirect condition that comprises above-mentioned character and positional information, then set up new branch, positional information+1, character reach;
(5) if current rule is finished, skip to step (6), otherwise repeating step 3), 4);
(6) if rule set R1 finishes, skip to step (7), otherwise repeating step 3), 4), 5);
(7), calculate the inefficacy redirect according to the state machine that makes up previously;
Wherein, so-called inefficacy redirect is meant in the state machine that when a state of a certain rule jumped to NextState, some states of this NextState and other rules were overlapping, and this redirect is called the inefficacy redirect.As shown in Figure 3, the redirect between state 5 and the state 9 is the inefficacy redirect.
(8) state of the state machine that made up of traversal, if current state S except existing redirect condition, traversal can also jump to other states S1, increases the redirect condition of state S to state S1;
(9) if traveled through all states of state machine, then withdraw from, otherwise repeating step (8).
Wherein, the state machine compiler carries out the state machine rule can carry out following state overall treatment to state machine after the state machine structure:
A) according to the state machine that made up, for two regular r1 among the rule set R1 and r2, and r1 and r2 have identical rule number;
B1 represents the state of r1 on state machine;
B2 represents the state of r2 on state machine;
B) if the degree of depth on state machine of B1, the B2 distance of initial state 0 (promptly apart from) is identical, this degree of depth then is set for merging the maximal value of (Merge);
C) the redirect limit if B1 and B2 did not lose efficacy, the minimum value that then merges (Merge) is 0;
Wherein, B1 and the B2 redirect limit of all not losing efficacy, illustrating does not have the redirect condition between B1 and the B2.
D) otherwise, the degree of depth of inefficacy redirect appears in the minimum value that merges (Merge) for one of them state;
As shown in Figure 3, have the inefficacy redirect between state 5 and the state 9, the minimum value that then merges (Merge) is 4 (be state 9 be 4 states apart from the distance of initial state 0).
E) for the state between maximal value, the minimum value, merge.
In the present embodiment, it is in order to merge the equal state in the whole state machine, to reduce state machine, reducing storage space that state machine is carried out the state overall treatment.As shown in Figure 3, the minimum value that merges (Merge) is 4 (be state 9 be 4 states apart from the distance of initial state 0), and the maximal value that merges (Merge) is 5 (be state 10 be 5 states apart from the distance of initial state 0), state 9 and state 10 can be merged, reduce state machine, reduce storage space.
405, the state machine that makes up is converted to needed form of matching engine and storage.
See also Fig. 5, the process flow diagram of a kind of rule matching method of providing in the embodiment of the invention is provided Fig. 5.In rule matching method shown in Figure 5, adopt the state machine matching engine to carry out the coupling of rule.As shown in Figure 5, this rule matching method can may further comprise the steps:
501, the state machine matching engine receives character and the positional information of this character in character string in the character string;
Wherein, the state machine matching engine is based on the state machine work that has made up.
In the present embodiment, a special location counter can be set in the load module of state machine matching engine, be used for determining the positional information of current input character in character string.Wherein, positional information can be a forward or reverse, and reverse value equals the character string total length and deducts the forward value.For example, when the state machine matching engine received first character of character string, the location counter calculated value was 0; When receiving second character of character string, the location counter calculated value is 1; The rest may be inferred, till receiving all characters of character string.All import when all characters of each character string and to finish, location counter can zero clearing.
Further, if during the maximum position information that positional information has required greater than state machine, can the final character input, no longer do coupling.
502, the state machine matching engine is mated in state machine according to the character and the positional information of this character in character string that receive;
In the present embodiment, the matching module of state machine matching engine can mate in state machine according to the character and the positional information of this character in character string that receive.
Suppose, the state machine rule " .{0} x00 x00 x00 " and " .{5}abc " state machine of making up as shown in Figure 6; Wherein, the state machine rule " .{0} x00 x00 x00 " be designated r＜1, state machine rule " .{5}abc " be designated r＜2.
When input of character string " x00 x00 x00 x01 x02abceg " time,
First input: character be x00, positional information is 0, matching engine jumps to state 1 from state 0;
Second input: character be x00, positional information is 1, matching engine jumps to state 2 from state 1;
The 3rd input: character be x00, positional information is 2, matching engine jumps to state 3 from state 2.Because state 3 is to receive attitude, promptly matching engine reports and has matched regular r＜1 〉;
The 4th input: character be x01, positional information is 3, state 3 does not have such redirect, matching engine is got back to state 0;
The 5th input: character be x02, positional information is 4, state 0 does not have such redirect; Engine continues at state 0;
The 6th input: character is a, and positional information is 5, and matching engine jumps to state 4 from state 0;
The 7th input: character is b, and positional information is 6, and matching engine jumps to state 5 from state 4;
The 8th input: character is c, and positional information is 7, and matching engine jumps to state 6 from state 5.
Because state 6 is to receive attitude, promptly matching engine has matched regular r＜2 〉;
The 9th input: character is e, and positional information is 8, and state 6 does not have such redirect; Engine is got back at state 0;
The tenth input: character is g, and positional information is 9, and state 0 does not have such redirect; Engine continues at state 0.
In the present embodiment, the maximum position information that sets in advance is set in the state machine matching engine, when the positional information in the state machine surpasses maximum position information, can stops coupling like this.
For example, can be provided with in the state machine matching engine and set in advance maximum position information is 7, when the state machine matching engine matches regular r＜2 at state 6〉after, can stop coupling, to have surpassed the maximum position information that sets in advance be 7 because the character of the 9th input of follow-up reception is the positional information of e.
Suppose that state machine as shown in Figure 6, when input of character string " abc x01 x02 x00 x00 x03abc " time, state machine is from state 0, never corresponding redirect, when the positional information of input character during greater than the maximum position information that sets in advance (for example maximum position information is 7), the state machine matching engine can stop coupling.Like this, by the control of " positional information+character ", just can remove unnecessary invalid coupling.For example, in the input of character string " abc x01 x02 x00 x00 x03abc " two " abc " are arranged,, all can satisfy regular r＜2〉only from the character condition, but because not matching of positional information can directly be removed at matching stage.
In addition, because the coupling when only paying close attention to it during some rule match and appearing at a certain position is not paid close attention to the follow-up coupling that appears at other positions; Like this, positional information has been arranged after, the position that can occur for the first time according to positional information location just, follow-up just can mate; Do not have positional information as original hypothesis, it is " abc " that a rule is arranged, now positional information has been arranged after, rule becomes " 010a, 020b, 030c "; If character string " abcabcabc " is arranged now, so, if according to original rule " abc ", " abcabcabc " in this character string needs to be mated three times; Suppose only to pay close attention to first abc, used rule " 010a, 020b, 030c " so after, first in " abcabcabc " " abc " can be matched, and second, the 3rd " abc " just can have been mated, and have so just saved match time.
503, the state machine matching engine is handled the result according to the match information in the state machine.
Wherein, if the rule of matching can be exported the sign of the rule that matches,, can export the matching error prompting if mate less than rule.
In the present embodiment, if the state machine that generates does not calculate the inefficacy redirect, then this state machine can be called deterministic finite automaton (Deterministic finite automaton, DFA); If the state machine that generates calculates the inefficacy redirect, then this state machine can be called uncertain finite automaton (Non-deterministic finite automaton, NFA).Compare with DFA, NFA can reduce the memory space (comprising status number and redirect condition) of state machine, effectively holddown blast.Wherein, so-called state explosion is meant the increase along with regular quantity, and the memory space of state machine is multiplier or progression increases.
Therefore, the state machine that generates in the present embodiment can generate NFA by calculating the inefficacy redirect, thereby reduces the memory space of state machine, effectively holddown blast.Illustrate below, the NFA that present embodiment generates can reduce the memory space of state machine, effectively holddown blast.
For example, for regular .{3}abc, its corresponding NFA is: status number+redirect condition=14;
DFA is: status number+redirect condition=20;
If after increasing a regular .{2}facd, become:
.{3}abc
.{2}facd
Its corresponding NFA is: status number+redirect condition=22;
Than the NFA of front wall scroll rule, storage increases (22-14)/14=57%;
Its corresponding DFA is: status number+redirect condition=46;
Than the DFA of front wall scroll rule, storage increases (46-20)/20=130%;
By above-mentioned example as can be seen, when regular number increased, the storage of the NFA that present embodiment generates was linear growth substantially, and the storage of DFA multiplier or progression increase often.So along with the increase of regular quantity, the NFA that present embodiment generates can reduce the memory space of state machine, effectively holddown blast.
In the present embodiment, character and positional information as the redirect condition of each state in the state machine, can be reduced the inefficacy redirect effectively.
For example, exist to be designated r＜1〉rule " .{0}abc " and be designated r＜2 rule " .{10}bad ", wherein, the state machine of rule " .{0}abc " and regular " .{10}bad " structure is as shown in Figure 7.Wherein, redirect condition between state 0 and the state 1 comprises character " a " and positional information " 0 ", redirect condition between state 1 and the state 2 comprises character " b " and positional information " 1 ", and the redirect condition between state 2 and the state 3 comprises character " c " and positional information " 2 "; Redirect condition between state 0 and the state 4 comprises character " b " and positional information " 10 ", redirect condition between state 4 and the state 5 comprises character " a " and positional information " 11 ", and the redirect condition between state 5 and the state 6 comprises character " d " and positional information " 12 ".Wherein, state 3 is to receive attitude, and promptly matching engine has matched regular r＜1 〉; State 6 is to receive attitude, and promptly matching engine has matched regular r＜2 〉.
As seen, before not removing positional information, because the restriction of positional information is arranged, the redirect of not losing efficacy in the state machine of two rule structures.
After removing positional information, the state machine that above-mentioned two rules make up as shown in Figure 8.Wherein, the redirect condition between state 0 and the state 1 comprises character " a ", and the redirect condition between state 1 and the state 2 comprises character " b ", and the redirect condition between state 2 and the state 3 comprises character " c "; And the redirect condition between state 0 and the state 4 comprises character " b ", and the redirect condition between state 4 and the state 5 comprises character " a ", and the redirect condition between state 5 and the state 6 comprises character " d "; Wherein, state 3 is to receive attitude, and promptly matching engine has matched regular r＜1 〉; Because state 6 is to receive attitude, promptly matching engine has matched regular r＜2 〉.As shown in Figure 8, remove positional information after, regular r＜1〉character " b " state afterwards will add inefficacy redirect a more, and regular r＜2 character " a " state afterwards will add inefficacy redirect c more.When regular quantity was big, inefficacy redirect meeting became the major part of storage, the waste storage space.
In the present embodiment,, and then after receiving character and the positional information of this character in character string, can in state machine, mate and export matching result with character and positional information redirect condition as each state in the state machine.Compared with prior art, the embodiment of the invention can reduce the output of ineffective matching result, improves rule matching efficiency.
Embodiment three:
See also Fig. 9, Fig. 9 is used to realize above-mentioned rule matching method for the structural drawing of a kind of rule match device of providing in the embodiment of the invention.As shown in Figure 9, this rule match device can comprise:
Receiving element 901 is used for receiving the character and the positional information of this character in character string of character string;
Wherein, the input of character string can be a character format, for example: " Example ", this class character string can be represented all displayable ASCII character; In addition, the input of character string also can be with the ASCII character of xhh escape, for example: " x01 x02 x0a ", this class character string mainly is to be used to represent the ASCII character that can't show.
Wherein, the input of positional information can be a system arbitrarily.For example, for example d (ddd) represent decimal number, x (hhh) represent 16 system numbers.If have only two, can " () ".For example d10 represent decimal number 10.
Illustrate the positional information of character in character string below.Suppose that character string is abc, then the positional information of first character a in character string can be set to the positional information of 0, the second character b in character string and be set to the positional information of 1, the three character c in character string and be set to 2.In other words, in a character string, the positional information that the positional information of back one character equals last character adds 1, and the positional information of first character is traditionally arranged to be 0.
As shown in Figure 5, this rule match device can comprise:
State machine generation unit 903 is used to generate state machine.
Wherein, character and positional information that matching unit 902 specifically is used for receiving according to receiving element 901 are mated at the state machine that state machine generation unit 903 generates, and according to coupling output matching result; Wherein, the redirect condition of each state comprises character and positional information in the state machine.
See also Figure 10, the structural representation of the another kind of rule match device that provides in the present embodiment is provided Figure 10.As shown in figure 10, in this rule match device, state machine generation unit 903 can comprise:
Make up subelement 9032, be used for carrying out state machine and make up according to above-mentioned state machine rule;
Storing sub-units 9033, the state machine that is used for making up convert needed form of matching engine and storage to.
Wherein, resolving subelement 9031 specifically is used for input rule is carried out syntax parsing, if input rule is the pure character string that has reference position, then input rule is rewritten into state machine and makes up required state machine rule " .{m}XXX ", wherein, " .{m} " represents reference position, and " XXX " represents character.
Wherein, resolve subelement 5031 and specifically input rule is carried out syntax parsing, if input rule begins with reference position " .{m} ", and comprise " [] ", " () ", the regular expression of at least one grammer in " | " then is rewritten into regular expression several state machine rules corresponding with at least one grammer; Wherein, each state machine rule begins with reference position " .{m} ", and comprises the part character of regular expression.
Wherein, making up subelement 9033 specifically is used for making up state machine according to each character and the positional information of each character in the state machine rule of state machine rule;
Wherein, in making up the state machine that subelement 9033 makes up, the redirect condition of initial state to the second state comprises the initial character in the state machine rule and the positional information of initial character; Second state in the state machine to the redirect condition of the third state comprises the inferior character in the state machine rule and the positional information of inferior character; The rest may be inferred, and the penult state in the state machine to the redirect condition of last state comprises last character in the state machine rule and the positional information of last character.
As shown in figure 10, in this rule match device, matching unit 902 can comprise:
In the present embodiment, state machine generation unit 903 is with character and the positional information redirect condition as each state in the state machine, and then after matching unit 902 receives character and the positional information of this character in character string, can in state machine, mate and export matching result.Compared with prior art, the embodiment of the invention can reduce the output of ineffective matching result, improves rule matching efficiency.
In the specific implementation process, above-mentioned each matching unit can use various hardware chips and realize in conjunction with various accessory circuits, as realizing by process chip such as DSP, FPGA and in conjunction with some accessory circuits (power circuit, memory circuit, interface circuit etc.), the method of specific implementation is a technology known in those skilled in the art, does not repeat them here.
One of ordinary skill in the art will appreciate that: all or part of step that realizes said method embodiment can be finished by the relevant hardware of programmed instruction, aforesaid program can be stored in the computer read/write memory medium, this program is carried out the step that comprises said method embodiment when carrying out; And aforesaid storage medium comprises: various media that can be program code stored such as ROM (read-only memory) (ROM), random access device (RAM), magnetic disc or CD.
More than a kind of rule matching method and the device that is provided in the embodiment of the invention is described in detail, used specific case herein principle of the present invention and embodiment are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that all can change in specific embodiments and applications, to sum up, this description should not be construed as limitation of the present invention.
Claims (12)
1. a rule matching method is characterized in that, comprising:
Receive character and the positional information of described character in described character string in the character string;
Mate in state machine according to described character and positional information, the redirect condition of each state comprises character and positional information in the described state machine;
According to coupling output matching result.
2. method according to claim 1 is characterized in that, before character in the described reception character string and the positional information of described character in described character string, also comprises:
Generate described state machine;
The described state machine of described generation comprises:
Input rule is carried out syntax parsing, and be rewritten into the required state machine rule of state machine structure;
Carrying out state machine according to described state machine rule makes up;
Convert the state machine that makes up to the needed form of matching engine and storage.
3. method according to claim 2 is characterized in that, described input rule is carried out syntax parsing, and is rewritten into state machine and makes up required state machine rule and comprise:
Input rule is carried out syntax parsing, if described input rule is the pure character string that has reference position, input rule is rewritten into state machine and makes up required state machine rule " .{m}XXX " shown in then inciting somebody to action, wherein, described " .{m} " represents reference position, and " XXX " represents character.
4. method according to claim 2 is characterized in that, described input rule is carried out syntax parsing, and is rewritten into state machine and makes up required state machine rule and comprise:
Input rule is carried out syntax parsing, if described input rule begins with reference position " .{m} ", and comprise " [] ", " () ", the regular expression of at least one grammer in " | " then is rewritten into described regular expression several state machine rules corresponding with described at least one grammer; Wherein, each state machine rule begins with described reference position " .{m} ", and comprises the part character of described regular expression.
5. method according to claim 2 is characterized in that, describedly carries out state machine according to described state machine rule and makes up and to comprise:
Positional information in described state machine rule makes up state machine according to each character in the described state machine rule and described each character;
Wherein, the redirect condition of original state to the second state in the described state machine comprises the initial character in the described state machine rule and the positional information of described initial character; Second state in the described state machine to the redirect condition of the third state comprises the inferior character in the described state machine rule and the positional information of described character; The rest may be inferred, and the penult state in the described state machine to the redirect condition of last state comprises last character in the described state machine rule and the positional information of described last character.
6. according to each described method of claim 1～5, it is characterized in that described the coupling according to described character and positional information comprises in state machine:
Whether the character that comprises in the character that judge to receive and the redirect condition is identical, and whether the positional information that comprises in the positional information that receives and the redirect condition is identical, if all identical, judges whether the state that described redirect condition is pointed to is the reception attitude, if then determine to match rule; If not, determine that then coupling is less than rule.
7. a rule match device is characterized in that, comprising:
Receiving element is used for receiving the character and the positional information of described character in described character string of character string;
Matching unit is used for mating at state machine according to described character and positional information, and according to coupling output matching result; The redirect condition of each state comprises character and positional information in the described state machine.
8. device according to claim 7 is characterized in that, also comprises:
The state machine generation unit is used to generate described state machine;
Described state machine generation unit comprises:
Resolve subelement, be used for input rule is carried out syntax parsing, and be rewritten into the required state machine rule of state machine structure;
Make up subelement, be used for carrying out state machine and make up according to described state machine rule;
Storing sub-units, the state machine that is used for making up convert needed form of matching engine and storage to.
9. device according to claim 8 is characterized in that,
Described parsing subelement specifically is used for input rule is carried out syntax parsing, if described input rule is the pure character string that has reference position, input rule is rewritten into state machine and makes up required state machine rule " .{m}XXX " shown in then inciting somebody to action, wherein, described " .{m} " represents reference position, and " XXX " represents character.
10. device according to claim 8 is characterized in that,
Described parsing subelement specifically is used for input rule is carried out syntax parsing, if described input rule begins with reference position " .{m} ", and comprise " [] ", " () ", the regular expression of at least one grammer in " | " then is rewritten into described regular expression several state machine rules corresponding with described at least one grammer; Wherein, each state machine rule begins with described reference position " .{m} ", and comprises the part character of described regular expression.
11. device according to claim 8 is characterized in that,
Described structure subelement specifically is used for the positional information structure state machine in described state machine rule according to each character of described state machine rule and described each character; Wherein, the redirect condition of initial state to the second state in the described state machine comprises the initial character in the described state machine rule and the positional information of described initial character; Second state in the described state machine to the redirect condition of the third state comprises the inferior character in the described state machine rule and the positional information of described character; The rest may be inferred, and the penult state in the described state machine to the redirect condition of last state comprises last character in the described state machine rule and the positional information of described last character.
12., it is characterized in that described matching unit comprises according to each described device of claim 7～11:
Judgment sub-unit, be used for judging whether the character of reception is identical with the character that the redirect condition comprises, and whether the positional information that comprises in the positional information that receives and the redirect condition is identical, if it is all identical, judge whether the state that described redirect condition is pointed to is to receive attitude, if then determine to match rule; If not, determine that then coupling is less than rule.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2010102446131A CN101901268B (en) | 2010-08-02 | 2010-08-02 | Rule matching method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2010102446131A CN101901268B (en) | 2010-08-02 | 2010-08-02 | Rule matching method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101901268A true CN101901268A (en) | 2010-12-01 |
| CN101901268B CN101901268B (en) | 2011-12-21 |
Family
ID=43226802
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2010102446131A Active CN101901268B (en) | 2010-08-02 | 2010-08-02 | Rule matching method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101901268B (en) |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102142009A (en) * | 2010-12-09 | 2011-08-03 | 华为技术有限公司 | Method and device for matching regular expressions |
| CN103188268A (en) * | 2013-03-29 | 2013-07-03 | 华为技术有限公司 | Method and device of identifying aggressive message |
| CN103729452A (en) * | 2013-12-31 | 2014-04-16 | 杭州华为数字技术有限公司 | Rule matching method and device |
| CN104750683A (en) * | 2013-12-25 | 2015-07-01 | 中国移动通信集团公司 | Character string matching method and device |
| CN104866465A (en) * | 2014-02-25 | 2015-08-26 | 腾讯科技（深圳）有限公司 | Sensitive text detection method and device |
| CN110546640A (en) * | 2017-04-25 | 2019-12-06 | 华为技术有限公司 | Hierarchical pattern matching for deep packet analysis |
| WO2020107359A1 (en) * | 2018-11-30 | 2020-06-04 | 唐山曹妃甸联城科技有限公司 | Rule matching method and device |
| CN111984536A (en) * | 2020-08-17 | 2020-11-24 | 四川爱创科技有限公司 | Equipment automation test system |
| CN112069303A (en) * | 2020-09-17 | 2020-12-11 | 四川长虹电器股份有限公司 | Matching search method and device for character strings and terminal |
| CN113905411A (en) * | 2021-10-28 | 2022-01-07 | 中国联合网络通信集团有限公司 | Detection method, device, equipment and storage medium for deep packet inspection recognition rule |
| CN114489683A (en) * | 2022-04-15 | 2022-05-13 | 南京安元科技有限公司 | JVM-based functional programming grammar implementation method for java-like language |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1759354A (en) * | 2003-01-09 | 2006-04-12 | 思科系统公司 | Methods and apparatuses for evaluation of regular expressions of arbitrary size |
| US20070282833A1 (en) * | 2006-06-05 | 2007-12-06 | Mcmillen Robert J | Systems and methods for processing regular expressions |
| CN101154182A (en) * | 2006-09-25 | 2008-04-02 | 西门子（中国）有限公司 | Grammar checking device |
-
2010
- 2010-08-02 CN CN2010102446131A patent/CN101901268B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1759354A (en) * | 2003-01-09 | 2006-04-12 | 思科系统公司 | Methods and apparatuses for evaluation of regular expressions of arbitrary size |
| US20070282833A1 (en) * | 2006-06-05 | 2007-12-06 | Mcmillen Robert J | Systems and methods for processing regular expressions |
| CN101154182A (en) * | 2006-09-25 | 2008-04-02 | 西门子（中国）有限公司 | Grammar checking device |
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102142009B (en) * | 2010-12-09 | 2013-08-14 | 华为技术有限公司 | Method and device for matching regular expressions |
| CN102142009A (en) * | 2010-12-09 | 2011-08-03 | 华为技术有限公司 | Method and device for matching regular expressions |
| CN103188268A (en) * | 2013-03-29 | 2013-07-03 | 华为技术有限公司 | Method and device of identifying aggressive message |
| CN103188268B (en) * | 2013-03-29 | 2016-08-10 | 华为技术有限公司 | A kind of method and apparatus identifying aggressivity message |
| CN104750683A (en) * | 2013-12-25 | 2015-07-01 | 中国移动通信集团公司 | Character string matching method and device |
| CN103729452B (en) * | 2013-12-31 | 2017-05-10 | 杭州华为数字技术有限公司 | Rule matching method and device |
| CN103729452A (en) * | 2013-12-31 | 2014-04-16 | 杭州华为数字技术有限公司 | Rule matching method and device |
| CN104866465B (en) * | 2014-02-25 | 2017-11-03 | 腾讯科技（深圳）有限公司 | Sensitive Method for text detection and device |
| CN104866465A (en) * | 2014-02-25 | 2015-08-26 | 腾讯科技（深圳）有限公司 | Sensitive text detection method and device |
| CN110546640A (en) * | 2017-04-25 | 2019-12-06 | 华为技术有限公司 | Hierarchical pattern matching for deep packet analysis |
| CN110546640B (en) * | 2017-04-25 | 2021-09-07 | 华为技术有限公司 | Hierarchical pattern matching for deep packet analysis |
| WO2020107359A1 (en) * | 2018-11-30 | 2020-06-04 | 唐山曹妃甸联城科技有限公司 | Rule matching method and device |
| CN111984536A (en) * | 2020-08-17 | 2020-11-24 | 四川爱创科技有限公司 | Equipment automation test system |
| CN112069303A (en) * | 2020-09-17 | 2020-12-11 | 四川长虹电器股份有限公司 | Matching search method and device for character strings and terminal |
| CN113905411A (en) * | 2021-10-28 | 2022-01-07 | 中国联合网络通信集团有限公司 | Detection method, device, equipment and storage medium for deep packet inspection recognition rule |
| CN113905411B (en) * | 2021-10-28 | 2023-05-02 | 中国联合网络通信集团有限公司 | Detection method, device, equipment and storage medium for deep packet inspection identification rule |
| CN114489683A (en) * | 2022-04-15 | 2022-05-13 | 南京安元科技有限公司 | JVM-based functional programming grammar implementation method for java-like language |
| CN114489683B (en) * | 2022-04-15 | 2022-06-21 | 南京安元科技有限公司 | JVM-based functional programming grammar implementation method for java-like language |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101901268B (en) | 2011-12-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101901268B (en) | Rule matching method and device | |
| CN101876986B (en) | Character string matching method based on finite state automation and content filtering equipment | |
| CN102075511B (en) | Data matching equipment and method as well as network intrusion detection equipment and method | |
| CN101650717B (en) | Method and system for saving storage space of database | |
| CN100574321C (en) | The system safety implementation method of user mode table and relevant system | |
| CN102143148B (en) | Parameter acquiring and general protocol analyzing method and device | |
| US9558299B2 (en) | Submatch extraction | |
| CN102857493A (en) | Content filtering method and device | |
| CN101639861B (en) | String matching method and device based on definite state automaton | |
| CN102870116B (en) | Method and apparatus for content matching | |
| CN102682090A (en) | System and method for matching and processing sensitive words on basis of polymerized word tree | |
| CN101154228A (en) | Partitioned pattern matching method and device thereof | |
| CN103138981A (en) | Method and device for social network service analysis | |
| CN101369278B (en) | Approximate adaptation method and apparatus | |
| CN102207979A (en) | Sensitive word matching method and system | |
| CN104994219A (en) | Data processing method and system | |
| CN105045808A (en) | Composite rule set matching method and system | |
| CN110517137A (en) | A kind of method and system of systematic function modular safety contract | |
| CN101079890B (en) | A method and device for generating characteristic code and identifying status machine | |
| CN113157981A (en) | Graph network relation diffusion method and device | |
| CN107291521B (en) | Method and apparatus for compiling computer language | |
| CN101944121A (en) | Generating method of finite state automaton, keyword matching method and devices and equipment | |
| CN104994220A (en) | Data processing method and system | |
| CN101771675B (en) | Method and device for implementing feature matching of data packet | |
| CN109740130B (en) | Method and device for generating file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20170714 Address after: 510640 Guangdong City, Tianhe District Province, No. five, road, public education building, unit 371-1, unit 2401 Patentee after: GUANGDONG GAOHANG INTELLECTUAL PROPERTY OPERATION Co.,Ltd. Address before: 518129 Bantian HUAWEI headquarters office building, Longgang District, Guangdong, Shenzhen Patentee before: HUAWEI TECHNOLOGIES Co.,Ltd. |
|
| CB03 | Change of inventor or designer information |
Inventor after: Chen Liwei Inventor before: Zeng Jia Inventor before: Guo Zhi Inventor before: Wu Fuqiang Inventor before: Sun Lingyan |
|
| CB03 | Change of inventor or designer information | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20170901 Address after: 063000, Hebei Province, Fengrun District, Fengrun Town, Tangshan City Province, Wang Chuang-tzu Village East 1 row 2 Patentee after: Chen Liwei Address before: 510640 Guangdong City, Tianhe District Province, No. five, road, public education building, unit 371-1, unit 2401 Patentee before: GUANGDONG GAOHANG INTELLECTUAL PROPERTY OPERATION Co.,Ltd. |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20181212 Address after: 063000 Tangshan City, Hebei Province, Caofeidian Industrial Zone, Sanjia Municipal Service Building, Block B, 709 Patentee after: Tangshan Caofeidian Liancheng Technology Co.,Ltd. Address before: 063000 Row 2, Bingdong Street, Wangzhuangzi Village, Fengrun Town, Tangshan City, Hebei Province Patentee before: Chen Liwei |
|
| TR01 | Transfer of patent right | ||
| CP03 | Change of name, title or address |
Address after: 063299 C2 training building, science and Technology Innovation Industrial Park, Caofeidian new city, Tangshan City, Hebei Province Patentee after: Tangshan Caofeidian Liancheng Technology Co.,Ltd. Address before: 063000 Tangshan City, Hebei Province, Caofeidian Industrial Zone, Sanjia Municipal Service Building, Block B, 709 Patentee before: Tangshan Caofeidian Liancheng Technology Co.,Ltd. |
|
| CP03 | Change of name, title or address | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 063299 C2 training building, Caofeidian new town science and Technology Innovation Industrial Park, Tangshan City, Hebei Province Patentee after: Liancheng Technology (Hebei) Co.,Ltd. Address before: 063299 C2 training building, Caofeidian new town science and Technology Innovation Industrial Park, Tangshan City, Hebei Province Patentee before: Tangshan Caofeidian Liancheng Technology Co.,Ltd. |
|
| CP01 | Change in the name or title of a patent holder |