CN102255788A

CN102255788A - Message classification decision establishing system and method and message classification system and method

Info

Publication number: CN102255788A
Application number: CN2010101818391A
Authority: CN
Inventors: 叶润国; 周涛
Original assignee: Beijing Venus Information Security Technology Co Ltd; Beijing Venus Information Technology Co Ltd
Current assignee: Beijing Venus Information Security Technology Co Ltd; Beijing Venus Information Technology Co Ltd
Priority date: 2010-05-19
Filing date: 2010-05-19
Publication date: 2011-11-23
Anticipated expiration: 2030-05-19
Also published as: CN102255788B

Abstract

The invention discloses a message classification decision establishing system and method and a message classification system and method, which are used for establishing an efficiently-matched message classification system and realizing efficient message classification. The message classification decision establishing method comprises the following steps of: mapping all message classification rules onto a series of hyper-rectangles in a multi-dimensional space; dimensionally projecting the series of hyper-rectangles gradually in the multi-dimensional space to obtain the basic interval of each hyper-rectangle sequentially arranged on each dimension of the multi-dimensional space; and establishing a message classification decision tree for message classification according to the basic intervals. Compared with the prior art, the invention has the advantages that: the message classification decision tree established in the embodiment of the invention has a very small number of layers, and the message classification processing efficiency is high.

Description

Message classification decision-making constructing system and method, message classification system and method

Technical field

The present invention relates to the information processing technology, relate in particular to a kind of message classification decision-making constructing system and method and a kind of message classification system and method.

Background technology

Message classification is also referred to as traffic classification.Stream is the sequence of message from source to a purpose, is the set with message of same alike result.The least unit of forming stream is a network message.Message classification mainly is based on one or more territories of header, according to the stream under certain strategy or this message of rule identification.

The message classification technology can be applicable to a lot of fields in the network.Development along with Internet technology, now a lot of network equipments all be unable to do without the message classification technology, and this comprises key routing device, the firewall box that network message filtering is provided that service quality (QoS) guarantee is provided, VPN(Virtual Private Network) gateway device of data encryption or the like is provided.For these serious network equipments that relies on the message classification technology, message classification efficient is directly determining the performance height of the described network equipment.

Table 1 is the firewall rule sets under discrimination signal of a simple message five-tuple sign Network Based, it is exactly 5 dimension message classification problems of typically carrying out according to these five parameters of source IP address (SIP), source port (Sport), target ip address (DIP), target port (DPort) and agreement (Prot) in fact, it is classified according to all network messages of flowing through of network message rules set pair, take different processing actions for the networks of different type message, such as transmitting or abandoning or the like.

Table 1, the signal of fire compartment wall acl rule collection

Numbering	The five-tuple rule (SIP, Sport, DIP, DPort, Prot)	Priority	Action
					1	192.168.55.0/24，*，202.168.34.15，80，TCP	1	Allow
2	192.168.43.0/24，，202.168.57.34-37，[20-21]，	2	Allow
				3	，，，，*	3	Deny

A more formal d dimension message classification problem can be described below:

The set of strategy relevant with message classification and rule is called the message classification device, for the grader of given N message classification rule, Wherein, regular R _jForm by three parts:

(1) regular expression R _j[i], 1≤i≤d, wherein d is the number of the related header field of message classification device;

(2) numerals, Pri (R _j), pointed out the priority of this message classification rule in grader;

(3) operations, Action (R _j), pointed out processing action to the network message that meets this message classification rule, the processing action of different application is different, such as, action is handled in packet loss in the fire compartment wall and forwarding.

For the network message P of an arrival, its header can regard as d dimension tuple (P[1], P[2] ... P[d]).Think network message P and message classification the rule R _jCoupling, and if only if all has P[i for each dimension i] coupling R _j[i].

Certain thresholding P[i of network message P] and message classification rule R _jDomain of dependence expression formula R _jThere are three kinds of modes in the coupling of [i]: accurate coupling, prefix matching and commensurate in scope, wherein:

Accurately coupling is meant the i thresholding P[i of network header P] just in time with message classification rule R _jI territory expression formula R _jThe value of [i] equates;

Prefix matching is meant message classification rule R _jI territory expression formula R _j[i] just in time is the prefix of the i thresholding (P[i]) of network message P, generally uses longest prefix match;

Commensurate in scope is meant the i thresholding P[i of network message P] just in time be positioned at by message classification rule R _jI territory expression formula R _jWithin [i] represented codomain scope.

Because accurately coupling and prefix matching can be regarded the special shape of commensurate in scope as, therefore, the present invention is with all message classification rule R _jAll territory expression formula R _j[i] is considered as commensurate in scope and expresses formula.

See message classification from geometrical point, d dimension message classification rule is exactly a hypermatrix in the d dimension space in fact.For a given sorter network header P that treats, be a point in the d dimension space in fact.The message classification problem is exactly all hypermatrix or that the highest hypermatrix of priority of finding to comprise a P in fact.

As shown in table 2, in the object lesson of a message classification rule as follows, every message classification rule comprises two territories, is respectively X and Y.The interval span of territory X and Y all is 0 to 7 (being designated as [0,7]), existing following 5 message classification rules:

Table 2, message classification rule first example

Rule numbers	X territory span	Y territory span	Rule priority
				R1	[1，5]	[2，6]	1
R2	[2，7]	[3，4]	2
				R3	Arbitrary value	[5，7]	3
R4	[5，6]	Arbitrary value	4
				R5 (silent rule)	Arbitrary value	Arbitrary value	5

If (being the X territory is transverse axis to regard two related territories of each message classification rule in above-mentioned first example as in 2 dimension spaces two dimensions, the Y territory is the longitudinal axis), then each message classification rule all exists one 2 rectangle in the dimensional plane corresponding with it in fact in this first example, as shown in Figure 1.

Below how explanation classifies to network message based on 2 dimension spaces shown in Figure 1 under the situation of considering priority.

Network message 1 (P1): X=4, Y=7

For network message 1, can in Fig. 1, come out with point (4,7) mark, according to table 2 and Fig. 1 as can be seen, this point is arranged in message classification rule R3 and the represented rectangle of R5 simultaneously, but because R3 has higher priority, therefore network message 1 is categorized among the message classification rule R3.

Network message 2 (P2): X=3, Y=6

For network message 2, can be with point (3 in Fig. 1,6) mark comes out, according to table 2 and Fig. 1 as can be seen, this point is arranged in message classification rule R1, R3 and the represented rectangle of R5 simultaneously, but, therefore network message 1 is categorized in the message classification rule 1 because message classification rule 1 has higher priority level.

Network message 3 (P3): X=1, Y=1

For network message 3, can be in Fig. 1 come out with point (1,1) mark, according to table 2 and Fig. 1 as can be seen, this point is arranged in the represented rectangle of message classification rule R5, therefore network message 3 is categorized among the message classification rule R5.

For the message classification problem that contains more than the message classification rule set in 2 territories, can adopt similar approach to be converted to the hyperspace orientation problem equally.

The inventor is in realizing process of the present invention, find that traditional message classification technology great majority adopt linear search to finish, be about to the current sorter network message for the treatment of and carry out the order coupling with each network message classifying rules linearly, till the message classification rule that finds coupling.But, this linear search technique for message classification rule bar number more after a little while performance perhaps can guarantee, if but the message classification rule reaches hundreds and thousands of, then matching efficiency is extremely low, thereby makes message classification efficient directly have influence on the performance of the network equipment.

Summary of the invention

Technical problem to be solved by this invention is that a kind of message classification decision-making constructing system and method need be provided, and is used to make up the message classification system of efficient coupling, overcomes the prior art neutral line and searches the low technical problem of technical efficiency.

In order to solve the problems of the technologies described above, the invention provides a kind of message classification decision-making constructing system, comprising:

Mapping block is used for all message classification rules are mapped to a series of hypermatrix of a hyperspace;

Projection module is used in described hyperspace, and described a series of hypermatrix are pursued the dimension projection, obtains each hypermatrix tactic basic interval on each dimension of described hyperspace;

Make up module, be used for making up a message classification decision tree that is used to carry out message classification according to described basic interval.

Wherein, described projection module comprises:

Selected cell is used for not selecting one dimension to tie up as current goal in described hyperspace is carried out the residue dimension of projection;

Projecting cell is used for described hypermatrix is carried out projection in described current goal dimension, obtains each hypermatrix tactic basic interval on described current goal dimension.

Wherein, described structure module comprises:

Resolving cell is used for according to described tactic basic interval, on described current goal dimension described all message classification rules is decomposed into the regular subclass of one or more message classification;

Judging unit is used to judge whether described message classification rule subclass is empty, and is used for judging that whether described message rule subclass all is projected in each dimension of described hyperspace;

Construction unit, be used for making up described message classification decision tree according to described message classification rule subclass, and go out described message classification rule subclass in described judgment unit judges and stop described structure for sky or when on promising, all being projected, obtain a complete described message classification decision tree.

In order to solve the problems of the technologies described above, the present invention also provides a kind of message classification decision-making construction method, comprising:

All message classification rules are mapped to a series of hypermatrix in the hyperspace;

In described hyperspace, described a series of hypermatrix are pursued the dimension projection, obtain each hypermatrix tactic basic interval on each dimension of described hyperspace;

Make up a message classification decision tree that is used to carry out message classification according to described basic interval.

Wherein, in described hyperspace, carry out the described step that the dimension projection obtains described tactic basic interval of pursuing, comprising:

In described hyperspace, do not carry out selecting one dimension to tie up in the residue dimension of projection as current goal;

Described hypermatrix is carried out projection in described current goal dimension, obtain each hypermatrix tactic basic interval on described current goal dimension.

Wherein, make up the step of described message classification decision tree, comprising according to described basic interval:

According to described tactic basic interval, on described current goal dimension, described all message classification rules are decomposed into the regular subclass of one or more message classification;

Make up described message classification decision tree according to described message classification rule subclass;

Judge whether described message classification rule subclass is empty, and be used for judging that whether described message rule subclass all is projected in each dimension of described hyperspace;

Judge described message classification rule subclass and stop described structure, obtain a complete described message classification decision tree for sky or when on promising, all being projected.

Another technical problem to be solved by this invention is that a kind of message classification system and method need be provided, and is used to provide message classification efficiently, overcomes the technical problem of message classification inefficiency in the prior art.

In order to solve the problems of the technologies described above, the invention provides a kind of message classification system, comprising:

Receiver module is used for receiving and treats the sorter network message;

Sort module, be used for from the root node of a message classification decision tree that makes up according to all message classification rules, node successively according to described message classification decision tree is classified to the described sorter network message for the treatment of, stops described classification when obtaining the leaf node of described message classification decision tree;

Output module is used for obtaining described classification results and the output for the treatment of the sorter network message according to described leaf node.

Wherein, described output module is used to judge whether described leaf node is empty, be that the then described sorter network message for the treatment of does not match any message classification rule, otherwise the message classification that is comprised in described leaf node rule is the described message classification rule for the treatment of that the sorter network message matches.

In order to solve the problems of the technologies described above, the present invention also provides a kind of packet classification method, comprising:

The sorter network message is treated in reception;

From root node, the described sorter network message for the treatment of is classified according to the node successively of described message classification decision tree according to the regular message classification decision tree that makes up of all message classifications;

Stop described classification when obtaining the leaf node of described message classification decision tree;

Obtain described classification results and the output for the treatment of the sorter network message according to described leaf node.

Wherein, the step according to the described message classification decision tree of described all message classification rule structures comprises:

Described all message classification rules are mapped to a series of hypermatrix in the hyperspace;

Make up described message classification decision tree according to described basic interval.

Wherein, obtain the step of described classification results, comprising according to described leaf node:

Judging whether described leaf node is empty, be that the then described sorter network message for the treatment of does not match any message classification rule, otherwise the message classification that is comprised in described leaf node rule is the described message classification rule for the treatment of that the sorter network message matches.

Compared with prior art, embodiments of the invention only use a spot of heuristic information at the building process of message classification decision tree, and are stronger to the applicability of various message classification regular collections.The constructed message classification decision tree number of plies of the embodiment of the invention is very little, message classification treatment effeciency height.Embodiments of the invention have effectively utilized the fast data buffer of modern CPU, have guaranteed the actual execution efficient that technical solution of the present invention is higher.Embodiments of the invention are also controlled the size of constructed message classification decision tree by a series of measures, improve and guaranteed the efficient of message classification.

Other features and advantages of the present invention will be set forth in the following description, and, partly from specification, become apparent, perhaps understand by implementing the present invention.Purpose of the present invention and other advantages can realize and obtain by specifically noted structure in specification, claims and accompanying drawing.

Description of drawings

Accompanying drawing is used to provide further understanding of the present invention, and constitutes the part of specification, is used from explanation the present invention with embodiments of the invention one, is not construed as limiting the invention.In the accompanying drawings:

Fig. 1 represents the schematic diagram of message classification rule for available technology adopting 2 dimension space rectangles;

Fig. 2 a is the composition schematic diagram of message classification decision-making constructing system embodiment of the present invention;

Fig. 2 b, 2c and 2d are the schematic flow sheet of message classification decision-making construction method embodiment of the present invention;

Fig. 3 a the present invention is based on the schematic flow sheet that recursive fashion makes up the message classification decision tree;

Fig. 3 b is the idiographic flow schematic diagram of step S320 shown in Fig. 3 a;

Fig. 4 the present invention is based on the schematic flow sheet that the task queue mode makes up the message classification decision tree;

Fig. 5 a is the composition schematic diagram of message classification system embodiment of the present invention;

Fig. 5 b is the schematic flow sheet of packet classification method embodiment of the present invention;

Fig. 6 a is the message classification schematic flow sheet that the present invention is based on the message classification decision tree;

Fig. 6 b is projection and the interval division schematic diagram of the corresponding rectangle of classifying rules shown in Figure 1 on X-axis;

Fig. 7 the present invention is based on the message classification regular collection tree structure schematic diagram that basic interval is divided;

Fig. 8 is tree structure schematic diagram between the Y dimension projected area of the corresponding message classification rule of leaf node shown in Figure 7 [0.2] subclass;

Fig. 9 is the message classification decision tree schematic diagram after leaf node shown in Figure 8 [0.2] further expands;

The complete message categorised decision tree schematic diagram of Figure 10 for making up based on message classification first example;

Figure 11 simplifies message classification decision tree schematic diagram afterwards to message classification decision tree shown in Figure 10;

Figure 12 among the present invention based on the message classification decision tree schematic diagram of message classification rule second example;

Figure 13 among the present invention based on another message classification decision tree schematic diagram of message classification rule second example;

Figure 14 the present invention is based on the message classification decision tree schematic diagram that message classification rule the 3rd example is constructed;

Figure 15 deletes repetition subtree message classification decision tree schematic diagram afterwards for the present invention;

Figure 16 merges message classification decision tree schematic diagram afterwards for the present invention carries out continuous child node.

Embodiment

Describe embodiments of the present invention in detail below with reference to drawings and Examples, how the application technology means solve technical problem to the present invention whereby, and the implementation procedure of reaching technique effect can fully understand and implements according to this.

Need to prove that if do not conflict, each feature among the embodiment of the invention and the embodiment can mutually combine, all within protection scope of the present invention.In addition, can in computer system, carry out in the step shown in the flow chart of accompanying drawing such as a set of computer-executable instructions, and, though there is shown logical order in flow process, but in some cases, can carry out step shown or that describe with the order that is different from herein.

Core concept of the present invention is to adopt in the art of mathematics to construct the message classification decision tree by the thought of dimension projection interval division, and carries out message classification according to the message classification decision tree that is constructed.

Specifically the whole set of all message classification rules is considered as a series of d dimension hypermatrix in the d dimension space, from the d dimension, select certain one dimension k, all d dimension hypermatrix are carried out projection on the k dimension, and according to the value of all message classification rules on the k dimension, obtain a series of tactic basic intervals, these basic intervals are divided k dimension codomain space fully; Coverage condition according to each message classification rule k territory span and each basic interval, each message classification rule is mapped in each basic interval (because the k territory span of each message classification rule may cover a plurality of basic intervals, therefore, each message classification rule may be mapped on a plurality of basic intervals), each message classification rule correspondence obtains a basic interval set, thereby will original message classification regular collection be decomposed into the regular subclass of message classification with quantity such as basic interval set; For each the message classification rule subclass that obtains, adopt recursive fashion or task queue mode, utilize by division methods between the dimension projected area and continue on other dimensions, to decompose, the message classification rule subclass that to the last obtains is for till all dimensions all are projected in empty or this message rule subclass, and acquisition can be used to carry out the message classification decision tree of message classification.

When concrete enforcement packet classification method of the present invention, can adopt recursion method to realize the structure of above-mentioned message classification decision tree, also can adopt the method for task queue to make up.

Fig. 2 a is the composition schematic diagram of message classification decision-making constructing system embodiment of the present invention.Shown in Fig. 2 a, this system embodiment mainly comprises mapping block 210, projection module 220 and structure module 230, wherein:

Mapping block 210 is used for all message classification rules are mapped to a series of hypermatrix of a hyperspace;

Projection module 220 links to each other with mapping block 210, is used in hyperspace, and a series of hypermatrix are pursued the dimension projection, obtains each hypermatrix tactic basic interval on each dimension of hyperspace;

Make up module 230, link to each other, be used for making up a message classification decision tree that is used to carry out message classification according to basic interval with projection module 220.

Shown in Fig. 2 a, above-mentioned projection module 220 comprises selected cell 221 and projecting cell 222, wherein:

Selected cell 221 links to each other with this mapping block 210, is used for not selecting one dimension to tie up as current goal in hyperspace is carried out the residue dimension of projection;

Projecting cell 222 links to each other with this selection module 221, is used for hypermatrix is carried out projection in the current goal dimension, obtains each hypermatrix tactic basic interval on the current goal dimension.

Shown in Fig. 2 a, above-mentioned structure module 230 comprises resolving cell 231, judging unit 232 and construction unit 233, wherein:

Resolving cell 231 links to each other with this projecting cell 222, is used for according to tactic basic interval, all message classification rules is decomposed into one or more message classification rule subclass on current goal dimension;

Judging unit 232 links to each other with this resolving cell 231, is used to judge whether message classification rule subclass is empty, and is used for judging that whether the message rule subclass all is projected in each dimension of hyperspace;

Construction unit 233, link to each other with this judging unit 232, be used for making up the message classification decision tree, and judge message classification rule subclass for empty or stop structure when on promising, all being projected, obtain a complete message classification decision tree at judging unit 232 according to message classification rule subclass.

Fig. 2 b is the schematic flow sheet of message classification decision-making construction method embodiment of the present invention.In conjunction with the system embodiment shown in Fig. 2 a, the method embodiment shown in Fig. 2 b mainly comprises the steps:

Step S210 is mapped to a series of hypermatrix in the hyperspace with all message classification rules;

Step S220 in hyperspace, pursues the dimension projection with a series of hypermatrix, obtains each hypermatrix tactic basic interval on each dimension of hyperspace;

Step S230 makes up a message classification decision tree that is used to carry out message classification according to basic interval.

Shown in Fig. 2 c, in hyperspace, pursue the step that the dimension projection obtains tactic basic interval, comprising:

Step S221 does not carry out selecting one dimension to tie up as current goal in the residue dimension of projection in hyperspace;

Step S222 carries out projection with hypermatrix in the current goal dimension, obtains each hypermatrix tactic basic interval on the current goal dimension.

Shown in Fig. 2 d, the step according to basic interval structure message classification decision tree comprises:

Step S231 according to tactic basic interval, is decomposed into all message classification rules one or more message classification rule subclass on current goal dimension;

Step S232 makes up the message classification decision tree according to message classification rule subclass;

Step S233 judges whether message classification rule subclass is empty, and is used for judging that whether the message rule subclass all is projected in each dimension of hyperspace;

Step S234 judges message classification rule subclass for empty or stop structure when being projected on promising, obtains a complete message classification decision tree.

For the ease of understanding message classification decision tree construction method of the present invention better and based on the packet classification method of decision tree, here at first provide the information that each node comprised in the decision tree, and then provide the construction method of message classification decision tree and carry out the realization flow of message classification based on the message classification decision tree.Need to prove that the definition of given decision tree nodes and decision tree structure flow process and message coupling (classification) flow process do not limit of the present invention other and implement selection here.

Each decision node can be described with following node (TNODE) structure in the message classification decision tree of the present invention, and the TNODE structure comprises following information:

(1) IsLeaf: Boolean, represent whether this node is leaf node;

(2) RestDims: the not projection dimension set relevant with TNODE;

(3) RuleSet: the message classification relevant rule subclass, expression with node when root node carries out message classification, the message classification regular collection that when matching this node, may mate;

(4) ProjectDim: the projection dimension of selecting when expanding this node;

(5) BasicIntervals: when this node is expanded on selected dimension, the head-end of tactic each basic interval that obtains after the projection; If this node is a leaf node, then this item is empty;

(6) Children: to this node after expanding on the selected dimension, the child node sequence that obtains corresponding to each tactic basic interval; If this node is a leaf node, then this item is empty.

For sake of convenience, for a message classification device that comprises n bar m dimension message classification rule, suppose that each dimension label is respectively X ₁, X ₂..., X _m, each message classification rule r in the message classification device ₁, r ₂..., r _nExpression; Certain message classification rule r _iThe span r of k dimension _i[k] expression.

Fig. 3 a the present invention is based on the schematic flow sheet that recursive fashion makes up the message classification decision tree.Shown in Fig. 3 a, this flow process mainly comprises the steps:

Step S310 constructs a decision tree DT who only comprises root node Root, and the residue dimension set (Root.RestDims) that root node Root is set is all projection dimension ({ X ₁, X ₂..X _m), i.e. Root.RestDims={X ₁, X ₂..X _m, the message classification rule subclass (Root.Ruleset) that root node Root is set is all message classification rule ({ r ₁, r ₂..., r _n), i.e. Root.Ruleset={r ₁, r ₂..., r _n, it is leaf node, i.e. Root.isLeaf=true that Root is set;

Step S320, traversal decision tree DT is to each leaf node V among the decision tree DT _iCarry out following operation: if its not projection dimension set (be expressed as V _i.RestDims) and message classification rule subclass (be expressed as V _i.RuleSet) be not empty, then to this leaf node V _iExpand, be this leaf node V _iGenerate a series of child node { N _j, and this leaf node V is set _iFor backbone node (is V _i.isLeaf=false);

Step S330, there is not such leaf node V in repeating step S320 in decision tree DT _i: V _iNot projection dimension set RestDims (being expressed as Vi.RestDims) and V _iMessage classification rule subclass RuleSet (being expressed as Vi.RuleSet) for empty; Last resulting decision tree DT is constructed message classification decision tree.

Shown in Fig. 3 b, among the above-mentioned steps S320 to leaf node V _iThe concrete steps of expanding comprise:

Step S321 is from leaf node V _iNot projection dimension set RestDims in select k dimension X _k

Step S322 is with leaf node V _iMessage classification rule subclass RuleSet in each message classification rule respectively at selected k dimension (X _k) on carry out projection, thereby obtain the basic interval S that d arranges in order _j(j=1,2 ..., d), this d basic interval is divided k dimension codomain fully; At last, according to basic interval set { S _jNode V is set _iBasic interval array V _i.BasicIntervals;

Step S323 is to leaf node V _iMessage classification rule subclass RuleSet in each message classification rule, according to resulting d basic interval S among this message classification rule k territory span and the step S322 _j(j=1..d) coverage condition is mapped to each message classification rule on the corresponding basic interval; At last, obtain d message classification rule subclass R _j(j=1,2 ..., d), each message classification rule subclass R wherein _jAll there is related basic interval S _j, this incidence relation is designated as two tuple { S _j, R _j, j=1 wherein, 2 ..., d;

Step S324 is respectively the d { S that obtains among the step S323 _j, R _jThe corresponding decision tree nodes U of establishment _j(j=1,2 ..., d), and node U is set _j.RestDims=V _i.RestDims-{X _k, U is set _j.RuleSet=R _jAt last, with d the decision tree nodes N that is created _jBe set to leaf node V _iThe next stage child node (by V _i.Children write down), and record node V _iProjection dimension V _i.ProjectDim=X _k

Fig. 4 makes up the schematic flow sheet of message classification decision tree for the present invention adopts the task queue mode.As shown in Figure 4, this flow process mainly comprises the steps:

Step S410, read in all message classification rule set AllRuleSet, structure decision tree root node Root, the message classification rule subclass Root.RuleSet=AllRuleSet (all message classification rules) of root node Root is set, the residue dimension set Root.RestDims={X of root node Root is set ₁, X ₂... X _m(the residue dimension set that is root node Root is for comprising the set of all projection dimensions);

Step S420 constructs one and treats expanding node formation Queue, the decision tree root node Root that constructs among the step S410 is placed into treats among the expanding node formation Queue then;

Step S430 takes out a pending node U from treat expanding node formation Queue, and takes out residue dimension set U.RestDims and the message classification rule subclass U.RuleSet of node U;

Step S440, (note is X to choose the k dimension from the residue dimension set U.RestDims of node U _k) as (being X when front projection dimension _k), and U.ProjectDim=X is set _k

Step S450 carries out projection with each rule among the message classification rule subclass U.RuleSet of node U, thereby obtains d tactic basic interval S set on selected k dimension _j(j=1,2 ..., d), and according to basic interval set { S _jThe basic interval array U.BasicIntervals of node U is set;

Step S460 is for each element S in the basic interval S set _j, for node U creates corresponding child node V _j, and child node V is set _jResidue dimension set V _j.RestDims=U.Restdims-{X _k, child node V is set _jMessage classification rule subclass

(r is for not only belonging to its k dimension integer range of node U message classification rule subclass while but also covering child node V _jCorresponding basic interval S _iThe message classification rule);

Step S470 is for each the child node V that creates among the step S460 _j, judge this child node V _jResidue dimension set V _j.RestDims with message classification rule subclass V _j.Ruleset value condition: if V _j.RestDims and V _j.RuleSet there is one to be empty set, then changes step S480, otherwise change step S485;

Step S480 is provided with this child node V _jBe leaf node, change step S490 and continue to carry out;

Step S485 is with this child node V _jBe placed into and treat among the expanding node formation Queue, change step S490 and continue to carry out;

Step S490 judges and treats whether expanding node formation Queue is empty, if be empty, then changes step S495, continues to carry out otherwise change step S430;

Step S495, the message classification decision tree that output is constructed is finished.

Fig. 5 a is the composition schematic diagram of message classification system embodiment of the present invention.Shown in Fig. 5 a, this system embodiment mainly comprises receiver module 510, sort module 520 and output module 530, wherein:

Receiver module 510 is used for receiving and treats the sorter network message;

Sort module 520, link to each other with receiver module 510, be used for from the root node of a message classification decision tree that makes up according to all message classification rules, treat the sorter network message according to the node successively of message classification decision tree and classify, stop classification when obtaining the leaf node of message classification decision tree;

Output module 530 links to each other with sort module 520, is used for obtaining to treat the classification results of sorter network message and export according to leaf node.

Above-mentioned output module 530 is used to judge whether leaf node is empty, be to treat that then the sorter network message does not match any message classification rule, otherwise the message classification that is comprised in leaf node rule is for treating the message classification rule that the sorter network message matches.

Fig. 5 b is the schematic flow sheet of packet classification method embodiment of the present invention.In conjunction with the system embodiment shown in Fig. 5 a, the method embodiment shown in Fig. 5 b mainly comprises the steps:

Step S510 receives and treats the sorter network message;

Step S520 from the root node according to the regular message classification decision tree that makes up of all message classifications, treats the sorter network message according to the node successively of message classification decision tree and classifies;

Step S530 stops classification when obtaining the leaf node of message classification decision tree;

Step S540 obtains to treat the classification results and the output of sorter network message according to leaf node.

Wherein, the process according to all message classification rule structure message classification decision trees sees also the method embodiment shown in the system embodiment shown in Fig. 2 a and Fig. 2 b.

Above-mentioned leaf node obtains the process of classification results, can be to judge whether leaf node is empty, be to treat that then the sorter network message does not match any message classification rule, otherwise the message classification that is comprised in leaf node rule is for treating the message classification rule that the sorter network message matches.

After Fig. 6 a finishes for network message categorised decision tree makes up, based on the message classification schematic flow sheet of message classification decision tree.Shown in Fig. 6 a, this message classification flow process mainly comprises the steps:

Step S610 receives and treats sorter network message P, present node (being expressed as C) is set is the root node Root of message classification decision tree DT;

Step S620 judges whether present node C is leaf node, and being then changes step S650, otherwise changes step S630;

Step S630 determines that (being C.ProjectDim) tieed up in the projection of present node C, and the basic interval array (C.BasicIntervals) of definite present node C and child node array (C.Children);

Step S640, projection dimension (C.ProjectDim) according to present node C, from treat sorter network message P, take out corresponding to the integer value I on the projection dimension, and determine basic interval under the integer value I according to the basic interval array (C.BasicIntervals) of present node C, present node C is set to the pairing child node of basic interval under the integer I, with this child node as present node C and forward step S620 to and carry out;

Step S650, message classification rule subclass (C.RuleSet) among the output present node C, message classification among present node C rule subclass (C.RuleSet) the message classification rule that message P successfully mate that is and waits to classify: if the message classification of present node C rule subclass is not a sky, represent that this network message and some network message classifying rules successfully mate, otherwise expression treats that the sorter network message does not match any message classification rule.

Below how to make up the message classification decision tree by dimension projection interval division thought with describing in detail for example shown in the table 2 based on of the present invention.

Each message classification rule comprises two dimension: X and Y in above-mentioned first example, each 2 dimensional plane rectangle that these message classification rules are corresponding shown in Figure 1.Shown in Fig. 6 b, at first each rectangle shown in Figure 1 is carried out the projection of X dimension, and according to the value at each rectangle two ends on X-axis, obtain 6 basic intervals (basic interval is represented with the semi-closure half open interval in the algebraically), they are respectively: [0,1), [1,2), [2,5), [5,6), [6,7), [7,8), these 6 basic intervals are tieed up codomain space ([0,8) with X) carry out one and divide fully.

Coverage condition according to each message classification rule X territory span and these basic intervals, successively each message classification rule in above-mentioned first example is mapped in these 6 basic intervals, thereby all the message classification regular collections in above-mentioned first example are decomposed into 6 message classification rule subclass relevant with basic interval.The pairing message classification rule of each basic interval subclass is:

X territory first basic interval [0,1): { R3, R5}

X territory second basic interval [1,2): { R1, R3, R5}

X territory the 3rd basic interval [2,5): { R1, R2, R3, R5}

X territory the 4th basic interval [5,6): { R1, R2, R3, R4, R5}

X territory the 5th basic interval [6,7): { R2, R3, R4, R5}

X territory the 6th basic interval [7,8): { R2, R3, R5}

Fig. 7 the present invention is based on the message classification regular collection tree structure schematic diagram that basic interval is divided.As shown in Figure 7, it is exactly a decision tree that above-mentioned first example is tieed up the tree structure figure that obtains after the projection interval division actual based on X, and still, this decision tree is also imperfect, needs to continue growth downwards, also promptly needs continuation that the message classification rule is continued to divide.

In the following description, need quote certain node in the decision tree (comprising internal node and leaf node), for sake of convenience, take here a kind ofly to be similar to MIB (Management Information Base, MIB) Shu node quoting method is quoted each node in the decision tree.

Suppose:

The quotation mark of (1) decision tree nodes is for to begin to the pairing numbered sequence of the sequence node of present node from root node;

(2) belong to the method for numbering serial of each child node of same father node for from left to right, since 0 number consecutively;

(3) root node in the decision tree is represented with symbol [0];

The 2nd child node of the root node in the decision tree like this, shown in Figure 7 represented with symbol [0.1].

Message classification decision tree shown in Figure 7 is not a complete decision tree, also needs the represented message classification rule subclass of each leaf node in this decision tree is carried out the projection interval division in the Y dimension, thereby forms last message classification decision tree.

Here be example with the pairing message classification rule of the leaf node [0.2] in the described decision tree of Fig. 7 (i.e. the 3rd leaf node) subclass, the Y that is described in detail this message classification rule subclass ties up partition process between projected area.As shown in Figure 8, leaf node [0.2] pairing comprising { R1, R2, R3, R5}, after the pairing rectangle of each message classification rule carries out the Y-axis projection in should gathering, obtain 5 basic intervals, they are: [0,2), [2,3), [3,5), [5,7) and [7,8).According to message classification rule subclass { R1, R2, R3, the coverage condition of the Y territory span of each message classification rule and these 5 basic intervals among the R5}, successively each message classification rule is mapped in these 5 basic intervals, thereby the pairing message classification rule of the leaf node among Fig. 7 [0.2] subclass is decomposed into 5 message classification rule subclass relevant with basic interval.The pairing message classification rule of each basic interval subclass is:

Y territory first basic interval [0,2): { R5}

Y territory second basic interval [2,3): { R1, R5}

Y territory the 3rd basic interval [3,5): { R1, R2, R5}

Y territory the 4th basic interval [5,7): { R1, R3, R5}

Y territory the 5th basic interval [7,8): { R3, R5}

Fig. 8 represented with leaf node among Fig. 7 [0.2] corresponding message classification rule subclass carry out the decomposable process of Y dimension projection interval division, can expand by decision tree nodes and represent, thereby obtain as shown in Figure 9 message classification decision tree.Need to prove that the decision tree shown in Fig. 9 still is not a complete message classification decision tree, also needs further expansion.

In the decision tree shown in Figure 9, pairing 5 leaf nodes of internal node [0.2] [0.2.0], [0.2.1], [0.2.2], [0.2.3] and [0.2.4] pairing message classification rule subclass have all been finished at X, the projection of Y dimension, therefore, need not once more the pairing message classification rule of these 5 leaf nodes subclass to be carried out projection has decomposed.

Next, 5 leaf nodes [0.0] among Fig. 9, [0.1], [0.3], [0.4] and [0.5] pairing message classification rule subclass are carried out Y dimension projection interval division, thereby obtain complete message classification decision tree as shown in figure 10.

In complete message categorised decision tree shown in Figure 10, a lot of leaf nodes all comprise many message classification rules, this illustrates that there is overlapping space in defined some classifying rules of calling the score in above-mentioned first example, and this can find out from 2 dimension space figure shown in Figure 1.Such as, in the message classification decision tree shown in Figure 10, leaf node [0.0.1] comprises R3 and two message classification rules of R5, begin the projection basic interval sequence that to the path of leaf node [0.0.1], marked as can be seen from the decision tree root node of Figure 10, the represented rectangle of R3 and R5 is at X=[0,1) and Y=[5,8) overlapping in the rectangle that is limited.Also as can be seen, these two message classification rules of R3 and R5 are at X=[0 from Fig. 1,1) in the rectangle that is limited space overlap appears and Y=[5,8).

In the message classification process, the aforesaid overlapping space if the represented point of certain network message just in time falls is such as dropping on X=[0,1) and Y=[5,8) in the rectangle that is limited, then need determine return results according to the priority relationship between the message classification rule:

(1) if the priority between each message classification rule is equal, then should simultaneously R3 and R5 be returned as matching result;

(2) if there is strict priority orders between each message classification rule, then general need be returned R3 as matching result, because the priority of R3 is higher than R5.

If consider the priority orders of strict difinition between the message classification rule, message classification rule decision tree then shown in Figure 10 can be reduced to message classification decision tree as shown in figure 11.

After having set up the message classification decision tree, carry out the message classification process according to this message classification decision tree and mainly comprise: begin coupling from the decision tree root node, successively carry out judging, till searching leaf node based on the basic interval of specifying dimension; After search stops, if comprise the message classification rule in the leaf node, then the contained message classification rule of this leaf node is the message classification rule for the treatment of that the sorter network message is matched, if no message classification rule in the leaf node represents that then this network message does not match any message classification rule.

Illustrate how to carry out the network message classification with concrete network message example now based on message classification decision tree shown in Figure 11.

Network message 1 (P1): X=4, Y=7

At first the root node [0] from decision tree shown in Figure 11 begins retrieval, owing to carried out X dimension projection interval division at the root node place, therefore, at first needs to determine the affiliated basic interval of X thresholding of network message 1.

Because the value in the X territory of network message 1 is 4, it with basic interval [2,5) mate, therefore, matching process advances to node [0.2].

Owing to locate to have carried out Y dimension projection interval division at node [0.2], therefore need to determine the affiliated basic interval of Y thresholding of network message 1, because the value in the Y territory of network message 1 is 7, it and basic interval [7,8) coupling, therefore, matching process advances to node [0.2.4].

Because node [0.2.4] is a leaf node, therefore, the message classification process stops.Since comprise message classification rule R3 in this leaf node, therefore, network message 1 and message classification rule 3 couplings.

Network message 2 (P2): X=3, Y=6

At first the decision tree root node from Figure 11 begins retrieval, owing to locate to have carried out X dimension projection interval division at root node [0], therefore, at first needs to determine the affiliated basic interval of X thresholding of network message 2.

Because the value in the X territory of network message 2 is 3, it with basic interval [2,5) mate, therefore, matching process advances to node [0.2].

Owing to locate to have carried out Y dimension projection interval division at node [0.2], therefore need to determine the affiliated basic interval of Y thresholding of network message 2, because the Y thresholding of network message 2 is 6, it and basic interval [5,7) coupling, therefore, matching process advances to node [0.2.3].

Because node [0.2.3] is a leaf node, the message classification process finishes, and the message classification rule R1 that this leaf node comprised is the message classification rule of coupling.

Network message 3 (P3): X=1, Y=1

At first begin retrieval,, therefore, at first need to determine the affiliated basic interval of X thresholding of network message 3 owing to locate to have carried out X dimension projection interval division at root node [0] from the decision tree root node shown in Figure 11.

Because the X thresholding of network message 3 is 1, it with basic interval [1,2) mate, therefore, matching process advances to node [0.1].

Owing to locate to have carried out Y dimension projection interval division at node [0.1], therefore need to determine the affiliated basic interval of Y thresholding of network message 3, because the Y thresholding of network message 3 is 1, it and basic interval [0,2) coupling, therefore, matching process proceeds to node [0.1.0].

Because node [0.1.0] is a leaf node, the message classification process finishes, and the message classification rule R5 that this leaf node comprised is the message classification rule of coupling.

Find out from above-mentioned network message assorting process based on the message classification decision tree, root node from decision tree, all need to solve a basic interval orientation problem at each internal node place, be given n continuous tactic basic interval and integer value, need to judge fast the basic interval that this integer value is affiliated.When specifically implementing this method, can adopt following several method to solve the basic interval orientation problem:

(1) sequential search method: all basic intervals of sequential scanning from left to right, till finding the basic interval that mates to integer with institute.Such as the basic interval orientation problem at root node place among Figure 11, it is given 6 continuous basic intervals: [0,1), [1,2), [2,5), [5,6), [6,7), [7,8), suppose the basic interval that needs under the location integer 4, then can from left to right scan these basic intervals, when scan the 3rd basic interval [2,5) time, find that integer 4 belongs to this basic interval, therefore, the search end also draws Search Results.The preferably time of searching of sequential search method is 1, and the worst time of searching is basic interval quantity n, and average search time is n/2.The space expense of sequential search method is n.

(2) binary search: order is extracted the head-end or the distal point of the individual basic interval continuously of n and is formed an array, adopts the binary search affiliated basic interval of the given integer in location fast then.Such as the basic interval orientation problem at root node place among Figure 11, it is given 6 continuous basic intervals: [0,1), [1,2), [2,5), [5,6), [6,7), [7,8), at first extract these 6 basic interval distal points and form an array, it comprises 6 values { 1,2,5,6,7,8}, suppose the basic interval that needs under the location integer 3, by binary search can know very soon with the basic interval of integer 3 couplings for [2,5).The preferably time of searching of binary search is 1, and average search time is logn, and space expense is n.

(3) quick look-up table: make a form in advance, this form includes 2^k element, and (k is the maximum number bits of these basic interval institute corresponding domain, such as, the X of described above-mentioned first example of table 2 and the maximum number bits in Y territory all are 3), each lattice in the form have been stored the numbering (since 0) of the affiliated basic interval of cell subscript value.Such as the basic interval orientation problem at root node place among Figure 11, it is given 6 continuous basic intervals: [0,1), [1,2), [2,5), [5,6), [6,7), [7,8), these basic interval institute corresponding domain are the X territory, and its maximum number bits is 3, therefore, the form that to make a size in advance be 8 (2^3) is referring to table 3 as follows.For given integer 3, can be numbered 2 then by the basic interval that draws fast with its coupling of tabling look-up.Best, the worst and average search time of look-up table is 1 fast, and space expense is 2^k (k is the maximum number bits of domain space).

Table 3, Fast Lookup Table example

The form subscript	?0	1	2	3	4	5	6	7
									Interval numbering	?0	1	2	2	2	3	4	5

When the specific implementation technical solution of the present invention, can come freely to select this three kinds of basic interval localization methods as required, technical solution of the present invention can also adopt other localization methods certainly, realizes the location of basic interval.The present invention preferably carries out adaptively selected according to the concrete condition of each internal node of decision tree, detailed process is as follows:

(1) if the pairing basic interval number of certain internal node is less than 10, then adopts the sequential search method;

(2) if the pairing basic interval number of certain internal node is far longer than 10, then adopt binary search;

(3) because memory space that look-up table consumes is bigger fast, therefore suggestion is only adopted quick look-up table at decision tree root node place.

Make up the memory headroom that the categorised decision tree is consumed in order to reduce, the present invention can adopt following measure to carry out the optimization of technical solution of the present invention, concrete measure comprises selects optimum projection dimension sequence, deletion to repeat subtree and merge continuous fundamental space, below specifies.

(1) selects optimum projection dimension order

When a certain message classification rule subclass being pursued the division of dimension projector space at every turn, need carry out projection one by one to remaining each dimension, though no matter select which projection dimension order can obtain a complete message classification decision tree, but the selection of projection dimension order can have influence on the size to whole message classification decision tree.

By relatively finding, if when message classification rule subclass is pursued dimension projection interval division, from remain unallocated dimension, select a dimension that can obtain as far as possible evenly dividing to carry out projector space as far as possible and divide, then can be so that the message classification decision tree that makes up is littler.Such as, be that message classification as shown in table 4 rule second example is when making up decision tree, can take the dividing method between the dimension projected area that pursues of " first X ties up the Y dimension again " and " first Y ties up the X dimension again " respectively, but, the decision tree size that these two kinds of methods obtain is different: adopting the node number by tieing up the decision tree that division methods obtains between projected area of " first X ties up Y again and ties up " is 16 nodes (as shown in figure 12), is 23 nodes (as shown in figure 13) and adopt the node number by tieing up the decision tree that dividing method obtains between projected area of " first Y ties up the X dimension again ".

For certain decision tree nodes V to be expanded, suppose that its message classification rule subclass (V.Ruleset) is { r ₁, r ₂.., r ₁, its residue dimension set (V.RestDims) is { X ₁, X ₂..X _t; the present invention adopts following method to select the best projection dimension: each message classification rule in the message classification rule subclass (V.RuleSet) of node V is carried out projection respectively on each dimension of residue dimension set (V.RestDims); the dimension that can access maximum basic intervals is optimum projection dimension (if more than projection dimension all can obtain maximum basic intervals, then the optimum projection of an optional conduct is tieed up from these projection dimensions).

Table 4, message classification rule second example

Rule numbers	X territory span	Y territory span	Rule priority
				R1	[1，4]	[4，6]	1
R2	[2，4]	Arbitrary value	2
				R3	[5，7]	[5，7]	3
R4	[5，6]	Arbitrary value	4

(2) deletion repeats subtree

When adopting the present invention to make up the message classification decision tree, identical subtree can appear in the part situation in the constructed decision tree.Such as, the message classification decision tree that constructs based on the rule of message classification shown in the table 5 the 3rd example as shown in Figure 14 just can find that there are two groups of identical subtrees in this tree, they are respectively:

(1) with node [0.0] and node [0.4] is the two stalks tree of root;

(2) with node [0.1] and node [0.3] be the two stalks tree of root.

For saving the memory space of message classification decision tree, the subtree that can delete these repetitions fully adopts the cross reference pointer to point to remaining unique subtree to simplify whole message classification decision tree then.As shown in figure 15, the decision tree that deletion repeats subtree logically remains a complete message classification decision tree, but compares message classification decision tree shown in Figure 14, and it has obviously reduced the memory space of message classification decision tree.

Table 5, message classification rule the 3rd example

Rule numbers	X territory span	Y territory span	Rule priority
				R1	[1，5]	[4，6]	1
R2	[2，3]	Arbitrary value	2
				R3	[1，5]	[5，7]	3
R4	Arbitrary value	Arbitrary value						4

(3) merge continuous fundamental space

For one group of continuous child node under the same internal node, the first and last end points that is the basic interval in this group child node forms continuously, can unite and form a big basic interval, if the message classification that the continuous child node of this group is comprised rule subclass is just the same, then can merge this two child nodes, thereby simplify the message classification decision tree.

Such as, just there are three groups of continuous child nodes in the message classification decision tree based on above-mentioned first example shown in Figure 11, is respectively:

(1) [0.1.1] and [0.1.2];

(2) [0.2.1], [0.2.2] and [0.2.3];

(3) [0.3.1], [0.3.2] and [0.3.3].

After these continuous child nodes are merged, obtain the message classification decision tree behind the abbreviation as shown in figure 16.

The present invention only uses a spot of heuristic information (promptly selecting the best projection dimension from the set of residue dimension) at the building process of message classification decision tree, so the inventive method is stronger to the applicability of various message classification regular collections.

The constructed message classification decision tree number of plies of the present invention is very little, and is at most identical with the territory quantity of message classification rule.Therefore a message classification process at most only needs the execution basic interval location number of times identical with the territory quantity of message classification rule just can finish classification, the treatment effeciency height.

When carrying out the basic interval location among the present invention, the head-end of related tactic each basic interval that obtains projection dimension upslide movie queen is a continuous and less data space, therefore, technical solution of the present invention can effectively utilize the fast data buffer of modern CPU, has guaranteed the actual execution efficient that technical solution of the present invention is higher.

The present invention can control the size of constructed message classification decision tree by a series of measures measures such as (deletion repeat) subtrees, thereby has guaranteed constructed message classification decision tree to be unlikely to expand too much and influence the efficient of message classification.

The present invention adopts the decision tree thought in the data mining to realize the structure of message classification rule, and carry out message classification according to the decision tree that makes up, thereby greatly improved the speed of message classification, experiment test is the result show: under similarity condition, when surpassing hundred message classification rules, message classification of the present invention is consuming time be conventional linear search sorting technique consuming time 1/80 to 1/50, significantly improved the classification effectiveness of network message.

Need to prove, can in computer system, carry out in the step shown in the flow chart of accompanying drawing such as a set of computer-executable instructions, and, though there is shown logical order in flow process, but in some cases, can carry out step shown or that describe with the order that is different from herein.In addition, those skilled in the art should be understood that, above-mentioned each module of the present invention or each step can realize with the general calculation device, they can concentrate on the single calculation element, perhaps be distributed on the network that a plurality of calculation element forms, alternatively, they can be realized with the executable program code of calculation element, thereby, they can be stored in the storage device and carry out by calculation element, perhaps they are made into each integrated circuit modules respectively, perhaps a plurality of modules in them or step are made into the single integrated circuit module and realize.Like this, the present invention is not restricted to any specific hardware and software combination.

Though the disclosed execution mode of the present invention as above, the execution mode that described content just adopts for the ease of understanding the present invention is not in order to limit the present invention.Technical staff in any the technical field of the invention; under the prerequisite that does not break away from the disclosed spirit and scope of the present invention; can do any modification and variation what implement in form and on the details; but scope of patent protection of the present invention still must be as the criterion with the scope that appending claims was defined.

Claims

1. a message classification decision-making constructing system is characterized in that, comprising:

2. system according to claim 1 is characterized in that, described projection module comprises:

3. system according to claim 2 is characterized in that, described structure module comprises:

4. a message classification decision-making construction method is characterized in that, comprising:

5. method according to claim 4 is characterized in that, carries out the described step that the dimension projection obtains described tactic basic interval of pursuing in described hyperspace, comprising:

6. method according to claim 5 is characterized in that, makes up the step of described message classification decision tree according to described basic interval, comprising:

7. a message classification system is characterized in that, comprising:

Receiver module is used for receiving and treats the sorter network message;

8. system according to claim 7 is characterized in that:

Described output module is used to judge whether described leaf node is empty, be that the then described sorter network message for the treatment of does not match any message classification rule, otherwise the message classification that is comprised in described leaf node rule is the described message classification rule for the treatment of that the sorter network message matches.

9. a packet classification method is characterized in that, comprising:

The sorter network message is treated in reception;

10. method according to claim 9 is characterized in that, the step according to the described message classification decision tree of described all message classification rule structures comprises:

11. method according to claim 9 is characterized in that, obtains the step of described classification results according to described leaf node, comprising: