CN103888321B - Dataflow detecting method and multi-core processing device - Google Patents
Dataflow detecting method and multi-core processing device Download PDFInfo
- Publication number
- CN103888321B CN103888321B CN201410148517.5A CN201410148517A CN103888321B CN 103888321 B CN103888321 B CN 103888321B CN 201410148517 A CN201410148517 A CN 201410148517A CN 103888321 B CN103888321 B CN 103888321B
- Authority
- CN
- China
- Prior art keywords
- data flow
- chain table
- ltsh chain
- node
- kernel processes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention provides a dataflow detecting method based on a multi-core processing device. The multi-core processing device has the ability of concurrently processing million-level dataflow. The method comprises the step of establishing Hash chain tables corresponding all core processing units in the multi-core processing device according to the processing ability of the multi-core processing device and the current detecting task, wherein nodes in the Hash chain tables are used for buffering dataflow in a backbone network corresponding to the current task in real time, and the dataflow buffered by all nodes is different; the step of executing the aging process on the Hash chain tables corresponding to the core processing units in a concurrent processing mode according to the LRU mechanism; the step of determining the dataflow buffered by the aged Hash chain tables as the active flow. According to the dataflow detecting method, the processing speed is improved, and therefore the active flow can be detected in real time, and the requirement for the real-time performance in detecting the active flow in the backbone network can be met.
Description
Technical field
The application is related to computer network field, more particularly to a kind of data-flow detection method and multinuclear processing equipment.
Background technology
In high-speed backbone network, data arrive in the way of one or more flows, and the definition flowed here is still general meaning
The stream of the lower five-tuple definition of justice, i.e., defined, identical five-tuple by source IP, purpose IP, source port, destination interface and protocol type
Data are to be considered as same data flow.Because online dynamic dataflow continually arrives, and if can not be in time to effective
Data Stream Processing, then the data flow can disappear at once, the requirement of real-time needs a kind of data run on internal memory of design
Stream detection algorithm.In backbone network, Small Sample Database stream existence time is shorter, does not possess researching value, and high amount of traffic is present
Time is long, is the major part of network service, the real-time detection to enlivening high amount of traffic, believes for optimization of network performance and network
Breath treatment has very important significance.
At present, there is a kind of data-flow detection method based on filtering in the real-time detection method for enlivening high amount of traffic.Base
In the data-flow detection method of filtering, typically in the case of laboratory flow is less, packet can packet-by-packet be adjudicated,
But backbone network is generally 10G express networks, the demand that there is real-time, the data-flow detection method based on filtering is but difficult to full
The real-time demand of sufficient backbone network.
The content of the invention
In order to solve the above technical problems, the embodiment of the present application provides a kind of data-flow detection method and multinuclear processing equipment,
To reach raising processing speed, realize that real-time detection goes out active stream, disclosure satisfy that the real-time of detection active stream in backbone network
It is required that purpose, technical scheme is as follows：
A kind of data-flow detection method, based on multinuclear processing equipment, the multinuclear processing equipment possesses concurrent processing million
The disposal ability of DBMS stream, methods described includes：
It is every in the structure multinuclear processing equipment for the disposal ability and current detection task of the multinuclear processing equipment
Individual each self-corresponding ltsh chain table of kernel processes unit, the node in the ltsh chain table is used to cache the current detection in real time
The data flow in backbone network corresponding to task, and the data flow that each node is cached is different；
In the way of concurrent processing, each kernel processes unit is performed using least recently used LRU mechanism to respective
Ltsh chain table carries out the process of burin-in process；
It is determined that by data flow the enlivening corresponding to current detection task that the ltsh chain table after burin-in process is cached
Stream.
Preferably, in the disposal ability and current detection task for the multinuclear processing equipment, build described many
In core processing equipment before each self-corresponding ltsh chain table of each kernel processes unit, also include：
In the way of concurrent processing, each kernel processes unit is advised using combined filtration in performing the multinuclear processing equipment
Then carry out the process of active stream detection；
Wherein, any one kernel processes unit is included using the process that combined filtration rule carries out active stream detection：
Whether the length that the kernel processes unit judges newly arrive data flow meets preset length scope；
If so, determining that described is newly active stream to data flow；
If it is not, newly whether meeting five-tuple filtering rule to data flow described in the kernel processes unit judges；
If so, determining that described is newly active stream to data flow；
If it is not, newly whether meeting keyword filtering rule to data flow described in the kernel processes unit judges；
If so, determining that described is newly active stream to data flow；
If it is not, triggering the multinuclear processing equipment performs the disposal ability for being directed to the multinuclear processing equipment, build described
In multinuclear processing equipment the step of each self-corresponding ltsh chain table of each kernel processes unit.
Preferably, any one kernel processes unit carries out the process of burin-in process using LRU mechanism to its ltsh chain table,
Including：
A, to newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained as keyword, in the ltsh chain table
In search whether there is the corresponding node of the cryptographic Hash, if so, perform step B, if it is not, performing step C；
B, the nodal information for updating the cryptographic Hash corresponding node, and the cryptographic Hash corresponding node is placed in the ltsh chain table
Foremost；
C, judge with the presence or absence of idle node in the ltsh chain table, if so, performing step D, otherwise, perform step E；
D, choose an idle node and deposit the cryptographic Hash, and by the idle node be placed in the ltsh chain table most before
End；
E, the node for deleting the afterbody for being located at the ltsh chain table, discharge chain table space and deposit the cryptographic Hash, and should
The corresponding node of cryptographic Hash is placed in the ltsh chain table foremost.
Preferably, the length for newly arriving data flow in the kernel processes unit judges whether meet preset length scope it
Before, also include：
The kernel processes unit is by a kind of data transfer model POS of use optical fiber of 10G（Packet Over SDH,）
The new of form is changed to 10G Ethernets ETH to stream compression（Ethernet, Ethernet）Data flow is arrived in the new of form.
Preferably, to before newly carrying out cryptographic Hash calculating to data flow, also including：
The new of 10G POS forms is changed to the new to data of 10G ETH forms by the kernel processes unit to stream compression
Stream.
Preferably, the process to newly carrying out cryptographic Hash calculating to data flow, including：
Using the strong hash function of randomness to newly carrying out cryptographic Hash calculating to data flow.
A kind of multinuclear processing equipment, the multinuclear processing equipment possesses the disposal ability of the DBMS stream of concurrent processing million,
The multinuclear processing equipment includes：
Module is built, for disposal ability and current detection task for the multinuclear processing equipment, is built described many
Each self-corresponding ltsh chain table of each kernel processes unit in core processing equipment, the node in the ltsh chain table is used for slow in real time
Data flow in the backbone network corresponding to the current detection task is deposited, and the data flow that each node is cached is different；
First control module, in the way of concurrent processing, performing each kernel processes unit using LRU mechanism to each
From ltsh chain table carry out the process of burin-in process；
Determining module, the data flow for determining to be cached by the ltsh chain table after burin-in process is current detection task
Corresponding active stream；
Multiple kernel processes units, the kernel processes unit is used to carry out respective ltsh chain table using LRU mechanism
Burin-in process.
Preferably, also include：
Second control module, in the way of concurrent processing, performing each kernel processes in the multinuclear processing equipment
Unit carries out the process of active stream detection using combined filtration rule；
Wherein, the kernel processes unit includes：
First judgment sub-unit, for judging whether the length for newly arriving data flow meets preset length scope, if so, performing
Determination subelement, if it is not, performing the second judgment sub-unit；
The determination subelement, for determining that described is newly active stream to data flow；
Second judgment sub-unit, for judge it is described it is new whether meet five-tuple filtering rule to data flow, if so,
Determination subelement is performed, if it is not, performing the 3rd judgment sub-unit；
3rd judgment sub-unit, for judge it is described it is new whether meet keyword filtering rule to data flow, if so,
The determination subelement is performed, if it is not, performing triggering subelement；
The triggering subelement, the structure module is performed for triggering the multinuclear processing equipment.
Preferably, the kernel processes unit includes：
Search subelement, for newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained as keyword,
Search whether there is the corresponding node of the cryptographic Hash in the ltsh chain table, if so, perform that subelement is updated, if it is not, performing the
Four judgment sub-units；
The renewal subelement, the nodal information for updating the cryptographic Hash corresponding node, and cryptographic Hash correspondence is saved
Point is placed in the ltsh chain table foremost；
4th judgment sub-unit, for judging to whether there is idle node in the ltsh chain table, if so, performing choosing
Subelement is taken, if it is not, perform deleting subelement；
The selection subelement, deposits the cryptographic Hash, and the idle node is placed in into institute for choosing an idle node
State ltsh chain table foremost；
The deletion subelement, the node for deleting the afterbody positioned at the ltsh chain table, discharges chain table space and deposits
The cryptographic Hash is put, and the corresponding node of the cryptographic Hash is placed in the ltsh chain table foremost.
Preferably, the kernel processes unit includes：
Conversion subunit, for the new of 10G POS forms to be changed into the new to data of 10G ETH forms to stream compression
Stream.
Compared with prior art, the application has the beneficial effect that：
The data-flow detection method that the application is provided relies on the disposal ability for possessing the DBMS stream of concurrent processing million, has
Body is embodied as：For the disposal ability and current detection task of the multinuclear processing equipment, in the structure multinuclear processing equipment
Each self-corresponding ltsh chain table of each kernel processes unit, the node in the ltsh chain table is used to cache the current inspection in real time
Data flow corresponding to survey task, and the data flow that each node is cached is different；In the way of concurrent processing, to each
The respective ltsh chain table of kernel processes unit carries out LRU mechanism burin-in process；It is determined that by the Hash after LRU mechanism burin-in process
The data flow that chained list is cached is active stream.
Because the mode for using concurrent processing carries out LRU mechanism to each respective ltsh chain table of kernel processes unit
Burin-in process, therefore LRU mechanism burin-in process concurrently can be carried out to multiple ltsh chain tables, concurrently determine multiple ltsh chain table institutes
The data flow of caching is active stream, compared to the mode for processing one by one, processing speed is improve, it is achieved thereby that real-time detection goes out
Active stream, disclosure satisfy that the requirement of real-time of detection active stream in backbone network.
Brief description of the drawings
In order to illustrate more clearly of the technical scheme in the embodiment of the present application, below will be to make needed for embodiment description
Accompanying drawing is briefly described, it should be apparent that, drawings in the following description are only some embodiments of the present application, for
For those of ordinary skill in the art, without having to pay creative labor, it can also be obtained according to these accompanying drawings
His accompanying drawing.
Fig. 1 is a kind of flow chart of the data-flow detection method that the application is provided；
Fig. 2 is another flow chart of the data-flow detection method that the application is provided；
Fig. 3 is a kind of sub-process figure of the data-flow detection method that the application is provided；
Fig. 4 is another sub-process figure of the data-flow detection method that the application is provided；
Fig. 5 is a kind of structural representation of the multinuclear processing equipment that the application is provided；
Fig. 6 is another structural representation of the multinuclear processing equipment that the application is provided；
Fig. 7 is a kind of structural representation of the kernel processes unit that the application is provided；
Fig. 8 is another structural representation of the kernel processes unit that the application is provided.
Specific embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present application, the technical scheme in the embodiment of the present application is carried out clear, complete
Site preparation is described, it is clear that described embodiment is only some embodiments of the present application, rather than whole embodiments.It is based on
Embodiment in the application, it is every other that those of ordinary skill in the art are obtained under the premise of creative work is not made
Embodiment, belongs to the scope of the application protection.
The data-flow detection method that the application is provided, based on multinuclear processing equipment, wherein, the multinuclear processing equipment possesses
The disposal ability of the DBMS stream of concurrent processing million.In this application, the multiple processing equipment can with but be not limited to 32
Core processing equipment.
Embodiment one
Fig. 1 is referred to, a kind of flow chart of the data-flow detection method that the application is provided is shown, following step can be included
Suddenly：
Step S11：For the disposal ability and current detection task of the multinuclear processing equipment, the multinuclear treatment is built
Each self-corresponding ltsh chain table of each kernel processes unit in equipment.
In the present embodiment, the node in the ltsh chain table is used to cache in real time corresponding to the current detection task
Data flow in backbone network, and the data flow that each node is cached is different.
With the number in the backbone network corresponding to current detection task during the data flow that the node in ltsh chain table is cached
Change according to the change of stream.
The device for multi-core is directed to the disposal ability and current detection task of itself, in the structure multinuclear processing equipment
Each self-corresponding ltsh chain table of each kernel processes unit.
Wherein, current detection task is the Detection task in some real network.Detection in different real networks
Task is often different.
Because the process for building each self-corresponding ltsh chain table of each kernel processes unit is identical, therefore, in the present embodiment
Only the process for building each self-corresponding ltsh chain table of any one kernel processes unit is described.
Specifically, the process for building each self-corresponding ltsh chain table of any one kernel processes unit is：
Step A11：Generation ltsh chain table.
The length of the ltsh chain table of generation is fixed.During generation ltsh chain table, each node of ltsh chain table is empty
Node.Wherein, the Hash node data structures in ltsh chain table are built using doubly linked list.Hash chain is built using doubly linked list
Hash node data structures in table alleviate hash-collision problem to a certain extent.
Step A12：Empty node in the ltsh chain table carries out assignment.
It is to the detailed process that empty node carries out assignment：The multinuclear processing equipment from backbone network first to receiving
Data flow carry out cryptographic Hash calculating, obtain cryptographic Hash, then determine the data flow in the ltsh chain table according to cryptographic Hash
In corresponding node, data flow described in the nodal cache is completed, so as to complete the assignment of node.
Each node in ltsh chain table completes assignment, builds and completes.It should be noted that building Hash when completing
The data flow that chained list each node is each cached can be used as active stream.
Specifically, it is five-tuple that cryptographic Hash calculates input（It it is five yuan when the data flow for receiving carries out cryptographic Hash calculating
The form of group）, it is output as cryptographic Hash.The Hash calculation function selection principle calculated for cryptographic Hash is strong to require randomness, takes
Value obedience is uniformly distributed.And traffic flow information is indexed using zip mode dynamic bucket depth Hash table, realize being based on five
Tuple stream information node is quickly searched.
Performing before building ltsh chain table, it is thus necessary to determine that Hash barrelage.Specifically, realizing a dynamic bucket depth, keep away
Exempt from because node overflows caused by conflict.
Step S12：In the way of concurrent processing, each kernel processes unit is performed using LRU (least recently
Used, it is least recently used）Mechanism carries out the process of burin-in process to respective ltsh chain table.
Multinuclear processing equipment performs each kernel processes unit using LRU mechanism to respective in the way of concurrent processing
Ltsh chain table carries out the process of burin-in process.
Each kernel processes unit is concurrently to enter to the process that respective ltsh chain table carries out burin-in process using LRU mechanism
Capable, greatly improve processing speed.
In the present embodiment, in the way of concurrent processing, each kernel processes unit is performed using LRU mechanism to respective
Ltsh chain table carries out the process of burin-in process i.e., in the way of concurrent processing, performs each kernel processes unit and uses LRU mechanism
Chain table space to respective ltsh chain table carries out the process of burin-in process.
Step S13：It is determined that right for current detection task by the data flow that the ltsh chain table after burin-in process is cached
The active stream answered.
In the present embodiment, multinuclear processing equipment determines each kernel processes unit each by the Hash after burin-in process
The data flow that chained list is cached is the active stream corresponding to current detection task.
Because the node in ltsh chain table caches the data flow in the backbone network corresponding to current detection task in real time, because
This, the data flow cached by the ltsh chain table of burin-in process is the active stream i.e. current detection corresponding to current detection task
The data flow in backbone network corresponding to task is by after caching in real time and burin-in process, being cached in the number on ltsh chain table
According to active stream of the stream corresponding to current detection task.
Specifically, being active stream by the data flow that each node in the ltsh chain table of burin-in process is each cached.
The data-flow detection method that the application is provided relies on the disposal ability for possessing the DBMS stream of concurrent processing million, has
Body is embodied as：For the disposal ability and current detection task of the multinuclear processing equipment, in the structure multinuclear processing equipment
Each self-corresponding ltsh chain table of each kernel processes unit, the node in the ltsh chain table is used to cache the current inspection in real time
Data flow corresponding to survey task, and the data flow that each node is cached is different；In the way of concurrent processing, to each
The respective ltsh chain table of kernel processes unit carries out LRU mechanism burin-in process；It is determined that by the Hash after LRU mechanism burin-in process
The data flow that chained list is cached is active stream.
Because the mode for using concurrent processing carries out LRU mechanism to each respective ltsh chain table of kernel processes unit
Burin-in process, therefore LRU mechanism burin-in process concurrently can be carried out to multiple ltsh chain tables, concurrently determine multiple ltsh chain table institutes
The data flow of caching is active stream, compared to the mode for processing one by one, processing speed is improve, it is achieved thereby that real-time detection goes out
Active stream, disclosure satisfy that the requirement of real-time of detection active stream in backbone network.
Embodiment two
In the present embodiment, the inspection of another data flow is expanded on the basis of the data-flow detection method shown in Fig. 1
Survey method, refers to Fig. 2, and Fig. 2 shows another flow chart of the data-flow detection method that the application is provided, can include with
Lower step：
Step S21：In the way of concurrent processing, each kernel processes unit is using multiple in performing the multinuclear processing equipment
Closing filtering rule carries out the process of active stream detection.
In the present embodiment, when certain types of data flow has demand in backbone network, using combined filtration rule
Active stream detection is carried out, the data flow of combined filtration rule will be met（I.e. certain types of data flow）As active stream, from
And obtain the active stream of respective type.
In the present embodiment, combined filtration rule is specifically by length filtration rule, five-tuple filtering rule and keyword mistake
Filter rule composition.
Each kernel processes unit is concurrently carried out using the process that combined filtration rule carries out active stream detection.
Whether each kernel processes unit directly judges newly meet filtering rule to data flow, described newly to arrive if meeting
Data flow is active stream, described to be newly inactive stream to data flow if not meeting.
It should be noted that new is the data flow newly received from backbone network to data flow, in present specification
The new of appearance is the new data flow for receiving from backbone network to data flow, subsequently repeats no more.
Step S22：For the disposal ability and current detection task of the multinuclear processing equipment, the multinuclear treatment is built
Each self-corresponding ltsh chain table of each kernel processes unit in equipment.
Step S23：In the way of concurrent processing, each kernel processes unit is performed using LRU mechanism to respective Hash
Chained list carries out the process of burin-in process.
Step S24：It is determined that the data flow cached by the ltsh chain table after burin-in process is active stream.
Step S11, step S12 in data-flow detection method shown in step S22, step S23 and step S24 and Fig. 1
It is identical with step S13, will not be repeated here.
Because each kernel processes unit is identical using the process that combined filtration rule carries out active stream detection, therefore this reality
Apply example to be only described any one kernel processes unit using the process that combined filtration rule carries out active stream detection, specifically
Fig. 3 is referred to, Fig. 3 shows a kind of sub-process figure of the data-flow detection method that the application is provided, may comprise steps of：
Step S31：Whether the length that the kernel processes unit judges newly arrive data flow meets preset length scope.
In the present embodiment, whether the kernel processes unit judges newly arrive the length of data flow and meet preset length scope
It is new described in i.e. described kernel processes unit judges whether to meet length filtration rule to data flow.
Wherein, preset length scope can dynamically change its zone of reasonableness according to the actual requirements.
If judged result is the length for newly arriving data flow meets preset length scope, step S32 is performed, if judged result
For the new length violation to data flow closes preset length scope, then step S33 is performed.
It should be noted that, it is necessary to the kernel processes unit is by 10G POS before step S31 is performed（Packet
Over SDH, a kind of data transfer model of use optical fiber）The new of form is changed to 10G ETH to stream compression（Ethernet, with
Too net）Data flow is arrived in the new of form.
The new data flow that arrives that kernel processes unit is processed in the present embodiment is for number is arrived in the new of 10G ETH ethernet frame formats
According to stream.
Step S32：Determine that described is newly active stream to data flow.
Step S33：Newly whether meet five-tuple filtering rule to data flow described in the kernel processes unit judges.
If judged result newly meets five-tuple filtering rule for described to data flow, return and perform step S32, otherwise,
Perform step S34.
Step S34：Newly whether meet keyword filtering rule to data flow described in the kernel processes unit judges.
If judged result newly meets keyword filtering rule for described to data flow, return and perform step S32, otherwise,
Perform step S25.
Step S35：Trigger the multinuclear processing equipment and perform the disposal ability for being directed to the multinuclear processing equipment, build institute
The step of stating each self-corresponding ltsh chain table of each kernel processes unit in multinuclear processing equipment.
In the present embodiment, each kernel processes unit just performs a step S31 extremely per a data flow is newly received
Step S35.
Embodiment three
In the present embodiment, thus it is shown that each kernel processes unit is carried out using LRU mechanism to respective ltsh chain table
The process of burin-in process.
Carry out the process phase of burin-in process to respective ltsh chain table using LRU mechanism due to each kernel processes unit
Together, therefore the present embodiment only carries out burin-in process using LRU mechanism to any one kernel processes unit to its ltsh chain table
Process is described, and specifically refers to Fig. 4, and Fig. 4 shows another sub-process of the data-flow detection method that the application is provided
Figure, may comprise steps of：
Step S41：To newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained as keyword, in the Kazakhstan
Search whether there is the corresponding node of the cryptographic Hash in uncommon chained list.
Specifically, whether there is to quickly be positioned in chained list and searching a node, using the data flow shown in Fig. 1
Hash calculation function involved in detection method, first carries out Hash caching, by what is obtained to data flow to new according to five-tuple
Cryptographic Hash searches whether there is the corresponding node of the cryptographic Hash as keyword in the ltsh chain table.Wherein, in the Kazakhstan
Search whether to be specially using Hash comparison function assignment in the hash chain in the presence of the corresponding node of the cryptographic Hash in uncommon chained list
Search whether there is the corresponding node of the cryptographic Hash in table.
If finding, step S42 is performed, if not finding, perform step S43.
It should be noted that be directed to backbone network, it is necessary to the kernel processes unit is by 10G before step S41 is performed
The new of POS forms is changed to the new to data flow of 10G ETH forms to stream compression.
The new data flow that arrives that kernel processes unit is processed in the present embodiment is for number is arrived in the new of 10G ETH ethernet frame formats
According to stream.
Step S42：The nodal information of the cryptographic Hash corresponding node is updated, and the cryptographic Hash corresponding node is placed in the Kazakhstan
Uncommon chained list is foremost.
Step S43：Judge to whether there is idle node in the ltsh chain table.
If judged result is the presence of idle node, step S44 is performed, otherwise, perform step S45.
Step S44：Choose an idle node and deposit the cryptographic Hash, and the idle node is placed in the ltsh chain table
Foremost.
Step S45：The node of the afterbody positioned at the ltsh chain table is deleted, chain table space is discharged and is deposited the cryptographic Hash,
And the corresponding node of the cryptographic Hash is placed in the ltsh chain table foremost.
When newly data flow is received, if ltsh chain table has been expired, the knot removal of ltsh chain table afterbody " oldest ",
Chain table space is vacateed for depositing newly to the corresponding node of data flow, and ltsh chain table is placed in the corresponding node of data flow by new
Foremost（At the top of i.e.）.
Using LRU mechanism, because the rill duration is short, arrival rate is low, always it is possible to be replaced away；And big stream is held
The continuous time is long, access cache frequently, so the forward position of the stem for being often buffered in ltsh chain table.
In the present embodiment, each kernel processes unit just performs a step S41 extremely per a data flow is newly received
Step S45.
For foregoing each method embodiment, in order to be briefly described, therefore it is all expressed as a series of combination of actions, but
It is that those skilled in the art should know, the application is not limited by described sequence of movement, because according to the application, certain
A little steps can sequentially or simultaneously be carried out using other.Secondly, those skilled in the art should also know, be retouched in specification
The embodiment stated belongs to preferred embodiment, necessary to involved action and module not necessarily the application.
Example IV
In the present embodiment, there is provided a kind of multinuclear processing equipment, the multinuclear processing equipment possesses concurrent processing million
The disposal ability of DBMS stream, refers to Fig. 5, and Fig. 5 shows a kind of structural representation of the multinuclear processing equipment that the application is provided
Figure, multinuclear processing equipment includes：Build module 51, the first control module 52, determining module 53 and multiple kernel processes units 54.
Module 51 is built, for disposal ability and current detection task for the multinuclear processing equipment, is built described
Each self-corresponding ltsh chain table of each kernel processes unit in multinuclear processing equipment, the node in the ltsh chain table is used for real-time
Cache data flow in the backbone network corresponding to the current detection task, and each not phase of data flow that each node is cached
Together.
First control module 52, in the way of concurrent processing, performing each kernel processes unit using LRU mechanism pair
Respective ltsh chain table carries out the process of burin-in process.
Determining module 53, the data flow for determining to be cached by the ltsh chain table after burin-in process is current detection times
The corresponding active stream of business.
Kernel processes unit 54 is used to carry out burin-in process to respective ltsh chain table using LRU mechanism.
In the present embodiment, another multinuclear processing equipment different from the multinuclear processing equipment shown in Fig. 5 is additionally provided,
Fig. 6 is referred to, Fig. 6 shows another structural representation of the multinuclear processing equipment that the application is provided, on the basis of Fig. 5 also
Including：Second control module 61.
Second control module 61, in the way of concurrent processing, performs in the multinuclear processing equipment at each kernel
Reason unit 54 carries out the process of active stream detection using combined filtration rule.
It is used for the specific knot that realization carries out the process of active stream detection using combined filtration rule in kernel processes unit 54
Structure refers to Fig. 7, and Fig. 7 shows a kind of structural representation of the kernel processes unit that the application is provided, kernel processes unit bag
Include：First judgment sub-unit 71, determination subelement 72, the second judgment sub-unit 73, the 3rd judgment sub-unit 74 and triggering are single
Unit 75.
First judgment sub-unit 71, for judging whether the length for newly arriving data flow meets preset length scope, if so, holding
Row determination subelement 72, if it is not, performing the second judgment sub-unit 73.
The determination subelement 72, for determining that described is newly active stream to data flow.
Second judgment sub-unit 73, for judge it is described it is new whether meet five-tuple filtering rule to data flow, if
It is to perform determination subelement 72, if it is not, performing the 3rd judgment sub-unit 74.
3rd judgment sub-unit 74, for judge it is described it is new whether meet keyword filtering rule to data flow, if
It is to perform the determination subelement 72, if it is not, performing triggering subelement 75.
The triggering subelement 75, the structure module 51 is performed for triggering the multinuclear processing equipment.
In addition, being used for the mistake for realizing carrying out its ltsh chain table using LRU mechanism burin-in process in kernel processes unit 54
The concrete structure of journey refers to Fig. 8, and Fig. 8 shows another structural representation of the kernel processes unit that the application is provided, interior
Core processing unit includes：Subelement 81 is searched, subelement 82, the 4th judgment sub-unit 83 is updated, is chosen subelement 84 and delete
Subelement 85.
Search subelement 81, for newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained as keyword,
Search whether there is the corresponding node of the cryptographic Hash in the ltsh chain table, if so, perform that subelement 82 is updated, if it is not, holding
The judgment sub-unit 83 of row the 4th.
The renewal subelement 82, the nodal information for updating the cryptographic Hash corresponding node, and the cryptographic Hash is corresponding
Node is placed in the ltsh chain table foremost.
4th judgment sub-unit 83, for judging to whether there is idle node in the ltsh chain table, if so, performing
Subelement 84 is chosen, if it is not, perform deleting subelement 85.
The selection subelement 84, deposits the cryptographic Hash, and the idle node is placed in for choosing an idle node
The ltsh chain table is foremost.
The deletion subelement 85, the node for deleting the afterbody positioned at the ltsh chain table discharges chain table space
The cryptographic Hash is deposited, and the corresponding node of the cryptographic Hash is placed in the ltsh chain table foremost.
In the present embodiment, kernel processes unit includes conversion subunit, for 10G POS forms newly to be arrived into data
Circulation is changed to the new to data flow of 10G ETH forms.
Conversion subunit was performed before the first judgment sub-unit 71 is performed, and was held before lookup subelement 81 is performed
OK.
Certainly, the multinuclear processing equipment that the present embodiment is provided includes 10G input interfaces, for receiving backbone network in
Data flow is arrived in the new of 10G POS light forms.
10G input interfaces send to conversion subunit the new of 10G POS forms to data flow, will by conversion subunit
The new of 10G POS light forms is changed to the new to data flow of 10G ETH forms to stream compression.
The multinuclear processing equipment that the present embodiment is provided equally includes 10G output interfaces, for the active stream that will be detected
Output.
It should be noted that each embodiment in this specification is described by the way of progressive, each embodiment weight
Point explanation is all difference with other embodiment, between each embodiment identical similar part mutually referring to.
For device class embodiment, because it is substantially similar to embodiment of the method, so description is fairly simple, related part ginseng
See the part explanation of embodiment of the method.
Finally, in addition it is also necessary to explanation, herein, such as first and second or the like relational terms be used merely to by
One entity or operation make a distinction with another entity or operation, and not necessarily require or imply these entities or operation
Between there is any this actual relation or order.And, term " including ", "comprising" or its any other variant meaning
Covering including for nonexcludability, so that process, method, article or equipment including a series of key elements not only include that
A little key elements, but also other key elements including being not expressly set out, or also include for this process, method, article or
The intrinsic key element of equipment.In the absence of more restrictions, the key element limited by sentence "including a ...", does not arrange
Except also there is other identical element in the process including the key element, method, article or equipment.
For convenience of description, it is divided into various units with function during description apparatus above to describe respectively.Certainly, this is being implemented
The function of each unit can be realized in same or multiple softwares and/or hardware during application.
As seen through the above description of the embodiments, those skilled in the art can be understood that the application can
Realized by the mode of software plus required general hardware platform.Based on such understanding, the technical scheme essence of the application
On the part that is contributed to prior art in other words can be embodied in the form of software product, the computer software product
Can store in storage medium, such as ROM/RAM, magnetic disc, CD, including some instructions are used to so that a computer equipment
（Can be personal computer, server, or network equipment etc.）Perform some of each embodiment of the application or embodiment
Method described in part.
A kind of data-flow detection method provided herein and multinuclear processing equipment are described in detail above, this
Apply specific case in text to be set forth the principle and implementation method of the application, the explanation of above example is only intended to
Help understands the present processes and its core concept；Simultaneously for those of ordinary skill in the art, according to the think of of the application
Think, will change in specific embodiments and applications, in sum, it is right that this specification content should not be construed as
The limitation of the application.
Claims (8)
1. a kind of data-flow detection method, it is characterised in that based on multinuclear processing equipment, the multinuclear processing equipment possesses concurrently
The disposal ability of million DBMS streams is processed, methods described includes：
In the way of concurrent processing, each kernel processes unit is entered using combined filtration rule in performing the multinuclear processing equipment
The process of row active stream detection；
Wherein, any one kernel processes unit is included using the process that combined filtration rule carries out active stream detection：
Whether the length that the kernel processes unit judges newly arrive data flow meets preset length scope；
If so, determining that described is newly active stream to data flow；
If it is not, newly whether meeting five-tuple filtering rule to data flow described in the kernel processes unit judges；
If so, determining that described is newly active stream to data flow；
If it is not, newly whether meeting keyword filtering rule to data flow described in the kernel processes unit judges；
If so, determining that described is newly active stream to data flow；
If it is not, triggering the multinuclear processing equipment performs the disposal ability for being directed to the multinuclear processing equipment, the multinuclear is built
In processing equipment the step of each self-corresponding ltsh chain table of each kernel processes unit；
The multinuclear processing equipment builds the multinuclear for the disposal ability and current detection task of the multinuclear processing equipment
Each self-corresponding ltsh chain table of each kernel processes unit in processing equipment, the node in the ltsh chain table is used for caching in real time
The data flow in backbone network corresponding to the current detection task, and the data flow that each node is cached is different；
And,
In the way of concurrent processing, each kernel processes unit is performed using least recently used LRU mechanism to respective Hash
Chained list carries out the process of burin-in process；And,
It is determined that active stream of the data flow cached by the ltsh chain table after burin-in process corresponding to current detection task.
2. method according to claim 1, it is characterised in that any one kernel processes unit is using LRU mechanism to it
Ltsh chain table carries out the process of burin-in process, including：
A, to newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained is looked into as keyword in the ltsh chain table
Node corresponding with the presence or absence of the cryptographic Hash is looked for, if so, step B is performed, if it is not, performing step C；
B, the nodal information for updating the cryptographic Hash corresponding node, and the cryptographic Hash corresponding node is placed in the ltsh chain table most
Front end；
C, judge with the presence or absence of idle node in the ltsh chain table, if so, performing step D, otherwise, perform step E；
D, one idle node of selection deposit the cryptographic Hash, and the idle node are placed in into the ltsh chain table foremost；
E, the node for deleting afterbody positioned at the ltsh chain table, discharge chain table space and deposit the cryptographic Hash, and by the Hash
It is worth corresponding node and is placed in the ltsh chain table foremost.
3. method according to claim 1, it is characterised in that newly arrive the length of data flow in the kernel processes unit judges
Before whether degree meets preset length scope, also include：
The new of 10G POS forms is changed to the new to data of 10G Ethernet ETH forms by the kernel processes unit to stream compression
Stream.
4. method according to claim 2, it is characterised in that to before newly carrying out cryptographic Hash calculating to data flow, also
Including：
The new of 10G POS forms is changed to the new to data flow of 10G ETH forms by the kernel processes unit to stream compression.
5. method according to claim 2, it is characterised in that the mistake to newly carrying out cryptographic Hash calculating to data flow
Journey, including：
Using the strong hash function of randomness to newly carrying out cryptographic Hash calculating to data flow.
6. a kind of multinuclear processing equipment, it is characterised in that the multinuclear processing equipment possesses the DBMS stream of concurrent processing million
Disposal ability, the multinuclear processing equipment includes：
Module is built, for disposal ability and current detection task for the multinuclear processing equipment, is built at the multinuclear
Each self-corresponding ltsh chain table of each kernel processes unit in reason equipment, the node in the ltsh chain table is used for caching institute in real time
Data flow in the backbone network corresponding to current detection task is stated, and the data flow that each node is cached is different；
First control module, in the way of concurrent processing, performing each kernel processes unit using LRU mechanism to respective
Ltsh chain table carries out the process of burin-in process；
Determining module, the data flow for determining to be cached by the ltsh chain table after burin-in process is right for current detection task
The active stream answered；
Multiple kernel processes units, the kernel processes unit is aging for being carried out to respective ltsh chain table using LRU mechanism
Treatment；
Second control module, in the way of concurrent processing, performing each kernel processes unit in the multinuclear processing equipment
The process of active stream detection is carried out using combined filtration rule；
Wherein, the kernel processes unit includes：
First judgment sub-unit, for judging whether the length for newly arriving data flow meets preset length scope, if so, performing determination
Subelement, if it is not, performing the second judgment sub-unit；
The determination subelement, for determining that described is newly active stream to data flow；
Second judgment sub-unit, for judge it is described it is new whether meet five-tuple filtering rule to data flow, if so, execution
Determination subelement, if it is not, performing the 3rd judgment sub-unit；
3rd judgment sub-unit, for judge it is described it is new whether meet keyword filtering rule to data flow, if so, execution
The determination subelement, if it is not, performing triggering subelement；
The triggering subelement, the structure module is performed for triggering the multinuclear processing equipment.
7. multinuclear processing equipment according to claim 6, it is characterised in that the kernel processes unit includes：
Search subelement, for newly carrying out cryptographic Hash calculating to data flow, the cryptographic Hash that will be obtained as keyword, described
Search whether there is the corresponding node of the cryptographic Hash in ltsh chain table, if so, perform that subelement is updated, if it is not, perform the 4th sentencing
Disconnected subelement；
The renewal subelement, the nodal information for updating the cryptographic Hash corresponding node, and the cryptographic Hash corresponding node is put
In the ltsh chain table foremost；
4th judgment sub-unit, for judging to whether there is idle node in the ltsh chain table, if so, perform choosing son
Unit, if it is not, perform deleting subelement；
The selection subelement, deposits the cryptographic Hash, and the idle node is placed in into the Kazakhstan for choosing an idle node
Uncommon chained list is foremost；
The deletion subelement, the node for deleting the afterbody positioned at the ltsh chain table, discharging the storage of chain table space should
Cryptographic Hash, and the corresponding node of the cryptographic Hash is placed in the ltsh chain table foremost.
8. multinuclear processing equipment according to claim 7, it is characterised in that the kernel processes unit includes：
Conversion subunit, for the new of 10G POS forms to be changed into the new to data flow of 10G ETH forms to stream compression.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410148517.5A CN103888321B (en) | 2014-04-14 | 2014-04-14 | Dataflow detecting method and multi-core processing device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410148517.5A CN103888321B (en) | 2014-04-14 | 2014-04-14 | Dataflow detecting method and multi-core processing device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103888321A CN103888321A (en) | 2014-06-25 |
| CN103888321B true CN103888321B (en) | 2017-05-24 |
Family
ID=50957048
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410148517.5A Active CN103888321B (en) | 2014-04-14 | 2014-04-14 | Dataflow detecting method and multi-core processing device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103888321B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105187436B (en) * | 2015-09-25 | 2019-03-08 | 中国航天科工集团第二研究院七〇六所 | A kind of packet filtering mainframe network control method based on hash table |
| CN105162663B (en) * | 2015-09-25 | 2019-02-19 | 中国人民解放军信息工程大学 | A kind of online method for recognizing flux based on adfluxion |
| CN106254134A (en) * | 2016-08-29 | 2016-12-21 | 上海斐讯数据通信技术有限公司 | A kind of network equipment and the method that data are flow to line pipe control thereof |
| CN106357451B (en) * | 2016-09-30 | 2019-06-25 | 广东电网有限责任公司电力科学研究院 | A kind of management method of fuzz testing data flow |
| CN108170489A (en) * | 2016-12-07 | 2018-06-15 | 腾讯科技（深圳）有限公司 | A kind of method and device of quick loading resource |
| CN108255590B (en) * | 2017-12-07 | 2021-07-30 | 深圳比特微电子科技有限公司 | Data flow control method and device |
| CN112468365A (en) * | 2020-11-26 | 2021-03-09 | 上海阅维科技股份有限公司 | Data quality detection method, system and medium for network mirror flow |
| CN114020657B (en) * | 2021-11-03 | 2023-03-17 | 无锡沐创集成电路设计有限公司 | Message searching method, system, storage medium and electronic equipment |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7406522B2 (en) * | 2001-09-26 | 2008-07-29 | Packeteer, Inc. | Dynamic partitioning of network resources |
| CN101834763A (en) * | 2010-06-25 | 2010-09-15 | 山东大学 | Multiple-category large-flow parallel measuring method under high speed network environment |
| CN102025563A (en) * | 2010-11-30 | 2011-04-20 | 东南大学 | Network flow identification method based on Hash collision compensation |
| CN102497297A (en) * | 2011-12-13 | 2012-06-13 | 曙光信息产业(北京)有限公司 | System and method for realizing deep packet inspection technology based on multi-core and multi-thread |
| CN102546299A (en) * | 2012-01-09 | 2012-07-04 | 北京锐安科技有限公司 | Method for detecting deep packet under large flow |
-
2014
- 2014-04-14 CN CN201410148517.5A patent/CN103888321B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7406522B2 (en) * | 2001-09-26 | 2008-07-29 | Packeteer, Inc. | Dynamic partitioning of network resources |
| CN101834763A (en) * | 2010-06-25 | 2010-09-15 | 山东大学 | Multiple-category large-flow parallel measuring method under high speed network environment |
| CN102025563A (en) * | 2010-11-30 | 2011-04-20 | 东南大学 | Network flow identification method based on Hash collision compensation |
| CN102497297A (en) * | 2011-12-13 | 2012-06-13 | 曙光信息产业(北京)有限公司 | System and method for realizing deep packet inspection technology based on multi-core and multi-thread |
| CN102546299A (en) * | 2012-01-09 | 2012-07-04 | 北京锐安科技有限公司 | Method for detecting deep packet under large flow |
Non-Patent Citations (1)
| Title |
|---|
| 互联网流采用技术综述;赵小欢 等;《小型微型计算机系统》;20130831;正文第2.2节，图2 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103888321A (en) | 2014-06-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103888321B (en) | Dataflow detecting method and multi-core processing device | |
| Zheng et al. | A TCAM-based distributed parallel IP lookup scheme and performance analysis | |
| Rosensweig et al. | On the steady-state of cache networks | |
| Varvello et al. | On the design and implementation of a wire-speed pending interest table | |
| Hammad et al. | Stream window join: Tracking moving objects in sensor-network databases | |
| JP3935880B2 (en) | Hybrid search memory for network processors and computer systems | |
| CN104580027B (en) | A kind of OpenFlow message forwarding methods and equipment | |
| CN103873712B (en) | Voip gateway detection method and multinuclear treatment facility | |
| CN104836810B (en) | A kind of collaborative detection method of NDN low speed caching pollution attack | |
| CN109921996A (en) | A kind of virtual flow stream searching method of high performance OpenFlow | |
| CN108337172A (en) | Extensive OpenFlow flow table classification storage architecture and acceleration lookup method | |
| KR20070122045A (en) | Realtime stateful packet inspection method and apparatus for thereof | |
| CN104579974B (en) | The Hash Bloom Filter and data forwarding method of Name Lookup towards in NDN | |
| JP2005513895A5 (en) | ||
| CN103188231A (en) | Multi-core printed circuit board access control list (ACL) rule matching method | |
| CN104394149B (en) | A kind of method of the Complex event processing based on parallel distributed framework | |
| Rosensweig et al. | A network calculus for cache networks | |
| Li et al. | Taming the wildcards: Towards dependency-free rule caching with freecache | |
| Li et al. | Stateful Inspection firewall session table processing | |
| CN104125146B (en) | A kind of method for processing business and device | |
| Fofack et al. | An approximate analysis of heterogeneous and general cache networks | |
| CN106909624B (en) | Real-time sequencing optimization method for mass data | |
| Dai et al. | Analysis of tandem PIT and CS with non-zero download delay | |
| Zadnik et al. | Tracking elephant flows in internet backbone traffic with an fpga-based cache | |
| Afek et al. | Recursive design of hardware priority queues |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |