CN107085576A - A kind of stream data statistic algorithm and device - Google Patents
A kind of stream data statistic algorithm and device Download PDFInfo
- Publication number
- CN107085576A CN107085576A CN201610086288.8A CN201610086288A CN107085576A CN 107085576 A CN107085576 A CN 107085576A CN 201610086288 A CN201610086288 A CN 201610086288A CN 107085576 A CN107085576 A CN 107085576A
- Authority
- CN
- China
- Prior art keywords
- statistic unit
- statistical
- area
- packet
- parameter value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2462—Approximate or statistical queries
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Probability & Statistics with Applications (AREA)
- Theoretical Computer Science (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Fuzzy Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
This application discloses a kind of stream data statistic algorithm and device.Upon reception of the data packet, the statistical information of the packet is obtained, and is judged in default Statistical Area with the presence or absence of the statistic unit matched with the statistical information；If it has not, and be empty statistic unit in the absence of parameter value, then select one statistic unit in the Statistical Area according to preset strategy as replacing statistic unit, and update with the statistical information parameter value of the replacement statistic unit；The sequence of statistic unit in the Statistical Area is updated according to the parameter value of each statistic unit；After the packet received in prefixed time interval is performed the judgement, the selection operation carried out according to the result of the sequence.Calculate in real time, and reduce the memory space of data.
Description
Technical field
The application belongs to data processing field, specifically, is related to a kind of stream data statistic algorithm and dress
Put.
Background technology
When ddos attack is counted, topN source IP list is often counted on, for attacking
Source Tracing, form is presented., it is necessary to first by all flows in traditional topN statistic algorithms
Data storage is got off and carries out topN calculating, in the network device, general to use netflow technologies
Network traffics are stored and for counting in one format, because data on flows amount is huge, count topN
Substantial amounts of memory space and computing capability can be consumed, is especially calculated in real time, it is more difficult.
In traditional algorithm, if to count the IP of the topN mesh of a period of time traffic conditions, it is necessary to will
The purpose IP of this period flow information is stored and calculated, in network traffics than in the case of larger, having
Substantial amounts of IP information needs statistics, can consume substantial amounts of statistical space and computing resource.And real-time compared with
Difference.
In further statistical fractals, if also needing to count all purposes IP topN source IP algorithms.
So, not only purpose IP flow is stored, also by for some purpose IP all source IPs
Flow also calculated and stored, then be 4,200,000,000 * 4,200,000,000 memory space under extreme case, it is actual
In, it is difficult to complete, it is necessary to be deposited by large-scale calculating that this statistics is in most purging system
Accumulation could be completed, and topN calculating is also carried out after the completion of storage, and this is all difficult to complete in systems.
Therefore, a kind of stream data statistic algorithm is urgently proposed.
The content of the invention
In view of this, technical problems to be solved in this application there is provided a kind of stream data statistic algorithm
And device.
In order to solve the above-mentioned technical problem, this application discloses a kind of stream data statistic algorithm, including such as
Lower step：
Upon reception of the data packet, the statistical information of the packet is obtained, and judges default Statistical Area
It is interior with the presence or absence of the statistic unit matched with the statistical information；Wherein, the Statistical Area is comprising certain
The statistic unit of quantity, each statistic unit is used for all statistics for recording received a certain packet
Storage information of the information to be formed；If it has not, and be empty statistic unit in the absence of storage information, then press
A statistic unit is selected as replacement statistic unit in the Statistical Area according to preset strategy, and with described
Statistical information updates the storage information for replacing statistic unit.Wherein, the storage information includes statistics
The identification marking and parameter value of unit；The statistical information includes identification marking and the institute of the packet
State the corresponding statistical weight of packet.
Wherein, methods described also includes：The statistics is updated according to the parameter value of each statistic unit
The sequence of statistic unit in area；When the packet received in prefixed time interval is performed the judgement
Afterwards, topN selection operation is carried out according to the result of the sequence.
Wherein, judge in default Statistical Area with the presence or absence of the statistics list matched with the statistical information
Member, is specifically included：Inquire about each statistic unit in the Statistical Area identification marking whether with the data
The identification marking of bag with it is consistent, if unanimously, judging presence and the statistical information default the Statistical Area in
The statistic unit matched.
Wherein, the storage information for replacing statistic unit is updated with the statistical information, specifically included：
The identification marking of the statistic unit is replaced with the identification marking of the packet, and with the packet
Statistical weight replaces the parameter value of the statistic unit.
Wherein, judge in default Statistical Area with the presence or absence of the statistics list matched with the statistical information
Member, if it has not, further comprising：If there is storage information is empty statistic unit, believed with the statistics
It is empty statistic unit that breath, which updates the storage information,.Further, update described with the statistical information
Storage information is empty statistic unit, is specifically included：The system is updated with the identification marking of the packet
Count the identification marking of unit, and by the parameter of the statistical weight assignment of the packet and the statistic unit
Value.
Wherein, judge in default Statistical Area with the presence or absence of the statistics list matched with the statistical information
Member, further comprises：If it has, then updating the ginseng of corresponding statistic unit according to the statistical information
Numerical value.
Further, the storage information of corresponding statistic unit, specific bag are updated according to the statistical information
Include：The statistical weight of the packet is added to the parameter value of the statistic unit.
Wherein, select a statistic unit single as statistics is replaced in the Statistical Area according to preset strategy
Member, the preset strategy includes：Select in the Statistical Area, do not carry out parameter value in the range of certain time
The statistic unit of renewal；Or, select in the Statistical Area, last renewable time is apart from current time
The maximum statistic unit of time difference；Or, select in the Statistical Area, the corresponding statistics of minimum parameter values
Unit.
Wherein, select a statistic unit single as statistics is replaced in the Statistical Area according to preset strategy
Member, further comprises：Split the Statistical Area for the firstth area and the secondth area, wherein appointing in firstth area
The sequence reference value of one statistic unit is more than the sequence ginseng of any statistic unit in predetermined threshold value, the secondth area
Value is examined less than or equal to the predetermined threshold value, wherein, the sequence reference value includes certain time scope
Parameter value, renewal frequency or the last renewable time of statistic unit；
A statistic unit is selected as replacement statistic unit, institute in secondth area according to preset strategy
Stating preset strategy includes：Select not carry out the system of parameter value renewal in the range of certain time in secondth area
Count unit；Or, select in secondth area, time difference of the last renewable time apart from current time
Maximum statistic unit；Or, select in secondth area, the corresponding statistic unit of minimum parameter values.
Wherein, methods described further comprises, when according to the corresponding statistic unit of statistical information renewal
Storage information when, the renewable time of each statistic unit of record simultaneously calculates each statistic unit
Renewal frequency in the range of the certain time.
Wherein, the row of statistic unit in the Statistical Area is updated according to the parameter value of each statistic unit
Sequence, further comprises：When detecting any statistic unit and having parameter value renewal, after renewal
The parameter value statistic unit in the Statistical Area is ranked up.
This application discloses a kind of stream data statistic device, including：
Data acquisition module, for upon reception of the data packet, obtaining the statistical information of the packet；
Wherein, the Statistical Area includes a number of statistic unit, and each statistic unit, which is used to record, to be received
To a certain packet storage information of all statistical informations to be formed；Judge module, it is pre- for judging
If Statistical Area in the presence or absence of the statistic unit that matches with the statistical information；Statistical module, if institute
The judged result for stating judge module is no, and is empty statistic unit in the absence of storage information, then the system
Meter module is used to select a statistic unit to count as replacement in the Statistical Area according to preset strategy
Unit, and the storage information for replacing statistic unit is updated with the statistical information.
Wherein, the storage information includes the identification marking and parameter value of statistic unit；The statistical information
Identification marking and the corresponding statistical weight of the packet including the packet.
Described device also includes：Order module, for being updated according to the parameter value of each statistic unit
The sequence of statistic unit in the Statistical Area；Module is chosen, for when receiving in prefixed time interval
Packet is performed after the judgement, the selection operation carried out according to the result of the sequence.
Wherein, the judge module is further used for：Inquire about the knowledge of each statistic unit in the Statistical Area
Do not identify whether with the identification marking of the packet with it is consistent, if unanimously, judging default Statistical Area
It is interior to there is the statistic unit matched with the statistical information.Wherein, the statistical module is further used for：
The identification marking of the statistic unit is replaced with the identification marking of the packet, and with the packet
Statistical weight replaces the parameter value of the statistic unit.
The statistical module, is further used for：If judging to be not present and the statistics in default Statistical Area
The statistic unit of information match, and there is storage information is empty statistic unit, with the statistical information
It is empty statistic unit to update the storage information.Specifically, the statistical module is with the packet
Identification marking updates the identification marking of the statistic unit, and by the statistical weight assignment of the packet with
The parameter value of the statistic unit.
The statistical module is further additionally operable to：Believe if judging to exist in default Statistical Area with the statistics
The statistic unit of manner of breathing matching, the parameter value of corresponding statistic unit is updated according to the statistical information.Tool
Body, the statistical weight of the packet is added to the parameter of the statistic unit by the statistical module
Value.Wherein, the preset strategy includes：Select in the Statistical Area, do not carried out in the range of certain time
The statistic unit that parameter value updates；Or, select in the Statistical Area, last renewable time distance is current
The maximum statistic unit of the time difference at moment；Or, select in the Statistical Area, minimum parameter values correspondence
Statistic unit.
The statistical module is further used for：Split the Statistical Area for the firstth area and the secondth area, wherein institute
The sequence reference value for stating any statistic unit in the firstth area is more than any statistics in predetermined threshold value, the secondth area
The sequence reference value of unit is less than or equal to the predetermined threshold value, wherein, the sequence reference value includes one
Parameter value, renewal frequency or the last renewable time of the statistic unit for scope of fixing time；
A statistic unit is selected as statistic unit is replaced in secondth area according to preset strategy, it is described pre-
If strategy includes：Select not carry out the statistics list of parameter value renewal in the range of certain time in secondth area
Member；Or, select in secondth area, last renewable time is maximum apart from the time difference at current time
Statistic unit；Or, select in secondth area, the corresponding statistic unit of minimum parameter values.
The statistical module is further used for：When according to the corresponding statistic unit of statistical information renewal
During parameter value, the renewable time of each statistic unit of record simultaneously calculates each statistic unit in institute
State the renewal frequency in the range of certain time.The order module is further used for：When detecting any institute
When stating statistic unit and having parameter value renewal, according to the parameter value after renewal to the system in the Statistical Area
Meter unit is ranked up.
Compared with prior art, the application can be obtained including following technique effect：
1) statistic processes of stream data being capable of real-time implementation；
2) statistic processes consumes few memory space, it is not necessary to by the storage device of large space with regard to energy
Obtained Computationally efficient.
Certainly, implementing any product of the application must be not necessarily required to while reaching all the above skill
Art effect.
Brief description of the drawings
Accompanying drawing described herein is used for providing further understanding of the present application, constitutes one of the application
Point, the schematic description and description of the application is used to explain the application, does not constitute to the application's
It is improper to limit.In the accompanying drawings：
Fig. 1 is a kind of techniqueflow chart of stream data statistic algorithm of the application；
Fig. 2 is a kind of another techniqueflow chart of stream data statistic algorithm of the application；
Fig. 3 is a kind of apparatus structure schematic diagram of stream data statistic device of the application；
Fig. 4 is a kind of application example schematic diagram of stream data statistic algorithm of the application；
Fig. 4 a are another schematic diagrames that a kind of application example of stream data statistic algorithm of the application shows.
Embodiment
Presently filed embodiment is described in detail below in conjunction with drawings and Examples, thereby to the application
How application technology means can fully understand to solve technical problem and reach the implementation process of technology effect
And implement according to this.
In a typical configuration, computing device include one or more processors (CPU), input/
Output interface, network interface and internal memory.
Internal memory potentially includes the volatile memory in computer-readable medium, random access memory
And/or the form, such as read-only storage (ROM) or flash memory (flash RAM) such as Nonvolatile memory (RAM).
Internal memory is the example of computer-readable medium.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by
Any method or technique come realize information store.Information can be computer-readable instruction, data structure,
The module of program or other data.The example of the storage medium of computer includes, but are not limited to phase transition internal memory
(PRAM), static RAM (SRAM), dynamic random access memory (DRAM),
Other kinds of random access memory (RAM), read-only storage (ROM), electrically erasable
Read-only storage (EEPROM), fast flash memory bank or other memory techniques, read-only optical disc read-only storage
(CD-ROM), digital versatile disc (DVD) or other optical storages, magnetic cassette tape, tape
Magnetic rigid disk is stored or other magnetic storage apparatus or any other non-transmission medium, can be by available for storage
The information that computing device is accessed.Defined according to herein, computer-readable medium does not include non-temporary electricity
The data-signal and carrier wave of brain readable media (transitory media), such as modulation.
Some vocabulary have such as been used to censure specific components among specification and claim.This area skill
Art personnel are, it is to be appreciated that hardware manufacturer may call same component with different nouns.This explanation
Book and claim be not in the way of the difference of title is used as differentiation component, but with component in function
On difference be used as the criterion of differentiation.Such as " the bag in specification in the whole text and claim mentioned in
Containing " it is an open language, therefore " include but be not limited to " should be construed to." substantially " refer to receivable
In error range, those skilled in the art can solve the technical problem, base in the range of certain error
Originally the technique effect is reached.In addition, " coupling " one word is herein comprising any direct and indirect electrically coupling
Take over section.Therefore, if a first device is coupled to a second device described in text, described first is represented
Device can directly be electrically coupled to the second device, or indirectly electric by other devices or coupling means
Property is coupled to the second device.Specification subsequent descriptions is implement the better embodiment of the application, so
The description is for the purpose of the rule for illustrating the application, to be not limited to scope of the present application.
The protection domain of the application is worked as to be defined depending on the appended claims person of defining.
It should also be noted that, term " comprising ", "comprising" or its any other variant be intended to it is non-
It is exclusive to include, so that commodity or system including a series of key elements not only will including those
Element, but also other key elements including being not expressly set out, or also include for this commodity or be
The intrinsic key element of system.In the absence of more restrictions, limited by sentence "including a ..."
Key element, it is not excluded that also there is other identical element in the commodity or system including the key element.
It should be noted that a kind of stream data statistic algorithm of the embodiment of the present application, it is adaptable to which institute is in need
The stream data application scenarios counted, such as packet source IP or purpose IP statistics, Streaming Media are passed
Defeated statistics, glossary statistic, experimental system monitoring data statistics etc..
Fig. 1 is the techniqueflow chart of the embodiment of the present application one, with reference to Fig. 1, a kind of stream data of the application
Statistic algorithm, can there is following embodiment：
Step S110：Upon reception of the data packet, the statistical information of the packet is obtained, and judges pre-
If Statistical Area in the presence or absence of the statistic unit that matches with the statistical information, if it has not, then performing
Step S120.
Step S120：If being empty statistic unit in the absence of storage information, according to preset strategy described
A statistic unit is selected in Statistical Area as replacement statistic unit, and update described with the statistical information
Replace the storage information of statistic unit.Optionally, after step S120, the embodiment of the present application may be used also
To comprise the following steps S130 and step S140.
Step S130：Statistic unit in the Statistical Area is updated according to the parameter value of each statistic unit
Sequence；
Step S140：After the packet received in prefixed time interval is performed the judgement, root
TopN selection operation is carried out according to the result of the sequence.
It should be noted that the storage information includes the identification marking and parameter value of statistic unit；It is described
Statistical information includes the identification marking and the corresponding statistical weight of the packet of the packet.In step
In rapid S110, a number of statistic unit is set up in Statistical Area in advance, the statistic unit is used for
Data to be counted are carried out with the storage of statistical information and the accumulation calculating of statistical weight, the statistics list
The identification marking of member is used for the identification marking of data storage bag, the accumulation result of the packet statistics weight
Marked with parameter value.Specifically, getting after packet, the statistical information to packet is parsed,
The statistical information further comprises the identification marking and corresponding statistical weight of packet, respectively by institute
The identification marking and statistical weight for stating packet correspond to the identification marking and ginseng for being assigned to corresponding statistic unit
Numerical value.It whether there is and the statistical information phase in the default Statistical Area of the judgement in step 110
The statistic unit matched somebody with somebody, actually inquire about each statistic unit in the Statistical Area identification marking whether with
The identification marking of the packet with it is consistent, if unanimously, judge default the Statistical Area in presence with it is described
The statistic unit that statistical information matches.
In a kind of feasible embodiment, there can be following embodiment：A certain IP is come from when receiving
Stream data bag when, obtain the source IP address or the purpose IP address that will be sent to of packet ownership with
And the size of packet, using source IP or purpose IP address as the packet unique identifier,
Using the size of the packet as the statistical weight of packet, to count in a period of time, data
TopN traffic conditions；Or, in another use scene, it may also be used for the top of statistics article is N number of to close
Keyword, is referred to as unique identifier with vocabulary name, statistics is used as using the approach degree of vocabulary and article theme
Weight, to count in an article, the topN keyword fitted well on article theme.
After the identification marking for obtaining packet, each statistic unit in query statistic area is found and the number
The statistic unit matched according to the identification marking of bag, if being not present, illustrates the corresponding source of this packet
IP or purpose IP were not counted, and performed step S120.
In the step s 120, it is necessary to further check, whether the statistic unit in Statistical Area has storage to believe
Cease for empty statistic unit, if not having, more statistic units are not further added by yet.In the embodiment of the present application,
One replacement statistic unit is selected in existing statistic unit according to default strategy, and with new number
The storage information for replacing statistic unit is updated specifically, with the identification of the packet according to the statistical information of bag
Mark replaces the identification marking of the statistic unit, and replaces the system with the statistical weight of the packet
Count the parameter value of unit.
For example, when carrying out streaming key vocabularies statistics, all statistic units are not sky in Statistical Area.
A certain statistic unit in Statistical Area, its identification marking is " efficiency ", and parameter value is 0.001,0.001
It is the accumulation result for the statistical weight for being counted vocabulary " efficiency ", and the row of this statistic unit parameter value
Sequence is minimum in whole Statistical Area.New vocabulary is still constantly received in Statistical Area, when new vocabulary
When corresponding statistical information is " efficient (0.5) ", all statistic units are inquired about, according to default
Strategy, " efficiency (0.001) " corresponding statistic unit, its parameter value sequence is minimum, can be replaced,
Therefore this statistic unit will be updated to " efficient (0.5) " by the statistical information of new vocabulary, more
The identification marking of statistic unit after new is " efficient ", and parameter value is 0.5.
In a kind of application scenarios of the embodiment of the present application, source IP list or the purpose of ddos attack are counted
During IP lists, the topN IP address generally data traffic in the range of the regular hour is larger or updates frequency
Rate is higher.If in the range of the regular hour it is a certain continued by the data volume of statistics it is very small, permanent
Do not update or renewal frequency is very low, then illustrate that this IP address is very likely not involved in attack, therefore do not have
There is larger Statistical Value, it may be considered that delete the data that this is counted from statistic unit, by sky
Between and the chance that is counted leave other data for.
In another application scenarios of the embodiment of the present application, united using the statistical of the embodiment of the present application
Count topN keyword of a certain paper.Some vocabulary unrelated with paper theme, such as auxiliary word, company
Word etc. is connect, these vocabulary are not high with article Topic Similarity, for statistics, its statistical weight is very low,
The parameter value of corresponding statistic unit is also very low.Therefore, it is saving statistical space, it may be considered that
This class auxiliary word is replaced from corresponding statistic unit.
Therefore, select a statistic unit single as statistics is replaced in the Statistical Area according to preset strategy
Member, the default strategy can be：Select in the Statistical Area, do not joined in the range of certain time
The statistic unit that numerical value updates；Or, select in the Statistical Area, last renewable time apart from it is current when
The maximum statistic unit of the time difference at quarter；Or, select in the Statistical Area, minimum parameter values are corresponding
Statistic unit.
Specifically, in the embodiment of the present application, when according to the corresponding statistic unit of statistical information renewal
During parameter value, also need the renewable time of each statistic unit of record and calculate each statistic unit
Renewal frequency in the range of the certain time, so as to be replaced statistics according to default strategy
The selection of unit.
In the step s 120, the parameter value for replacing statistic unit is updated with the statistical information, just
For data statistics, generally by the way of weight accumulation, by the weight of identification marking identical packet
The parameter value after cumulative updated is carried out, the basis of sequence is used as.
In step s 130, after new packet is counted, the ginseng of all statistic units in Statistical Area
Numerical values recited may change, therefore, have parameter value renewal when detecting any statistic unit
When, the statistic unit in the Statistical Area is ranked up according to the parameter value after renewal.
In step S140, opened according to step S130 ranking results from the maximum statistic unit of parameter value
Begin, choose N number of target data.
In the present embodiment, using limited space come data storage and carry out stream data statistics and
TopN analysis, reduces memory space and amount of calculation, has given up that probability of occurrence is less or statistical weight
The less statistics of weight, but by replacing, to it is all by statistics with chance, so as to
Giving up for mistake is avoided to turn into topN packet.
Fig. 2 is a kind of another techniqueflow chart of stream data statistic algorithm of the application, with reference to Fig. 2,
In a kind of feasible embodiment, the embodiment of the present application can also be realized by following steps：
Step S210：Upon reception of the data packet, the statistical information of the packet is obtained, and judges pre-
If Statistical Area in the presence or absence of the statistic unit that matches with the statistical information；If it has not, then performing
Step S220；
Step S220：Split the Statistical Area for the firstth area and the secondth area, wherein any in firstth area
The sequence reference value of statistic unit is more than the sequence reference of any statistic unit in predetermined threshold value, the secondth area
Value is less than or equal to the predetermined threshold value, wherein, the sequence reference value includes the system of certain time scope
Count parameter value, renewal frequency or the last renewable time of unit；
Step S230：If being empty statistic unit in the absence of parameter value, according to preset strategy described the
A statistic unit is selected in 2nd area as replacement statistic unit, and to be replaced described in statistical information renewal
Change the parameter value of statistic unit；
Step S240：Statistic unit in the Statistical Area is updated according to the parameter value of each statistic unit
Sequence；
In step S220, the Statistical Area is divided into Liang Ge areas, wherein the statistics list in the firstth area
First generally parameter value sorts, and higher, renewal frequency is higher or renewal time is close apart from current time, turns into
The possibility of topN data is big, you can the firstth area is called the statistic unit parameter value in stable region, the secondth area
The relatively low, renewal frequency that sorts is relatively low or does not update for a long time, and the possibility as topN data is smaller,
It can be described as range of instability.It should be noted that the embodiment of the present application is not intended to limit the predetermined threshold value
Size, the predetermined threshold value is an empirical value.
For example, can have the partitioning scheme of following Statistical Area：
Mode one：All statistic units of Statistical Area are arranged from big to small according to parameter value, one is preset
Threshold value, the statistic unit that parameter value is more than the threshold value can be divided into the firstth area, and parameter value is less than
Statistic unit equal to the threshold value can be divided into the secondth area；Or, assume to have in Statistical Area
In M1+M2 statistic unit, the firstth area of setting M2 is included comprising M1 statistic unit, the secondth area
Individual statistic unit, all statistic units of Statistical Area is arranged from big to small according to parameter value, from parameter value
Maximum statistic unit starts, and M1 statistic unit is chosen successively as the firstth area, then remaining M2
Individual statistic unit is used as the secondth area；
Mode two：The renewal frequency of each statistic unit in Statistical Area is recorded, and will be all in Statistical Area
Statistic unit, from minispread significantly, chooses a frequency threshold according to renewal frequency, and renewal frequency is more than
The statistic unit of the frequency threshold can be divided into the firstth area, and renewal frequency is less than or equal to the frequency
The statistic unit of threshold value can be divided into the secondth area；Or, assume to have M1+M2 system in Statistical Area
Count in unit, the firstth area of setting and include M2 statistic unit comprising M1 statistic unit, the secondth area,
All statistic units of Statistical Area are arranged from big to small according to parameter value, from the statistics list that parameter value is maximum
Member starts, and M1 statistic unit of selection is made as the firstth area, then remaining M2 statistic unit successively
For the secondth area；Or,
Mode three：The renewable time of each statistic unit of record, calculates each statistic unit last
Time difference of the renewable time away from current time, by all statistic units in Statistical Area according to the time difference from small
To being ranked up greatly, choosing one is used for the threshold value of subregion, the operating procedure of subregion with described in mode one,
Here is omitted.In step S230 specifically, preset strategy can be：Select in secondth area
The statistic unit of parameter value renewal is not carried out in the range of certain time；Or, select in secondth area, on
Renewable time is apart from the maximum statistic unit of the time difference at current time；Or, selection described second
In area, the corresponding statistic unit of minimum parameter values.
In the present embodiment, Statistical Area is divided into two statistic units, the secondth unstable area of prioritizing selection
Statistic unit be replaced, it is to avoid do not updated for a long time but weight larger statistics list in the firstth area
Member is replaced, and improves the accuracy of topN selections.
It should be noted that in the embodiment of the present application, judge to whether there is in default Statistical Area with it is described
The statistic unit that statistical information matches, if it has not, and there is storage information is empty statistic unit, then
The storage information is directly updated as empty statistic unit using the statistical information.
Judge with the presence or absence of the statistic unit matched with the statistical information in default Statistical Area, if
It is that the parameter value of corresponding statistic unit is then updated according to the statistical information.Concrete operations are, by institute
The statistical weight for stating packet is added to the parameter value of the statistic unit.
Fig. 3 is a kind of apparatus structure schematic diagram of stream data statistic device of the embodiment of the present application, with reference to figure
3, described device includes such as lower unit：
Data acquisition module 310, the statistics letter for upon reception of the data packet, obtaining the packet
Breath；Wherein, the Statistical Area includes a number of statistic unit, and each statistic unit is used to record institute
Storage information of all statistical informations of a certain packet received to be formed；Judge module 320, is used
In judging in default Statistical Area with the presence or absence of the statistic unit that matches with the statistical information；
Statistical module 330, if the judged result of the judge module is no, and be in the absence of storage information
Empty statistic unit, then the statistical module 330 according to preset strategy in the Statistical Area for selecting
One statistic unit updates the replacement statistic unit as replacement statistic unit, and with the statistical information
Storage information.
Specifically, the storage information includes the identification marking and parameter value of statistic unit；The statistics letter
Breath includes the identification marking and the corresponding statistical weight of the packet of the packet.
Optionally, the embodiment of the present application can further include order module 340 and topN chooses mould
Block 350.
The order module 340, for updating the statistics according to the parameter value of each statistic unit
The sequence of statistic unit in area；
The topN chooses module 350, for being held when the packet received in prefixed time interval
After the row judgement, topN selection operation is carried out according to the result of the sequence.
The judge module 320 is further used for：Inquire about the identification of each statistic unit in the Statistical Area
Identify whether with the identification marking of the packet with it is consistent, if unanimously, judging in default Statistical Area
In the presence of the statistic unit matched with the statistical information.
The statistical module 330 is further used for：The statistics is replaced with the identification marking of the packet
The identification marking of unit, and with the parameter value of the statistical weight replacement statistic unit of the packet.
Judge with the presence or absence of the statistic unit matched with the statistical information in default Statistical Area, if
It is no, and there is storage information is empty statistic unit, the statistical module 330 is further used for：With
It is empty statistic unit that the statistical information, which updates the storage information,.Specifically, the statistical module 330
Update the identification marking of the statistic unit with the identification marking of the packet, and by the packet
Statistical weight assignment and the parameter value of the statistic unit.
Judge with the presence or absence of the statistic unit matched with the statistical information in default Statistical Area, if
It is that the statistical module 330 is further additionally operable to：Corresponding statistics is updated according to the statistical information single
The parameter value of member.Specifically, the statistical weight of the packet is added to the system by the statistical module
Count the parameter value of unit.
A statistic unit is selected as replacement statistic unit, institute in the Statistical Area according to preset strategy
Stating preset strategy includes：Select in the Statistical Area, do not carry out parameter value renewal in the range of certain time
Statistic unit；Or, select in the Statistical Area, time difference of the last renewable time apart from current time
It is worth maximum statistic unit；Or, select in the Statistical Area, the corresponding statistic unit of minimum parameter values.
The statistical module 330 is further used for：Split the Statistical Area for the firstth area and the secondth area, its
Described in the firstth area the sequence reference value of any statistic unit be more than it is any in predetermined threshold value, the secondth area
The sequence reference value of statistic unit is less than or equal to the predetermined threshold value, wherein, the sequence reference value bag
Include parameter value, renewal frequency or the last renewable time of the statistic unit of certain time scope；Selection institute
State the statistic unit for not carrying out parameter value renewal in the secondth area in the range of certain time；Or, select described the
In 2nd area, last renewable time is apart from the maximum statistic unit of the time difference at current time；Or, choosing
Select in secondth area, the corresponding statistic unit of minimum parameter values.
The statistical module 330 is further used for：It is single when updating corresponding statistics according to the statistical information
During the parameter value of member, the renewable time of each statistic unit of record simultaneously calculates each statistic unit
Renewal frequency in the range of the certain time.
The order module 340 is further used for：There is parameter value more when detecting any statistic unit
When new, the statistic unit in the Statistical Area is ranked up according to the parameter value after renewal.
Fig. 3 shown devices can perform the method for Fig. 1~embodiment illustrated in fig. 2, realization principle and technology effect
Fruit refers to Fig. 1~embodiment illustrated in fig. 2, repeats no more.
Application example
Following part will combine Fig. 4, and this is expanded on further with an example applied under special scenes
The stream data statistic algorithm of application.
It is assumed that, it is necessary to choose the source IP address of N number of maximum flow when ddos attack is counted.
Statistical Area is divided into the firstth area and the secondth area, then N number of statistic unit can be included in the firstth area, in Fig. 4
In be the part with shading, comprising K statistic unit in the secondth area, in Fig. 4 for without shading portion
Point.
In such as Fig. 4, step S1, each statistic unit of Statistical Area is empty；
In step S2, the packet that a source IP is 1.1.1.1 is have received, its data package size is
10 bytes, the statistical information for being resolved to packet is as follows：The identification marking of packet is 1.1.1.1, statistics
Weight is 10.First statistic unit is inserted, the storage information of first statistic unit of modification is 1.1.1.1
(10), wherein, the identification marking of statistic unit is 1.1.1.1, and parameter value is 10.
In step S3, the packet that a source IP is 2.2.2.2 is received, its data package size is 20
Byte, the statistical information for being resolved to packet is as follows：The identification marking of packet is 2.2.2.2, statistical weight
Weight is 20.Second statistic unit is inserted, the storage information of second statistic unit of modification is 2.2.2.2
(20), wherein, the identification marking of statistic unit is 2.2.2.2, and its parameter value is 20；
In step S4, first statistic unit and second statistic unit are ranked up, because of the second system
The parameter value for counting unit is more than the parameter value of first statistic unit, i.e. data package size more than the first statistics
Unit, therefore, the data sorting in second statistic unit is shifted to an earlier date；
In step s 5, the packet that a source IP is 1.1.1.1 is received, its data package size is
20 bytes, the statistical information for being resolved to packet is as follows：The identification marking of packet is 1.1.1.1, statistics
Weight is 20.The statistic unit matched with the identification marking of packet is found in Statistical Area, and will
The statistical weight of packet is added to the parameter value of corresponding statistic unit, is resequenced after adding up, the first system
The storage information of meter unit is updated to 1.1.1.1 (30)；
In step S6, data are continued to, until N+K statistic unit is filled it up with；
Step S7, packet its data package size for receiving that a source IP is 1.1.1.1 is 20 bytes,
Statistic unit corresponding with 1.1.1.1 is found in Statistical Area, is entered using data package size as statistical weight
Row is cumulative, is resequenced after adding up；
Step S8, receives the packet that a source IP is 10.10.10.10, finds in current statistic area
Statistic unit not corresponding with 10.10.10.10.Assuming that a period of time in, with 8.8.8.8 this
The parameter value renewal frequency of the corresponding statistic unit of one source IP address is minimum, then it is believed that this IP address
Participate in less in ddos attack, the statistics to this IP address can be abandoned, by this IP address pair
The statistic unit answered updates as statistics replacement unit, and with the statistical information of 10.10.10.10 packet
This replacement unit, then resequences.Or, in another implementation strategy, it is assumed that with 8.8.8.8 this
At the time of the last undated parameter value of the corresponding statistic unit of one source IP address apart from current time when
Between difference it is maximum, illustrate that this IP address has neither part nor lot in ddos attack for a long time within a period of time, by this
The corresponding statistic unit of IP address is used as statistics replacement unit.
Step S9, within a certain period of time, receives and has counted after all data, choose N number of purpose
Top data.
Above-mentioned steps S8 can also have following embodiment, in S7, be 9.9.9.9 with IP address
Corresponding statistic unit, the accumulated value of its parameter value is 4, sorts minimum, illustrates in the current period
Interior, the flow for spending in this IP address is minimum, may not be DDoS emphasis target of attack, therefore
Can will be the corresponding statistic units of 9.9.9.9 as statistics replacement unit with IP address, using source IP as
10.10.10.10 the statistical information of packet updates this replacement unit, then resequences, such as Fig. 4 a
It is shown.
Some preferred embodiments of the application have shown and described in described above, but as it was previously stated, should manage
Solution the application is not limited to form disclosed herein, is not to be taken as the exclusion to other embodiment,
And available for it is various other combination, modification and environment, and can in invention contemplated scope described herein,
It is modified by the technology or knowledge of above-mentioned teaching or association area.And those skilled in the art are carried out changes
Dynamic and change does not depart from spirit and scope, then all should the application appended claims protection
In the range of.
Claims (26)
1. a kind of stream data statistic algorithm, it is characterised in that including：
Upon reception of the data packet, the statistical information of the packet is obtained, and judges default Statistical Area
It is interior with the presence or absence of the statistic unit matched with the statistical information；Wherein, the Statistical Area is comprising predetermined
The statistic unit of quantity, each statistic unit is used for all statistics for recording received a certain packet
Storage information of the information to be formed；
If it has not, and be empty statistic unit in the absence of storage information, then according to preset strategy in the system
Count and a statistic unit is selected in area as replacement statistic unit, and to be replaced described in statistical information renewal
Change the storage information of statistic unit.
2. the method as described in claim 1, it is characterised in that it is single that the storage information includes statistics
The identification marking and parameter value of member；The identification marking of the statistical information including the packet and described
The corresponding statistical weight of packet.
3. method as claimed in claim 2, it is characterised in that methods described also includes：
The sequence of statistic unit in the Statistical Area is updated according to the parameter value of each statistic unit；
After the packet received in prefixed time interval is performed the judgement, according to the sequence
Result carry out topN selection operation.
4. method as claimed in claim 2, it is characterised in that judge in default Statistical Area whether
In the presence of the statistic unit matched with the statistical information, specifically include：
Inquire about each statistic unit in the Statistical Area identification marking whether the identification with the packet
Identify and consistent, if unanimously, judging there is what is matched with the statistical information in default Statistical Area
Statistic unit.
5. method as claimed in claim 2, it is characterised in that update described with the statistical information
The storage information of statistic unit is replaced, is specifically included：
The identification marking of the statistic unit is replaced with the identification marking of the packet, and with the data
The statistical weight of bag replaces the parameter value of the statistic unit.
6. method as claimed in claim 2, it is characterised in that judge in default Statistical Area whether
In the presence of the statistic unit matched with the statistical information, further comprise：
If it has not, and there is storage information is empty statistic unit, with the statistical information update described in deposit
It is empty statistic unit to store up information.
7. method as claimed in claim 6, it is characterised in that update described with the statistical information
Storage information is empty statistic unit, is specifically included：
Update the identification marking of the statistic unit with the identification marking of the packet, and by the data
The statistical weight assignment of bag and the parameter value of the statistic unit.
8. method as claimed in claim 2, it is characterised in that judge in default Statistical Area whether
In the presence of the statistic unit matched with the statistical information, further comprise：
If it has, then updating the parameter value of corresponding statistic unit according to the statistical information.
9. method as claimed in claim 8, it is characterised in that according to the statistical information more cenotype
The storage information for the statistic unit answered, is specifically included：
The statistical weight of the packet is added to the parameter value of the statistic unit.
10. method as claimed in claim 2, it is characterised in that the preset strategy includes：
Select in the Statistical Area, do not carry out the statistic unit of parameter value renewal in the range of certain time；Or,
Select in the Statistical Area, last renewable time is apart from the maximum statistics list of the time difference at current time
Member；Or, select in the Statistical Area, the corresponding statistic unit of minimum parameter values.
11. method as claimed in claim 2, it is characterised in that according to preset strategy in the statistics
Select a statistic unit as statistic unit is replaced in area, further comprise：
Split the Statistical Area for the firstth area and the secondth area, wherein any statistic unit in firstth area
The sequence reference value that the reference value that sorts is more than any statistic unit in predetermined threshold value, the secondth area is less than or equal to
The predetermined threshold value, wherein, the sequence reference value includes the ginseng of the statistic unit of certain time scope
Numerical value, renewal frequency or last renewable time；
A statistic unit is selected as replacement statistic unit, institute in secondth area according to preset strategy
Stating preset strategy includes：
Select not carry out the statistic unit of parameter value renewal in the range of certain time in secondth area；Or,
Select in secondth area, last renewable time is apart from the maximum statistics list of the time difference at current time
Member；Or, select in secondth area, the corresponding statistic unit of minimum parameter values.
12. the method as described in claim 1 or 6 or 8, it is characterised in that methods described is further
Including,
When updating the storage information of corresponding statistic unit according to the statistical information, record is each described
The renewable time of statistic unit simultaneously calculates each statistic unit in the range of the certain time more
New frequency.
13. method as claimed in claim 3, it is characterised in that according to each statistic unit
Parameter value updates the sequence of statistic unit in the Statistical Area, further comprises：
When detecting any statistic unit and having parameter value renewal, according to the parameter value after renewal
Statistic unit in the Statistical Area is ranked up.
14. a kind of stream data statistic device, it is characterised in that including：
Data acquisition module, for upon reception of the data packet, obtaining the statistical information of the packet；
Judge module, for judging in default Statistical Area with the presence or absence of the statistics matched with the statistical information
Unit；Wherein, the Statistical Area includes a number of statistic unit, and each statistic unit is used to record
Storage information of all statistical informations of received a certain packet to be formed；
Statistical module, if the judged result of the judge module is no, and is empty in the absence of storage information
Statistic unit, then the statistical module in the Statistical Area for selecting a statistics according to preset strategy
Unit updates the storage letter for replacing statistic unit as replacement statistic unit, and with the statistical information
Breath.
15. device as claimed in claim 14, it is characterised in that the storage information includes statistics
The identification marking and parameter value of unit；The statistical information includes identification marking and the institute of the packet
State the corresponding statistical weight of packet.
16. device as claimed in claim 15, it is characterised in that described device further comprises：
Order module, is counted for being updated according to the parameter value of each statistic unit in the Statistical Area
The sequence of unit；
TopN chooses module, for described sentencing when the packet received in prefixed time interval is performed
Have no progeny, topN selection operation is carried out according to the result of the sequence.
17. device as claimed in claim 15, it is characterised in that the judge module is further used
In：
Inquire about each statistic unit in the Statistical Area identification marking whether the identification with the packet
Identify and consistent, if unanimously, judging there is what is matched with the statistical information in default Statistical Area
Statistic unit.
18. device as claimed in claim 15, it is characterised in that the statistical module is further used
In：
The identification marking of the statistic unit is replaced with the identification marking of the packet, and with the data
The statistical weight of bag replaces the parameter value of the statistic unit.
19. device as claimed in claim 15, it is characterised in that the statistical module, further
For：If judging the statistic unit matched with the statistical information is not present in default Statistical Area,
And there is storage information is empty statistic unit, and the storage information is updated to be empty using the statistical information
Statistic unit.
20. device as claimed in claim 19, it is characterised in that the statistical module is specifically also used
In：
Update the identification marking of the statistic unit with the identification marking of the packet, and by the data
The statistical weight assignment of bag and the parameter value of the statistic unit.
21. device as claimed in claim 15, it is characterised in that the statistical module is further gone back
For：If judging there is the statistic unit matched with the statistical information in default Statistical Area, according to
The statistical information updates the parameter value of corresponding statistic unit.
22. device as claimed in claim 21, it is characterised in that the statistical module is specifically also used
In：
The statistical weight of the packet is added to the parameter value of the statistic unit.
23. device as claimed in claim 15, it is characterised in that the preset strategy includes：
Select in the Statistical Area, do not carry out the statistic unit of parameter value renewal in the range of certain time；Or,
Select in the Statistical Area, last renewable time is apart from the maximum statistics list of the time difference at current time
Member；Or, select in the Statistical Area, the corresponding statistic unit of minimum parameter values.
24. device as claimed in claim 15, it is characterised in that the statistical module is further used
In：
Split the Statistical Area for the firstth area and the secondth area, wherein any statistic unit in firstth area
The sequence reference value that the reference value that sorts is more than any statistic unit in predetermined threshold value, the secondth area is less than or equal to
The predetermined threshold value, wherein, the sequence reference value includes the ginseng of the statistic unit of certain time scope
Numerical value, renewal frequency or last renewable time；
A statistic unit is selected as replacement statistic unit, institute in secondth area according to preset strategy
Stating preset strategy includes：
Select not carry out the statistic unit of parameter value renewal in the range of certain time in secondth area；Or,
Select in secondth area, last renewable time is apart from the maximum statistics list of the time difference at current time
Member；Or, select in secondth area, the corresponding statistic unit of minimum parameter values.
25. the device as described in claim 14 or 19 or 21, it is characterised in that the statistics mould
Block is further used for：
When updating the parameter value of corresponding statistic unit according to the statistical information, each system of record
Count the renewable time of unit and calculate each renewal of the statistic unit in the range of the certain time
Frequency.
26. device as claimed in claim 16, it is characterised in that the order module is further used
In：
When detecting any statistic unit and having parameter value renewal, according to the parameter value after renewal
Statistic unit in the Statistical Area is ranked up.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610086288.8A CN107085576A (en) | 2016-02-15 | 2016-02-15 | A kind of stream data statistic algorithm and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610086288.8A CN107085576A (en) | 2016-02-15 | 2016-02-15 | A kind of stream data statistic algorithm and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN107085576A true CN107085576A (en) | 2017-08-22 |
Family
ID=59614859
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610086288.8A Pending CN107085576A (en) | 2016-02-15 | 2016-02-15 | A kind of stream data statistic algorithm and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107085576A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108959458A (en) * | 2018-06-15 | 2018-12-07 | 南京国通智能科技有限公司 | Data generate and application method, system, medium and computer equipment |
| CN110166418A (en) * | 2019-03-04 | 2019-08-23 | 腾讯科技（深圳）有限公司 | Attack detection method, device, computer equipment and storage medium |
| CN111241146A (en) * | 2018-11-29 | 2020-06-05 | 北京数安鑫云信息技术有限公司 | Method and system for counting TopK-Frequency information |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1744573A (en) * | 2005-08-30 | 2006-03-08 | 杭州华为三康技术有限公司 | Business flow idnetifying method |
| CN101272254A (en) * | 2008-05-09 | 2008-09-24 | 华为技术有限公司 | Method for generating attack characteristic database, method for preventing network attack and device thereof |
| CN101369897A (en) * | 2008-07-31 | 2009-02-18 | 成都市华为赛门铁克科技有限公司 | Method and equipment for detecting network attack |
| CN101437030A (en) * | 2008-11-29 | 2009-05-20 | 成都市华为赛门铁克科技有限公司 | Method for preventing server from being attacked, detection device and monitoring device |
| CN101572701A (en) * | 2009-02-10 | 2009-11-04 | 中科正阳信息安全技术有限公司 | Security gateway system for resisting DDoS attack for DNS service |
| CN101594266A (en) * | 2009-07-01 | 2009-12-02 | 杭州华三通信技术有限公司 | A kind of SQL detection method for injection attack and device |
| CN101674192A (en) * | 2009-09-22 | 2010-03-17 | 天津大学 | Method for identifying VoIP based on flow statistics |
| CN102413197A (en) * | 2011-08-01 | 2012-04-11 | 中国科学院计算机网络信息中心 | Access statistics processing method and device |
| CN103593376A (en) * | 2012-08-17 | 2014-02-19 | 阿里巴巴集团控股有限公司 | Method and device for collecting user behavior data |
| CN103957195A (en) * | 2014-04-04 | 2014-07-30 | 上海聚流软件科技有限公司 | DNS system and defense method and device for DNS attack |
| CN104219102A (en) * | 2013-05-29 | 2014-12-17 | 华为技术有限公司 | Network data discounting counter method, device and system |
-
2016
- 2016-02-15 CN CN201610086288.8A patent/CN107085576A/en active Pending
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1744573A (en) * | 2005-08-30 | 2006-03-08 | 杭州华为三康技术有限公司 | Business flow idnetifying method |
| CN101272254A (en) * | 2008-05-09 | 2008-09-24 | 华为技术有限公司 | Method for generating attack characteristic database, method for preventing network attack and device thereof |
| CN101369897A (en) * | 2008-07-31 | 2009-02-18 | 成都市华为赛门铁克科技有限公司 | Method and equipment for detecting network attack |
| CN101437030A (en) * | 2008-11-29 | 2009-05-20 | 成都市华为赛门铁克科技有限公司 | Method for preventing server from being attacked, detection device and monitoring device |
| CN101572701A (en) * | 2009-02-10 | 2009-11-04 | 中科正阳信息安全技术有限公司 | Security gateway system for resisting DDoS attack for DNS service |
| CN101594266A (en) * | 2009-07-01 | 2009-12-02 | 杭州华三通信技术有限公司 | A kind of SQL detection method for injection attack and device |
| CN101674192A (en) * | 2009-09-22 | 2010-03-17 | 天津大学 | Method for identifying VoIP based on flow statistics |
| CN102413197A (en) * | 2011-08-01 | 2012-04-11 | 中国科学院计算机网络信息中心 | Access statistics processing method and device |
| CN103593376A (en) * | 2012-08-17 | 2014-02-19 | 阿里巴巴集团控股有限公司 | Method and device for collecting user behavior data |
| CN104219102A (en) * | 2013-05-29 | 2014-12-17 | 华为技术有限公司 | Network data discounting counter method, device and system |
| CN103957195A (en) * | 2014-04-04 | 2014-07-30 | 上海聚流软件科技有限公司 | DNS system and defense method and device for DNS attack |
Non-Patent Citations (1)
| Title |
|---|
| 卢先锋等: "基于动态IP黑名单的入侵防御系统模型", 《计算工程与设计》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108959458A (en) * | 2018-06-15 | 2018-12-07 | 南京国通智能科技有限公司 | Data generate and application method, system, medium and computer equipment |
| CN108959458B (en) * | 2018-06-15 | 2022-02-18 | 南京国通智能科技有限公司 | Data generation and use method, system, medium and computer device |
| CN111241146A (en) * | 2018-11-29 | 2020-06-05 | 北京数安鑫云信息技术有限公司 | Method and system for counting TopK-Frequency information |
| CN111241146B (en) * | 2018-11-29 | 2023-09-19 | 北京数安鑫云信息技术有限公司 | Method and system for counting TopK-Frequency information |
| CN110166418A (en) * | 2019-03-04 | 2019-08-23 | 腾讯科技（深圳）有限公司 | Attack detection method, device, computer equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102301342B (en) | Regular Expression Matching Method And System, And Searching Device | |
| CN103530334B (en) | Based on the data matching system and method for comparing template | |
| WO2018132196A1 (en) | Flow classification apparatus, methods, and systems | |
| CN106202569A (en) | A kind of cleaning method based on big data quantity | |
| US20140351273A1 (en) | System and method for searching information | |
| CN107547432B (en) | A kind of flow control methods and device | |
| CN107085576A (en) | A kind of stream data statistic algorithm and device | |
| CN104462396B (en) | Character string processing method and device | |
| EP3211843A1 (en) | Table look-up method and device for openflow table, and storage medium | |
| CN107276916B (en) | Switch flow table management method based on protocol non-perception forwarding technology | |
| CN110135603B (en) | Power network alarm space characteristic analysis method based on improved entropy weight method | |
| CN109359188A (en) | A kind of component method of combination and system | |
| CN110535825A (en) | A kind of data identification method of character network stream | |
| CN110458296A (en) | The labeling method and device of object event, storage medium and electronic device | |
| CN109582847A (en) | A kind of information processing method and device, storage medium | |
| CN105681199B (en) | The processing method and processing device of message data in a kind of vehicle bus | |
| CN107016075A (en) | Company-data synchronous method and device | |
| CN105468699B (en) | Duplicate removal data statistical approach and equipment | |
| CN109710676A (en) | Data capture method, device and the electronic equipment of CMDB model | |
| CN108170702A (en) | A kind of power communication alarm association model based on statistical analysis | |
| CN107888419A (en) | A kind of switch network Topology g eneration method and device | |
| CN110019763A (en) | Text filtering method, system, equipment and computer readable storage medium | |
| CN105357118A (en) | Rule based flow classifying method and system | |
| EP2804342A2 (en) | Method and device for clearing configuration command in communication equipment | |
| CN107315829A (en) | A kind of Fast Compression method of rule-based collection in real-time data base |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170822 |
|
| RJ01 | Rejection of invention patent application after publication |