CN107291757B

CN107291757B - Pattern matching method and pattern matching device

Info

Publication number: CN107291757B
Application number: CN201610204598.5A
Authority: CN
Inventors: 丁福海
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2016-03-31
Filing date: 2016-03-31
Publication date: 2020-01-10
Anticipated expiration: 2036-03-31
Also published as: CN107291757A

Abstract

The embodiment of the invention provides a pattern matching method and a pattern matching device. The method is applied to a pattern matching device, the pattern matching device comprises a timing manager and a state machine engine, and the method comprises the following steps: the method comprises the steps that when a first event of at least two events sent by an event source is received, a state machine engine registers a timer with a timing manager, wherein each event of the at least two events carries a respective occurrence time; the timing manager starts timing from the occurrence moment of the first event through the timer until a preset time threshold value; the state machine engine determines whether the received pattern of the event of the occurrence time within a preset time period is matched with a preset pattern, wherein the preset time period is a time range between the occurrence time of the first event and the preset time threshold. The invention can carry out pattern matching according to the occurrence time of the event, thereby improving the accuracy of pattern matching.

Description

Pattern matching method and pattern matching device

Technical Field

The present invention relates to the field of communications, and more particularly, to a method of pattern matching and a pattern matching apparatus.

Background

Of the large data streaming applications, some streaming applications (e.g., load pattern matching applications) rely on the actual time of occurrence of an event. However, in an actual business scenario, time handling may be difficult for various reasons. For example, there may be a problem of inconsistent event times, such as timeliness of event source collection, delay of each computing component, and accumulation of events due to failures.

A typical streaming system is based on the time of arrival of an event at a computing component. Therefore, when the actual occurrence time is not consistent with the time when the event is received by the computing component, certain errors or even errors can be caused in certain service scenarios.

Disclosure of Invention

The embodiment of the invention provides a pattern matching method and a pattern matching device, which can improve the accuracy of pattern matching.

In a first aspect, a method of pattern matching is provided. The method is applied to a pattern matching device, the pattern matching device comprises a state machine engine and a timing manager, and the method comprises the following steps: the method comprises the steps that when a first event of at least two events sent by an event source is received, a state machine engine registers a timer with a timing manager, wherein each event of the at least two events carries a respective occurrence time; the timing manager starts timing from the occurrence moment of the first event through the timer until a preset time threshold value; the state machine engine determines whether the received pattern of the event of the occurrence time within a preset time period is matched with a preset pattern, wherein the preset time period is a time range between the occurrence time of the first event and the preset time threshold.

The pattern matching device has two related modules, one is a state machine engine and the other is a timing manager. The state machine engine receives at least two events sent by an event source, and each event of the at least two events carries the occurrence time of the event. Registration of the timer may be triggered when the state machine engine receives a first event of the at least two events. The first event may be a first event of the at least two events, or may be any one of the at least two events, and accordingly, the pattern matching device performs pattern matching on a pattern formed by an event subsequent to the first event of the at least two events. The timing manager starts timing from the occurrence moment of the first event of the at least two events through a timer until a preset time threshold value. The state machine engine receives the event sent by the event source, and performs pattern matching according to a series of events of the occurrence time within the preset time period, so that the problem of pattern matching errors caused by large difference between the occurrence time and the receiving time due to accumulation in a system or reduction of throughput of internal parts when pattern matching is performed according to the time of receiving the event in the prior art is avoided, and the accuracy of pattern matching can be improved.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the at least two events are directly sent by different or the same event source, or sent by different or the same event source through the routing distribution apparatus, where each of the at least two events carries a respective event attribute; wherein the state machine engine registers a timer with the timing manager when receiving a first event of at least two events sent by an event source, comprising: the state machine engine, upon receiving the first event, creating a state machine for the first event and registering a timer with the timing manager; the state machine engine receives a second event of the at least two events, wherein the occurrence time of the second event is later than that of the first event; if the event attribute of the second event is matched with the state machine, the state machine engine sends the second event to the state machine; the method for determining whether the state machine engine is matched with a preset mode according to the mode of the event of the received occurrence moment in a preset time period includes the following steps: and the state machine determines whether the event is matched with the preset pattern according to the pattern of the event belonging to the occurrence moment of the state machine within the preset time period.

When the events received by the state machine engine are events from different event sources, because each event has a unique event attribute, the state machine engine can classify at least two events according to different event sources to which the events belong, and classify the events of the same event source into one class.

If the at least two events are distributed through the route distribution device, the at least two events are distributed according to a certain attribute value or a certain group of attribute values carried by each event, so that the related events are guaranteed to be distributed to the same computing node. That is, the route distribution means distributes the relevant event to the same pattern matching means according to the event attribute.

The state machine engine can create different state machines according to the event source, the state machines receive the events in a classified mode according to the event attributes of the received events, the events belonging to a certain event source can enter the same state machine, and each state machine can register the timer of the state machine. When the occurrence time of the second event received by the same state machine is before the occurrence time of the first event, the second event may be subjected to an operation such as discarding. Therefore, for the mixed disorder event streams of different data sources, the pattern matching device can still perform pattern matching, so that the disorder of events among different services and different users is not interfered with each other, namely, the pattern matching of different time scenes of different event sources can be processed simultaneously.

With reference to the first possible implementation manner of the first aspect, in a second implementation manner of the first aspect, before the creating a state machine for the first event and registering a timer with the timing manager, the method further includes: and the state machine engine determines that no state machine which is matched with the event attribute of the first event exists currently according to the event attribute of the first event.

The state machine engine, when creating a state machine for a first event, first determines that there is currently no state machine that matches the event attributes of the first event. For example, a state machine allocated to a first event is referred to as a first state machine, and when a state machine engine receives a second event, it is also necessary to determine whether to match the first state machine according to an event attribute carried by the second event. If the second event is the same event source as the first event, that is, the event attribute of the second event matches the first state machine, the second event is sent to the first state machine. If the event attribute of the second event does not match the first state machine (i.e., the second event belongs to a different event source than the first event), a new state machine (which may be referred to as a "second state machine") is assigned to the second event. Accordingly, the second event can be regarded as a "first event" of the second state machine, i.e., the second state machine starts timing from the occurrence time of the second event. Thus, each state machine belonging to the same event source can independently perform pattern matching.

With reference to the first aspect and any one of the first possible implementation manner of the first aspect and the second possible implementation manner of the first aspect, in a third implementation manner of the first aspect, the timing manager starts to time from the occurrence time of the first event until a preset time threshold through the timer, and the method includes: the timer determines the occurrence time of the first event as a first time, wherein the first time is earlier than the time when the state machine engine receives the first event; when the timer steps from the first time to a second time at a first rate, the state machine engine receives a second event of the at least two events, wherein the occurrence time of the second event is a third time, the second time is later than the first time, and the third time is later than the second time; the timer steps from the second time to the third time at a second rate, the second rate being greater than the first rate.

The occurrence time of some or all of the at least two events is before the current time (i.e. earlier than the time when the state machine engine receives the first event). That is, for the historical accumulated events, after counting from a certain historical time, if the timer is stepped at a normal rate, the current event will be processed after all. Therefore, the embodiment of the invention can rapidly process the historical accumulated events through the time jump of the timer.

The timer determines the occurrence of the first event received by the state machine engine as a first time from which to start stepping at a natural rate (i.e., a first rate). If the second event is also a historical event, i.e., the second event has already occurred, then the state machine engine receives the second event of the at least two events, possibly when the timer steps to the second time, and the second event occurs later than the second time. At this point, the timer is no longer stepped at the natural rate, but is rapidly stepped to the third time at a rate faster than the natural rate (i.e., the second rate). That is, the timer makes a transition according to the time stamp, so that pattern matching of the history accumulated event can be rapidly processed. By analogy, the timer steps to a preset time threshold at a natural rate or according to the jump of the timestamp, that is, when the state machine engine does not receive a new event, the timer steps at the natural rate; when the state machine engine receives a new event, the timer will jump according to the timestamp (i.e. quickly step to the occurrence of the new event). Therefore, the embodiment of the invention can quickly carry out pattern matching on the historical cumulative events.

With reference to any one possible implementation manner of the first aspect to the third possible implementation manner of the first aspect, in a fourth implementation manner of the first aspect, the method further includes: and if the occurrence time of the second event is earlier than that of the first event, deleting the second event by the state machine engine.

In a second aspect, a pattern matching apparatus is provided, which includes modules for performing the method of the first aspect or any one of the implementation manners of the first aspect.

In a third aspect, a pattern matching apparatus is provided, including: a processor and a memory;

the memory stores a program that is executed by the processor for performing the method of pattern matching as described above in the first aspect or any one of the possible implementations of the first aspect.

Based on the above technical solution, in the method for pattern matching of the embodiment of the present invention, a state machine engine receives at least two events carrying event occurrence times sent by an event source, and registers a timer with a timing manager when receiving a first event of the at least two events, the timing manager starts timing from the occurrence time of the first event through the timer until a preset time threshold, and the state machine engine determines whether to match a preset pattern according to a pattern of the event of the received occurrence time within a preset time period, so that a pattern matching device can perform pattern matching according to the occurrence time of the event, thereby improving accuracy of pattern matching.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments of the present invention will be briefly described below, and it is obvious that the drawings described below are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1 is a schematic diagram of a pattern matching system architecture according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of an event source according to an embodiment of the invention;

FIG. 3 is a schematic diagram of a route distribution apparatus according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a pattern matching apparatus according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a computer device according to an embodiment of the present invention;

FIG. 6 is a flow chart illustrating a method of pattern matching according to one embodiment of the present invention;

FIG. 7 is a schematic diagram of a method of pattern matching according to another embodiment of the present invention;

FIG. 8 is a flow diagram illustrating a method of pattern matching according to another embodiment of the invention;

fig. 9 is a schematic diagram of a pattern matching apparatus according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Fig. 1 shows a schematic diagram of a pattern matching system architecture. The architecture includes an event source 110, a route distributor 120, a pattern matching cluster 130, and a complex event application 140.

Event source 110 refers to a system that generates raw events, such as various production systems or event probe systems, etc. As shown in fig. 2, an event source is a source that generates an event stream, which is composed of continuous events. Each event has a unique event Identification (ID), and the event content consists of a set of (e.g., 1 … … N) event attributes, each defined by an attribute name and corresponding data type. The attribute names and types of events with the same event ID are completely consistent.

As shown in fig. 3, since the pattern matching nodes are distributed clusters, the route distribution apparatus needs to distribute events according to a certain attribute value or a group of attribute values (inter-partition attributes) of the events, so that the related events can be distributed to the same computing node. The related concepts may be determined by the service, for example, pattern matching matches the correlation according to telephone numbers, and the route distribution means distributes according to the telephone numbers. The distribution algorithm uses a typical consistent Hash (Hash) algorithm, where the Hash ring is divided into several equal regions, each represented by a region identifier. In different events, as long as the partition values are the same, the calculated regions where the Hash values are located are necessarily the same. The routing distribution device ensures that the events of the same area identifier are distributed to the same node.

As shown in fig. 4, the pattern matching cluster 130 includes at least one pattern matching device, and the pattern matching device mainly includes two related modules, one is a state machine engine and the other is a timing manager. The basic principle of the state machine engine is: generating a finite state machine according to the scene of a business processing event, consuming an original event by the state machine, and carrying out state transition, wherein each state in the state machine necessarily has a time threshold, the control of the time threshold of the state is realized by a timing manager module, and when a certain state starts timing, the timing manager sends the time threshold to a state machine engine to trigger the state transition. That is, state transitions of the state machine are driven by both external primitive events and time thresholds. And when the state of the state machine finally changes to the end state, generating a complex event and sending the complex event. If the state machine fails to reach the end state and is destroyed, the event pattern cannot be matched or the matching fails.

For example, in an actual service scenario, the pattern matching device is used to find out the mobile phone numbers which send the messages more than 1000 in 5 minutes, pay special attention to the mobile phone numbers, and determine whether the mobile phone numbers send fraud messages. The state machine engine establishes a state for each mobile phone sending the short message (the state is established when the first short message event arrives), the time period of the state is 5 minutes, the state counts 1 after receiving a short message event, if the total number received in the state within 5 minutes exceeds 1000, a complex event is triggered, and the application of a certain number is told to meet the condition of service requirement, and extra attention needs to be paid. The backend application may notify the relevant system to perform the authentication of the content of the short message. On the contrary, if the time of 5 minutes is up and the count is not over 1000, the state machine is destroyed and no complex event is generated.

In the prior art, the timing manager takes the current system time as the standard, and performs pattern matching according to the time when an event reaches a state machine. A series of events are used as input to enter a pattern matching device, the pattern matching device carries out pattern matching calculation, and if the pattern matching device accords with a predefined pattern, the pattern matching device generates a complex event to be consumed by an application system. The predefined pattern includes a pattern in which the sequence and interval of events conform to the preset pattern, for example, there are four types of events ABC, and one matching pattern of the pattern matching apparatus is: the events occurred in the order of ACAB, and the interval between a and C events was not less than 10 minutes.

If the event is an event entering the pattern matching device as the event occurrence time, and the difference between the event entering the pattern matching device and the actual occurrence time is large, the matching result of the pattern matching device is likely to be wrong. For example, the delay of the front-end acquisition system, the acquired data is reported periodically, but not in real time; or events are piled up inside the system; or the throughput between each component in the stream system is not matched, the acquisition end fast mode matching device is slow, and the like, so that the time of the event entering the mode matching device is greatly different from the real time.

As shown in fig. 5, in the embodiment of the present invention, the state machine engine and the timing manager in fig. 4 may be implemented in the form of a computer device (or system) in fig. 5.

Fig. 5 is a schematic diagram of a computer device according to an embodiment of the present invention. The computer device 500 comprises at least one processor 201, a communication bus 202, a memory 203 and at least one communication interface 204.

The processor 201 may be a general purpose Central Processing Unit (CPU), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs in accordance with the inventive arrangements.

The communication bus 202 may include a path that conveys information between the aforementioned components. The communication interface 504 may be any device, such as a transceiver, for communicating with other devices or communication Networks, such as ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

The Memory 203 may be a Read-Only Memory (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical Disc storage, optical Disc storage (including Compact Disc, laser Disc, optical Disc, digital versatile Disc, blu-ray Disc, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to these. The memory may be self-contained and coupled to the processor via a bus. The memory may also be integral to the processor.

The memory 203 is used for storing application program codes for executing the scheme of the invention, and the processor 201 controls the execution. The processor 201 is configured to execute the application program 2031 stored in the memory 203 for performing the pattern matching method according to the embodiment of the present invention.

In particular implementations, computer device 200 may also include an output device 205 and an input device 206, as one embodiment. The output device 205 is in communication with the processor 201 and may display information in a variety of ways. For example, the output device 205 may be a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display device, a Cathode Ray Tube (CRT) display device, a projector (projector), or the like. The input device 206 is in communication with the processor 201 and can accept user input in a variety of ways. For example, the input device 206 may be a mouse, a keyboard, a touch screen device, or a sensing device, among others.

The computer device 200 described above may be a general purpose computer device or a special purpose computer device. In a specific implementation, the computer device 200 may be a desktop computer, a laptop computer, a web server, a Personal Digital Assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, or a device with a similar structure as in fig. 5. Embodiments of the present invention are not limited by the type of computer device 200.

Fig. 6 shows a flow diagram of a method 300 of pattern matching according to an embodiment of the invention. The method 300 is performed by a pattern matching apparatus that includes a timing manager and a state machine engine.

The state machine engine registers a timer with the timing manager upon receiving a first event of the at least two events 310, each of the at least two events carrying a respective occurrence time.

Specifically, the pattern matching apparatus has two related modules, one is a state machine engine and the other is a timing manager. The event source sends an event to the state machine engine, and the state machine engine receives the event, and the event carries the occurrence time (also referred to as "timestamp"). Registration of a timer in the timing manager may be triggered when the state machine engine receives the first event. The first event may be a first event of the at least two events, or may be any one of the at least two events. Accordingly, the pattern matching means performs pattern matching on the pattern formed by the received event subsequent to the first event.

The state machine engine can also create a state machine for the first event when receiving the first event, the state machine can be created in advance, and when the state machine engine receives the first event, a state machine is allocated to the first event from the state machine created in advance; or when the state machine engine receives the first event, a new state machine is created for the first event, for convenience of description, the embodiment of the present invention takes the case where the state machine engine creates the new state machine when receiving the first event, but the present invention is not limited to this.

And 320, when the at least two events come from a single event source, and the state machine engine receives a second event of the at least two events, because the second event and the first event belong to the same event source, that is, the event attribute of the second event can be matched with the state machine to which the first event belongs. Thus, the state machine engine may send the second event directly to the state machine to which the first event belongs.

It should be understood that the event received by the state machine engine in the mode matching apparatus may be directly sent by the event source, or may be sent to the state machine engine after being distributed by the route distribution apparatus, or may be further processed by other apparatuses, and the present invention is not limited thereto.

Optionally, if the occurrence time of the second event is earlier than the occurrence time of the first event, the second event is deleted.

When the same event source sends an event to the state machine engine, the event is ordered, namely the event with the early occurrence moment enters the pattern matching device firstly. If the events received by the same state machine are out of order, that is, the occurrence time of the second event (the currently received event) of the at least two received events is before the occurrence time of the first event (the last event), the mode device may perform operations such as discarding the second event, which is not limited in the present invention.

The timing manager determines the occurrence time of the first event as a first time through the timer 330, which is earlier than the time when the state machine engine receives the first event.

340, when the timer steps from the first time to a second time at a first rate, the state machine engine receives a second event of the at least two events, the second event occurring at a third time, the second time being later than the first time, the third time being later than the second time.

The timer determines the occurrence of the first event received by the state machine engine as a first time from which to start stepping at a natural rate (i.e., a first rate). If the second event is also a historical event, i.e., the second event has already occurred, then the state machine engine receives the second event of the at least two events, possibly when the timer steps to the second time, and the second event occurs later than the second time.

350, the timer being stepped from the second time to the third time at a second rate, the second rate being greater than the first rate.

At this point, the timer is no longer stepped at the natural rate, but is rapidly stepped to the third time at a rate faster than the natural rate (i.e., the second rate). That is, the timer makes a transition according to the time stamp, so that pattern matching of the history accumulated event can be rapidly processed.

And 360, the timer is stepped to an nth time from the third time at the first rate or the second rate, a time range between the nth time and the first time is the preset time period, and the nth time is later than the third time.

By analogy, the timer steps to a preset time threshold at a natural rate or according to a jump of the timestamp, where the preset time threshold may be set when the timer is registered according to a requirement, or a default time period may be set for the mode matching device when the device leaves a factory, and the like, and the present invention is not limited thereto. That is, when the state machine engine does not receive a new event, the timer steps at a natural rate; when the state machine engine receives a new event, the timer will jump according to the timestamp (i.e. quickly step to the occurrence of the new event). Therefore, the embodiment of the invention can quickly carry out pattern matching on the historical cumulative events.

Optionally, for historical events, pattern matching is continuously performed on the monitored events occurring within a certain time period from a certain moment to the current time, as shown in fig. 7, Tm on a time axis is the current time of the system. Then registering a timer from a certain moment in history, and after timing, performing pattern matching within a preset time period. As shown in fig. 7(a), when the time T2 is a time period, in a preset time period, it is determined whether to match the preset pattern according to the pattern of the received event, and if the matching is successful, the pattern matching apparatus is triggered to generate a complex event. The timer starts from T2 and goes to the next cycle, stepping at a first rate if no new events are received by the state machine engine. As shown in fig. 7(B), when the timer steps to a time T4 at the first rate, the event 3 is received, and the occurrence time of the event 3 is T6, the timer rapidly jumps (i.e., at the second rate) from the time T4 to a time T6, wherein the time range between the time T5 and the time T2 is a preset time period, i.e., to a time T5, a cycle is completed, and the timer starts to count from the time T5 and enters a next cycle. In the period, if the pattern matching is successful, the pattern matching device is triggered again to generate a complex event. By analogy, as shown in fig. 7(C), when the state machine engine receives a new event, the timer rapidly jumps to the occurrence time of the new event, and if the state machine engine does not receive the new event, the timer steps at a natural rate.

The state machine engine determines whether it matches a preset pattern according to a pattern of events occurring within a preset time period 370.

Specifically, the state machine engine continuously receives events sent by an event source, triggers state transition of the state machine and calculation of various attributes in the state machine, and accordingly performs pattern matching according to occurrence time of a series of received events to determine whether a preset pattern is met. The pattern can be described by a complex regular expression, and specifically, the pattern can be a context of a plurality of events, a number of events, an interval relationship between events, and the like.

For example, the number of calls made within 1 minute after 3:00:00:00 pm on wednesday (friday today) is determined for a locked cell phone number to determine if the cell phone number is the desired cell phone number to look for. The first phone dialing from 3:00:00 starts the state machine engine to establish a state machine for the mobile phone, and registers a timer on the timing manager, the sending time of the first short message is 3 o' clock 0 min 0 sec (3:00:00), the timer starts to time from the moment, the timer steps by one second (natural speed), when the time is 3:00:02, the state machine receives the 2 nd phone event dialed by the mobile phone, but the time dialed by the mobile phone is 3:00:06, then the timer steps by two seconds and then by two seconds to 3:00: 06. And then, the timer is still stepped by one second for one second until the 3 rd telephone event is received, the timer jumps to the occurrence moment of the 3 rd telephone event until the 3:01:00 is reached, and the state machine can determine the number of the calls dialed by the mobile phone, so as to determine whether the locked mobile phone number is the mobile phone number to be searched.

Therefore, in the method for pattern matching according to the embodiment of the present invention, a state machine engine receives at least two events carrying event occurrence times sent by an event source, and registers a timer with a timing manager when a first event of the at least two events is received, the timing manager starts timing from the occurrence time of the first event through the timer until a preset time threshold, and the state machine engine determines whether to match a preset pattern according to a pattern of the event of the received occurrence time within a preset time period, so that a pattern matching device can quickly perform pattern matching on a historical event according to the occurrence time of the event, thereby improving a rate and an accuracy of pattern matching.

It should be understood that, in various embodiments of the present invention, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

Fig. 8 shows a flow diagram of a method 500 of pattern matching according to another embodiment of the invention. The method 500 is performed by a pattern matching apparatus that includes a timing manager and a state machine engine.

The state machine engine receives at least two events from different event sources, each of the at least two events including a respective event attribute 510.

Specifically, when the events received by the state machine engine are events from different event sources, the event attributes of the events from different event sources are different because each event has a unique event attribute. In this way, the state machine engine may classify the events of the at least two events according to the different event sources to which the events belong, and classify the events of the same event source into one class.

If the at least two events are distributed through the route distribution device, the at least two events are distributed according to a certain attribute value or a certain group of attribute values carried by each event to ensure that the related events are distributed to the same computing node, for example, the pattern matching is performed with the correlation matching according to the telephone number, and the route distribution device can perform the distribution according to different telephone numbers. That is, the route distribution means distributes the relevant event to the same pattern matching means according to the event attribute.

Alternatively, the routing distribution device generally adopts a typical consistent hash algorithm, and the hash ring is divided into a plurality of equal areas, and each area can be represented by an area identifier. And as long as the partition key values of different events are the same, the areas where the calculated hash values are located are the same, and the routing distribution device distributes the events of the same area identifier to the same calculation node.

The state machine engine registers a timer with the timing manager upon receiving a first event of the at least two events, each of the at least two events carrying a respective occurrence time 520.

Specifically, the state machine engine may create different state machines according to the event source to which the state machine belongs, and the state machines receive the events in a classified manner according to the event attributes of the received events, so that the events belonging to each event source enter the same state machine, and each state machine may register its own timer. The state machine engine, upon receiving a first event, creates a state machine for the first event, registers with a timer belonging to a source of the first event in the timing manager, and starts timing from an occurrence time of the first event.

The timing manager determines an occurrence time of a first event as a first time earlier than a time when the state machine engine receives the first event through the timer 530.

The timing manager respectively steps through respective timers in different state machines, and mutual influence cannot be caused. For example, for a state machine belonging to a first event source, timing is started with the occurrence time of the first event as a first time. To avoid repetition, further description is omitted here.

540, when the timer steps from the first time to a second time at a first rate, the state machine engine receives a second event of the at least two events, the second event occurring at a third time, the second time being later than the first time, the third time being later than the second time.

The state machine engine may create different state machines according to the event source to which the state machine engine belongs, for example, the state machine allocated to the first event is referred to as a first state machine, and when the state machine engine receives the second event, it is determined whether the state machine engine matches the first state machine according to the event attribute carried by the second event. If the second event is the same event source as the first event, that is, the event attribute of the second event matches the first state machine, the second event is sent to the first state machine. This enables the state machine engine to classify according to the event attributes of the received event, thereby enabling to determine whether the event pattern belonging to the first event source matches a preset pattern. If the events received by the first state machine are out of order, that is, the occurrence time of the second event is before the occurrence time of the first event, the second event may be subjected to operations such as discarding, which is not limited in the present invention.

It should be noted that, if the event attribute of the second event does not match the first state machine (i.e., the second event and the first event belong to different event sources), a new state machine (which may be referred to as a "second state machine") is assigned to the second event. Accordingly, the second event can be regarded as a "first event" of the second state machine, i.e., the second state machine starts timing from the occurrence time of the second event.

In summary, different state machines are created for different event sources, each state machine independently performs pattern matching, and different event sources cannot be influenced with each other, so that the pattern matching device can simultaneously process the pattern matching of different time scenes of different event sources.

It should be noted that each timer has its own current time and does not interfere with each other, and the embodiment of the present invention takes the example that different state machines are created by different event sources, but different state machines can be created by flexibly setting a distinguishing characteristic according to the characteristics of the mode matching device access device, and all of them fall within the scope of the present invention.

It should be understood that in embodiments of the present invention, the timer (or may be referred to as a "virtual clock") is different from the system clock, and there may be thousands of virtual clocks inside one pattern matching apparatus.

The timer steps from the second time instant to the third time instant at a second rate, the second rate being greater than the first rate 550.

S550 in this embodiment may refer to the description of S350 in the foregoing embodiment of fig. 6, and is not described herein again to avoid repetition.

560, the timer is stepped from the third time to an nth time at the first rate or the second rate, a time range between the nth time and the first time is the preset time period, and the nth time is later than the third time.

S560 in this embodiment may refer to the description of S360 in the foregoing embodiment of fig. 6, and is not described here again to avoid repetition.

570, the state machine engine determines whether to match a preset pattern according to a pattern of events occurring within a preset time period.

The state machine engine receives the events sent by the event source, triggers state transition of the state machine and calculation of various attributes in the state machine, and accordingly matches whether a series of received events meet a preset mode or not. The pattern can be described by a complex regular expression, and specifically, the pattern can be a context of a plurality of events, a number of events, an interval relationship between events, and the like.

Therefore, in the method for pattern matching according to the embodiment of the present invention, a state machine engine receives at least two events carrying event occurrence times sent by an event source, and registers a timer with a timing manager when a first event of the at least two events is received, the timing manager starts timing from the occurrence time of the first event through the timer until a preset time threshold, and the state machine engine determines whether to match a preset pattern according to a pattern of the event of the received occurrence time within a preset time period, so that a pattern matching device can perform pattern matching on events of different event sources and different time scenes according to the occurrence time of the event, thereby improving accuracy of pattern matching.

The method of pattern matching according to an embodiment of the present invention is described in detail above with reference to fig. 6, 7, and 8, and the pattern matching apparatus according to an embodiment of the present invention is described in detail below with reference to fig. 9.

Fig. 9 shows a schematic block diagram of a pattern matching apparatus 700 according to an embodiment of the present invention. As shown in fig. 9, the apparatus 700 includes: a state machine engine 710 and a timing manager 720;

the state machine engine 710 is configured to register a timer with the timing manager when a first event of at least two events sent by an event source is received, where each event of the at least two events carries a respective occurrence time;

the timing manager 720, configured to start timing from the occurrence time of the first event to a preset time threshold through the timer;

the state machine engine 710 is further configured to determine whether the received pattern of the event whose occurrence time is within a preset time period is matched with a preset pattern, where the preset time period is a time range between the occurrence time of the first event and the preset time threshold.

Therefore, in the pattern matching device of the embodiment of the present invention, the state machine engine receives at least two events carrying event occurrence times sent by an event source, and registers the timer with the timing manager when receiving a first event of the at least two events, the timing manager starts timing from the occurrence time of the first event through the timer until a preset time threshold, and the state machine engine determines whether to match with a preset pattern according to a pattern of the event of the received occurrence time within the preset time period, so that the pattern matching device can perform pattern matching according to the occurrence time of the event, thereby improving accuracy of pattern matching.

Optionally, in this embodiment of the present invention, the at least two events are directly sent by different or the same event source, or sent by different or the same event source through the route distribution device, where each of the at least two events carries a respective event attribute;

the state machine engine 710, further configured to, upon receiving the first event, create a state machine for the first event and register a timer with the timing manager;

the state machine engine 710 is further configured to receive a second event of the at least two events, where an occurrence time of the second event is later than an occurrence time of the first event;

the state machine engine 710 is further configured to send the second event to the state machine if the event attribute of the second event matches the state machine;

the state machine engine 710 is further configured to determine, by the state machine, whether to match the preset pattern according to a pattern of events belonging to the state machine within the preset time period of the occurrence time.

In this embodiment of the present invention, optionally, the state machine engine 710 is further configured to determine, before creating a state machine for the first event and registering a timer with the timing manager, that there is no state machine currently matching the event attribute of the first event according to the event attribute of the first event.

Optionally, in this embodiment of the present invention, the timing manager 720 is specifically configured to:

the timer determines the occurrence time of the first event as a first time, wherein the first time is earlier than the time when the state machine engine receives the first event;

when the timer steps from the first time to a second time at a first rate, the state machine engine receives a second event of the at least two events, wherein the occurrence time of the second event is a third time, the second time is later than the first time, and the third time is later than the second time;

the timer steps from the second time to the third time at a second rate, the second rate being greater than the first rate.

Optionally, in this embodiment of the present invention, the state machine engine 710 is further configured to:

and if the occurrence time of the second event is earlier than that of the first event, deleting the second event.

Therefore, in the pattern matching device of the embodiment of the present invention, the state machine engine receives at least two events carrying event occurrence times sent by an event source, and registers the timer with the timing manager when receiving a first event of the at least two events, the timing manager starts timing from the occurrence time of the first event through the timer until a preset time threshold, and the state machine engine determines whether to match with a preset pattern according to a pattern of the event of the received occurrence time within the preset time period, so that the pattern matching device can perform pattern matching on the events of different event sources in different time scenarios according to the occurrence time of the event, thereby improving accuracy of pattern matching.

It should be understood that the pattern matching apparatus 700 according to the embodiment of the present invention may correspond to an execution body of the method for pattern matching according to the embodiment of the present invention, and the above and other operations and/or functions of each module in the pattern matching apparatus 700 are respectively for implementing corresponding steps of each method described above, and are not described herein again for brevity.

It should be understood that the term "and/or" herein is merely one type of association relationship that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A method of pattern matching, the method being applied to a pattern matching apparatus, the pattern matching apparatus comprising a state machine engine and a timing manager, the method comprising:

the method comprises the steps that when a state machine engine receives a first event of at least two events sent by an event source, a timer is registered in a timing manager, and each event of the at least two events carries a respective occurrence time;

the timing manager starts timing from the occurrence moment of the first event through the timer until a preset time threshold value;

and the state machine engine determines whether the pattern is matched with a preset pattern according to the pattern of the received event of which the occurrence moment is within a preset time period, wherein the preset time period is a time range between the occurrence moment of the first event and the preset time threshold.

2. The method according to claim 1, wherein the at least two events are sent directly by different or the same event source or sent by different or the same event source via a routing distribution apparatus, and each of the at least two events carries a respective event attribute;

wherein the registering, by the state machine engine, the timer with the timing manager upon receiving a first event of the at least two events sent by the event source comprises:

the state machine engine, upon receiving the first event, creating a state machine for the first event and registering a timer with the timing manager; the state machine engine receives a second event of the at least two events, wherein the occurrence time of the second event is later than that of the first event; if the event attribute of the second event is matched with the state machine, the state machine engine sends the second event to the state machine;

the method for determining whether the state machine engine is matched with a preset mode according to the mode of the event of the received occurrence moment in a preset time period includes the following steps:

and the state machine determines whether the event is matched with the preset pattern according to the pattern of the event belonging to the state machine within the preset time period at the occurrence moment.

3. The method of claim 2, wherein prior to said creating a state machine for said first event and registering a timer with said timing manager, said method further comprises:

and the state machine engine determines that no state machine matched with the event attribute of the first event exists currently according to the event attribute of the first event.

4. The method according to any one of claims 1 to 3, wherein the timing manager starts timing from the occurrence time of the first event until a preset time threshold by the timer, and comprises:

the timer steps from the second time instant to the third time instant at a second rate, the second rate being greater than the first rate.

5. A method according to claim 2 or 3, characterized in that the method further comprises:

and if the occurrence time of the second event is earlier than that of the first event, deleting the second event by the state machine engine.

6. A pattern matching apparatus, characterized in that the pattern matching apparatus comprises a state machine engine and a timing manager;

the state machine engine is configured to register a timer with the timing manager when a first event of at least two events sent by an event source is received, where each event of the at least two events carries a respective occurrence time;

the timing manager is used for starting timing from the occurrence moment of the first event through the timer until a preset time threshold value;

the state machine engine is configured to determine whether the received event pattern of the occurrence time within a preset time period matches a preset pattern, where the preset time period is a time range between the occurrence time of the first event and the preset time threshold.

7. The pattern matching apparatus according to claim 6, wherein the at least two events are directly sent by different or the same event source, or sent by different or the same event source via a route distribution apparatus, and each of the at least two events carries a respective event attribute;

the state machine engine is further used for creating a state machine for the first event and registering a timer with the timing manager when the first event is received;

the state machine engine is further configured to receive a second event of the at least two events, where an occurrence time of the second event is later than an occurrence time of the first event;

the state machine engine is further configured to send the second event to the state machine if the event attribute of the second event matches the state machine;

the state machine engine is further configured to determine, by the state machine, whether to match the preset pattern according to a pattern of an event belonging to the state machine within the preset time period at the occurrence time.

8. The pattern matching apparatus of claim 7, wherein the state machine engine is further configured to determine, before the creating of the state machine for the first event and the registering of the timer with the timing manager, that there is no state machine currently matching the event attribute of the first event according to the event attribute of the first event.

9. The pattern matching apparatus according to any of claims 6 to 8, wherein the timing manager is specifically configured to:

10. The pattern matching apparatus of claim 7 or 8, wherein the state machine engine is further configured to: