CN110109672B - Analysis processing method and device for expression - Google Patents

Abstract

The embodiment of the present invention discloses a method and device for parsing and processing expressions. The method includes: counting all the expressions of the event processing language in the current network security rule engine to obtain the statistical quantity of each expression, and according to each expression determine the public expression; when parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, then it is judged whether the target public expression corresponding to the target expression is parsed If the target public expression has been parsed, the parsing result of the target expression is obtained according to the parsing result of the target public expression. In the embodiment of the present invention, by determining the public expression of the event processing language, in the parsing process of the expression, the parsing result of the parsed public expression is directly used, which greatly saves parsing time and reduces memory consumption.

Description

Method and device for parsing and processing expressions

technical field

Embodiments of the present invention relate to the field of network security technologies, and in particular to a method and device for parsing and processing expressions.

Background technique

EPL (Event Process Language, Event Processing Language) is widely used in DSL (Domain Specified Language, Domain Specified Language) writing of network security rule engine.

The event processing language contains a large number of expressions. When parsing the event processing language in the prior art, the expressions are parsed one by one, which has high time complexity and consumes too much memory.

Contents of the invention

Since the above-mentioned problems exist in the existing methods, the embodiments of the present invention propose a method and device for parsing and processing expressions.

In the first aspect, the embodiment of the present invention proposes an expression analysis processing method, including:

Make statistics on all expressions of the event processing language in the current network security rule engine, obtain the statistical quantity of each expression, and determine the common expression according to the statistical quantity of each expression;

When parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, it is judged whether the target public expression corresponding to the target expression has been parsed;

If the target public expression has been parsed, the parsing result of the target expression is obtained according to the parsing result of the target public expression.

In the second aspect, the embodiment of the present invention also proposes an expression analysis processing device, including:

The expression statistics module is used to make statistics on all the expressions of the event processing language in the current network security rule engine, obtain the statistical quantity of each expression, and determine the common expression according to the statistical quantity of each expression;

The parsing and judging module is used for parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, then judge whether the target public expression corresponding to the target expression has been parsed;

The result acquisition module is configured to obtain the analysis result of the target expression according to the analysis result of the target public expression if the target public expression has been analyzed.

In the third aspect, the embodiment of the present invention also proposes an electronic device, including:

at least one processor; and

at least one memory communicatively coupled to the processor, wherein:

The memory stores program instructions that can be executed by the processor, and the processor can execute the above method by calling the program instructions.

In a fourth aspect, an embodiment of the present invention also provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores a computer program, and the computer program causes the computer to execute the above method.

It can be seen from the above technical solution that the embodiment of the present invention determines the public expression of the event processing language, and directly adopts the parsing result of the parsed public expression in the parsing process of the expression, which greatly saves parsing time and reduces memory consumption.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of an expression analysis processing method provided by an embodiment of the present invention;

Fig. 2 is a schematic flow chart of the quantity statistics of an expression provided by an embodiment of the present invention;

FIG. 3 is a schematic flowchart of an expression analysis processing method provided by another embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an expression analysis processing device provided by an embodiment of the present invention;

Fig. 5 is a logic block diagram of an electronic device provided by an embodiment of the present invention.

detailed description

The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to illustrate the technical solution of the present invention more clearly, but not to limit the protection scope of the present invention.

Figure 1 shows a schematic flowchart of an expression analysis processing method provided in this embodiment, including:

S101. Make statistics on all the expressions of the event processing language in the current network security rule engine, obtain the statistical quantity of each expression, and determine a common expression according to the statistical quantity of each expression.

Wherein, the statistical quantity is the number of times each expression appears in the event processing language.

The common expression is an expression whose occurrence times is greater than 1 in the event processing language.

Specifically, the event processing language in the current network security rule engine is composed of several expressions, which are stored in a tree structure in the specific storage process, and each leaf node in the tree structure is an expression. When parsing the event processing language, each expression node in the tree structure needs to be parsed in turn, but in the actual process, there are multiple sets of the same expression nodes in the tree structure, that is, multiple sets of common expressions , each group of common expressions includes multiple identical expressions, that is, the statistical quantity of the expressions is greater than 1.

S102. When parsing the target expression of the event processing language, if it is determined that the target expression is a common expression, then determine whether the target common expression corresponding to the target expression has been parsed.

Wherein, the target expression is an expression divided into common expressions.

The target public expression is a public expression corresponding to the target expression.

Specifically, after the expression statistics of the event processing language are completed, each expression of the event processing language needs to be analyzed one by one. If the currently parsed target expression is a public expression, it means that the target expression may have been parsed before.

S103. If the target public expression has been parsed, obtain the parsing result of the target expression according to the parsing result of the target public expression.

Specifically, since the target expression is a public expression, the target expression and another expression are the same target public expression, and the target public expression has been parsed before, and since the expressions are the same, the parsing result is also the same , so the parsing result of the target expression can directly adopt the parsing result of the target public expression. By reusing the parsing results of common expressions, the parsing speed of the event processing language is accelerated, thereby improving the performance of the network security rule engine.

This embodiment can be applied in the field of network security technology. By determining the public expression of the event processing language, in the parsing process of the expression, the parsing result of the parsed public expression is directly used, which greatly saves parsing time, and at the same time Reduced memory consumption.

Further, on the basis of the above method embodiments, S101 specifically includes:

Count all the expressions in the event processing language in a recursive manner to obtain the statistical quantity of each expression, store the expressions with a statistical quantity greater than 1 in the public node set, and determine all the expressions in the public node set is a public expression.

Wherein, the set of common nodes is a set storing common expressions.

By setting the set of public nodes, it is convenient to store public expressions during expression statistics, and at the same time, it is convenient to quickly determine whether the currently parsed expression is a public expression during expression parsing.

Further, on the basis of the above method embodiments, in S101, recursively count all the expressions of the event processing language to obtain the statistical quantity of each expression, specifically including:

S1011. When making statistics on the current expression of the event processing language, judge whether the node mapping of the current expression exists in the general expression context.

S1012. If the current expression already exists in the node map, add 1 to the statistical quantity of the first target node existing in the node map.

S1013. If the current expression does not exist in the node map, add the second target node corresponding to the current expression to the node map, and set the statistical quantity of the second target node to 1.

S1014. Continue to perform statistics on child expressions of the current expression.

Wherein, the node mapping of the general expression context is used to store the parsing results of each expression, and the parsing results of common expressions are only stored once.

Specifically, the foregoing embodiments may also include:

S104. If the target public expression has not been parsed, parse the target public expression, and store the parsed result in the general node code mapping.

The first target node is an existing expression in the node map.

The second target node is an expression that does not exist in the node map.

The general node code map is used to store the parsing results of each expression.

In the specific statistical process, as shown in Figure 2, firstly, the EPL (event processing language) is parsed into an abstract syntax tree, and the abstract syntax tree is recursively parsed by the general expression optimizer, and each node corresponding to the abstract syntax tree is Count the expressions; if there is no node mapping for the current expression node, add the current expression node to the node mapping, set the node count (statistics) to 1, and continue recursively parsing the child nodes of the current expression node; If there is a node mapping for the current expression node, the node count (statistics) of the current expression node is incremented, and the child nodes of the current expression node are no longer recursively parsed; after the abstract syntax tree is traversed, the node mapping is traversed, and the node Expression nodes with a count greater than 1 are added to the public node collection.

That is: for the first target node that already has an expression in the node map, it means that the expression is a public expression, and there is no need to add it to the node map, and it is only necessary to add 1 to the statistical quantity of the corresponding expression in the node map. Yes; for the first target node that does not have an expression in the node map, it means that the expression has not been counted, and it needs to be added to the node map, and the statistical quantity of the expression in the node map is set to 1. Since each expression in the event processing language is stored in a tree structure, it is necessary to perform recursive statistics during the statistical process, and continue to count the child expressions of the current expression; if the current expression has no child expressions, count its sibling expressions If there is no sibling expression, it means that the statistics of the event processing language have been completed. At this time, all non-repeated expressions and the statistical quantity of each expression are stored in the node map. If the statistical quantity is greater than 1, it is a public expression.

Each expression and its statistical quantity are stored through the node mapping of the general expression context, so as to facilitate and quickly determine the common expression.

Further, on the basis of the above method embodiments, S102 specifically includes:

S1021. When parsing the target expression of the event processing language, if it is judged that the target expression is in the public node set, determine that the target expression is a public expression.

S1022. Determine whether the target public expression has been parsed according to whether there is a parsing result of the target public expression corresponding to the target expression in the general node code mapping.

Specifically, since the public expressions are stored in the public node collection during the expression statistics process, when parsing the expression, it can be directly determined whether it is a public expression according to whether the current expression exists in the public node collection, Convenient.

After it is determined that it is a public expression, if the target public expression corresponding to the public expression has been parsed, there is no need to perform secondary parsing, and the parsing result of the target public expression can be obtained directly from the general node code map, which can Greatly saves parsing time.

Referring to Figure 3, the abstract syntax tree is recursively processed by the expression generator. If the current expression node is in the public node set, it is judged whether there is a parsing result corresponding to the current expression node in the general node code map, and if it exists, it returns the public If the analysis result stored in the node code map does not exist, the current expression node will be parsed and the analysis result will be stored in the public node code map; after judging whether there is an analysis result corresponding to the current expression node in the general node code map After that, the child nodes of the current expression node will not be recursively parsed; if the current expression node is not in the public node set, the current expression node will be parsed to obtain the parsing result, and the child nodes of the current expression node will continue to be recursively processed. Until the abstract syntax tree is traversed.

The parsing and processing method of public expressions provided by this embodiment can solve the problem of poor parsing performance of public expressions in event processing languages. By converting all expressions in event processing language expressions in advance and extracting the common parts of expressions, it is guaranteed that events Under the premise of correct parsing of the processing language, the parsing results of common expressions are reused, which speeds up the parsing speed of the event processing language, improves the performance of the network security rule engine, and reduces the time complexity. At the same time, the parsing results of public expressions will only One copy is stored in memory, thereby saving memory usage, reducing space complexity, and saving cost.

FIG. 4 shows a schematic structural diagram of an expression analysis and processing device provided in this embodiment. The device includes: an expression statistics module 401, an analysis and judgment module 402, and a result acquisition module 403, wherein:

The expression statistics module 401 is used to perform statistics on all expressions of the event processing language in the current network security rule engine, obtain the statistical quantity of each expression, and determine the public expression according to the statistical quantity of each expression;

The parsing and judging module 402 is used to parse the target expression of the event processing language, if it is judged that the target expression is a public expression, then judge whether the target public expression corresponding to the target expression is parsed Pass;

The result acquisition module 403 is configured to obtain the analysis result of the target expression according to the analysis result of the target public expression if the target public expression has been parsed.

Specifically, the expression statistics module 401 performs statistics on all the expressions of the event processing language in the current network security rule engine, obtains the statistical quantity of each expression, and determines the public expression according to the statistical quantity of each expression; When the parsing and judging module 402 parses the target expression of the event processing language, if it is judged that the target expression is a public expression, then it is judged whether the target public expression corresponding to the target expression has been parsed; If the target public expression has been parsed, the result obtaining module 403 obtains the parsing result of the target expression according to the parsing result of the target public expression.

In this embodiment, by determining the common expressions of the event processing language, in the parsing process of the expressions, the parsing results of the parsed public expressions are directly used, which greatly saves parsing time and reduces memory consumption.

Further, on the basis of the above-mentioned device embodiment, the expression statistics module 401 is specifically used to recursively count all expressions of the event processing language to obtain the statistical quantity of each expression, and count the statistical quantity greater than 1 The expressions are stored in the public node set, and all expressions in the public node set are determined as public expressions.

Further, on the basis of the above device embodiments, the expression statistics module 401 is specifically used for:

When performing statistics on the current expression of the event processing language, it is judged whether the node mapping of the current expression exists in the general expression context;

If the current expression already exists in the node mapping, add 1 to the statistical quantity of the first target node existing in the node mapping;

If the current expression does not exist in the node map, adding a second target node corresponding to the current expression to the node map, and setting the statistical quantity of the second target node to 1;

Continue to perform statistics on child expressions of the current expression.

Further, on the basis of the above device embodiments, the parsing and judging module 402 is specifically used for:

When parsing the target expression of the event processing language, if it is judged that the target expression is in the public node set, then determine that the target expression is a public expression;

Determine whether the target public expression has been parsed according to whether there is a parsing result of the target public expression corresponding to the target expression in the general node code mapping.

Further, on the basis of the above device embodiment, the device further includes:

An expression parsing module, configured to parse the target public expression if the target public expression has not been parsed, and store the parsed result in the general node code mapping.

The apparatus for parsing and processing expressions described in this embodiment can be used to execute the above-mentioned method embodiments, and its principles and technical effects are similar, and will not be repeated here.

Referring to FIG. 5, the electronic device includes: a processor (processor) 501, a memory (memory) 502 and a bus 503;

in,

The processor 501 and the memory 502 complete mutual communication through the bus 503;

The processor 501 is configured to invoke program instructions in the memory 502 to execute the methods provided in the above method embodiments.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by the computer, the computer The methods provided by the foregoing method embodiments can be executed.

This embodiment provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the foregoing method embodiments.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

It should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it still can The technical solutions described in the foregoing embodiments are modified, or some of the technical features are replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. An analytical processing method of an expression, which is applied to the technical field of network security, is characterized in that, comprising: Count all the expressions in the event processing language in a recursive manner to obtain the statistical quantity of each expression, store the expressions with a statistical quantity greater than 1 in the public node set, and determine all the expressions in the public node set is a public expression; When parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, it is judged whether the target public expression corresponding to the target expression has been parsed; If the target public expression has been parsed, then according to the parsing result of the target public expression, the parsing result of the target expression is obtained; Wherein, the recursive method is used to count all the expressions of the event processing language to obtain the statistical quantity of each expression, specifically including: When performing statistics on the current expression of the event processing language, it is judged whether the node mapping of the current expression exists in the general expression context; If the current expression already exists in the node mapping, add 1 to the statistical quantity of the first target node existing in the node mapping; If the current expression does not exist in the node map, adding a second target node corresponding to the current expression to the node map, and setting the statistical quantity of the second target node to 1; Continue to perform statistics on child expressions of the current expression. 2. The method according to claim 1, wherein when parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, then it is judged that the target expression Whether the target public expression corresponding to the formula has been parsed, including: When parsing the target expression of the event processing language, if it is judged that the target expression is in the public node set, then determine that the target expression is a public expression; Determine whether the target public expression has been parsed according to whether there is a parsing result of the target public expression corresponding to the target expression in the general node code mapping. 3. The method according to claim 2, wherein the method further comprises: If the target public expression has not been parsed, the target public expression is parsed, and the parsed result is stored in the general node code mapping. 4. A device for parsing and processing expressions, applied to the technical field of network security, characterized in that, comprising: The expression statistics module is used to recursively count all the expressions of the event processing language, obtain the statistical quantity of each expression, store the expressions with a statistical quantity greater than 1 in the public node set, and store the public node All expressions in the set are determined to be public expressions; The parsing and judging module is used for parsing the target expression of the event processing language, if it is judged that the target expression is a public expression, then judge whether the target public expression corresponding to the target expression has been parsed; A result acquisition module, configured to obtain the analysis result of the target expression according to the analysis result of the target public expression if the target public expression has been parsed; Wherein, the expression statistics module is specifically used for: When performing statistics on the current expression of the event processing language, it is judged whether the node mapping of the current expression exists in the general expression context; If the current expression already exists in the node mapping, add 1 to the statistical quantity of the first target node existing in the node mapping; If the current expression does not exist in the node map, adding a second target node corresponding to the current expression to the node map, and setting the statistical quantity of the second target node to 1; Continue to perform statistics on child expressions of the current expression. 5. The device according to claim 4, wherein the parsing and judging module is specifically used for: When parsing the target expression of the event processing language, if it is judged that the target expression is in the public node set, then determine that the target expression is a public expression; Determine whether the target public expression has been parsed according to whether there is a parsing result of the target public expression corresponding to the target expression in the general node code mapping. 6. The device according to claim 5, further comprising: An expression parsing module, configured to parse the target public expression if the target public expression has not been parsed, and store the parsed result in the general node code mapping. 7. An electronic device, characterized in that it comprises: at least one processor; and at least one memory communicatively coupled to the processor, wherein: The memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the method as claimed in any one of claims 1 to 3 . 8. A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores a computer program, and the computer program enables the computer to execute the computer program according to any one of claims 1 to 3. Methods.

Images