JPH0397343A - Data monitor equipment - Google Patents

Abstract

PURPOSE:To search data with lots of strings at a high speed by providing a table to store a pointer pointing out an address of a succeeding page in advance to an address of each page corresponding to the data subject to search and using the pointer so as to discriminate whether or not plural consecutive data have specific patterns through the use of the pointer. CONSTITUTION:Line data D, A, B...C inputted sequentially via a communication line interface 1 are stored sequentially in the address area in a large capacity memory 2. A pointer pointing out an address of a succeeding page in advance is stored in an address of each page of a management table 7 corresponding to a searched data pattern (such as data A, B, C), an interrupt pointer INT is stored in an address of a page of the management table 7 corresponding to the last data pattern C, the data stored in the large capacity memory 2 is used as an address of the management table 7 to read a pointer and 3 consecutive data stored in the large capacity memory 2 are discriminated as to whether they are patterns A, B, C by using the pointer.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of Industrial Application The present invention relates to a data monitoring device that sequentially temporarily stores data on a communication line in a buffer memory and searches at high speed whether or not a plurality of consecutive pieces of data correspond to a specific pattern. Regarding.

Conventional technology Generally, when analyzing events on a communication line, data on the communication line is imported data by data into a large capacity storage device (buffer memory) such as an IOOM byte hard disk, and a plurality of consecutive pieces of data are analyzed to identify a specific pattern. Search whether or not.

FIG. 5 is a flowchart for explaining the operation of a conventional data monitor device. In this example, buffer memory addresses DATAO, DATAI, DATA2.
The input data stored sequentially in ... is data pattern A.
, B, and C.

In step 51, the address of the buffer memory is set to address DATAO, and in the subsequent step 52, the data at that address is compared with the first data A,
If they do not match, the process branches to step 57 and the buffer memory address is incremented by one, and the process proceeds to step 51.
Return to

If the input data and the first data A match in step 52, the process proceeds to step 53 and subsequent steps, where a comparison is made with the next data B.

In step 54, if the next data B does not match, the process returns to step 57 and the comparison is performed again starting from the first data A.

Therefore, in the conventional example described above, it is possible to search whether or not a plurality of consecutive pieces of data correspond to a specific pattern by using software that sequentially compares input data and specific data.

Problems to be Solved by the Invention However, in the conventional data monitoring device described above, the input data and specific data are sequentially compared and the branch judgment step is repeated until they match. The problem is that it requires processing time and is therefore unsuitable for retrieval from mass storage devices.

SUMMARY OF THE INVENTION In view of the above-mentioned conventional problems, it is an object of the present invention to provide a data monitor device that can search data containing many strings at high speed.

Means for Solving the Problems In order to achieve the above object, the present invention provides a table for storing a pointer indicating the address of the next page in advance at the address of each page corresponding to the data to be searched. The data stored in memory from the line is addressed to this table, the pointer is read out sequentially, and this pointer is used to determine whether or not multiple pieces of consecutive data stored in memory match a specific pattern. be.

According to the above-described structure, the processing steps of the present invention do not change even if the number of data strings increases, so that data containing many strings can be searched at high speed.

Embodiments Hereinafter, embodiments of the present invention will be described with reference to the drawings. 1st
1 is a block diagram showing an embodiment of the data monitoring device according to the present invention, FIG. 2 is an explanatory diagram showing the storage contents of the large capacity memory shown in FIG. 1, and FIG. 3 is a management table shown in FIG. 1. FIG. 4 is a flowchart showing the operation of the data monitor device shown in FIG. 1.

In FIG. 1, reference numeral 1 denotes a communication line interface for connecting with a communication line, and on the communication line, data A, which has an ASCII code "41", for example, and an ASCII
Data B with I code “42”, ASCII code “
Line data such as data C with an ASCII code of ``43'' and data D with an ASCII code of ``44'' are transmitted.

2, the line data received via the communication line interface 1 is transferred to DMA (Direct Memory).
For example, as shown in FIG. 2, the large capacity memory 2 stores line data D, A, B...C sequentially input via the communication line interface 1. is the address DATAO, DA
They are sequentially stored in the TAI, DATA2-DATAn areas.

Returning to FIG. 1, 3 is a central processing unit (CPU) for controlling communication and controlling the entire data monitor device as described later, and CPU 3 is for managing pointers in large capacity memory 2. BP, an index register SI1, a base register BX, an accumulator AX, etc. for managing the pointer of a management table 7, which will be described later.

4 is a read-only memory (ROM) in which programs for the CPU 3 to perform communication control and control the entire data monitor device are stored; 5 is a CRT for storing line data;
This is a peripheral LSI for displaying on 6.

In the management table 7, a pointer indicating the address of the next page is written in advance at the address of each page corresponding to the data pattern to be searched (for example, data A, B, C), for example, as shown in FIG. , a pointer r indicating the first page is located at location number 41 of the Oth page.
l 0 0J is written, and pointer "0" is written to other locations in the Oth page. Note that the 41st address corresponds to the ASCII code "41" of search pattern A.

Similarly, search pattern B's ASCII code "42"
Corresponding to this, a pointer r2 0 0J indicating the second page is written in the 42nd location of the first page, and a pointer r0 0J for jumping to the Oth page is written in the other locations. .

Furthermore, in response to the ASCII code "43" of search pattern C, the interrupt pointer INT is initialized so that when the 43rd location on the second page is accessed, an interrupt is generated indicating that the search condition has been met. , a pointer "00" for jumping to the Oth page is written in other locations.

Here, a page is a random access memory (RAM).
) is bounded by the area from address O to address 255.

Next, as shown in FIG. 2, data D, A, B, E, A,
Data patterns A and B are created from the data input in the order of B and C.
, C will be explained.

First, in step 11 shown in FIG. 4, the index register SI is cleared by writing data "0", and in the following step 12, the start address DATAO of the large capacity memory 2 is written to the base pointer BP. Therefore, the base pointer BP has large capacity memory 2.
This means that the first address DATAO has been written.

Next, in step 13, data at the address of the large capacity memory 2 indicated by the base pointer BP is written into the pace register BX. In this case, the AS of search pattern D
This means that CII code "44" has been written.

Next, in step 14, the value "44" written in the base register BX and the index register S
The sum of the values “0” written in (= [BX] + [S
I]) and read it into the accumulator AX.

Here, at the time of initial setting, the locations other than location number 41 on the 0th page of the management table 7 are set to "0".
” is set (first data A does not match),
In step 15, the data "0" is transferred to the index register S■, and in the following step 16,
The base pointer BP is incremented by one, and the process returns to step 13 to restart the search from the next input data DATA1.

The above series of operations will be explained for each address DATA as follows: Address DATAI (1) ASCII of data A indicated by address DATAI
Code “41” is transferred from large capacity memory 2 to pace register B.
Transfer to X (step 13).

(2) Obtain [BX] + [S I] and transfer it to the accumulation rake AX (step 14). Therefore, since data "0" is set in the index register SI, the total is "41" and the management table 7
The pointer rl O OJ written in advance at the 41st location of the Oth page is transferred to the accumulator AX (the leading data A matches).

(3) Transfer pointer rloOJ written in accumulator AX to index register SI (step 15).

(4) Increment base pointer BP by one (
Step 16).

Address DATA2 (1) ASCII of data B indicated by address DATA2
Code “42” is transferred from large capacity memory 2 to pace register B.
Transfer to X (step 13).

(2) Find [BX] + [SI] and transfer it to accumulator AX (step 14). Therefore, since the data rl 0 0J is set in the index register SI, the total becomes "142", and the pointer r2 0 0J written in advance at the 42nd location of the first page of the management table 7 is set to the accumulator AX. (the second data B matches).

(3) Pointer r written to accumulator AX
Transfer 2 0 0J to index register Sl (
Step 15).

(4) Increment base pointer BP by one (
Step 16).

Address DATA3 (1) ASCII of data E indicated by address DATA3
Code “45” is transferred from large capacity memory 2 to pace register B.
Transfer to X (step 13).

(2) Obtain [BX] + [S I and transfer it to accumulator AX (step 14). Therefore, since the data r200J is set in the index register SI, the total becomes "245", and the pointer rOJ written in advance at the 45th location of the second page of the management table 7 is transferred to the accumulator AX. (The third data is inconsistent).

(3) Pointer written to accumulator AX
0'' to index register S■ (step 15). In this case, since the line data is input in the order of data A, B, and E, the search conditions are no longer met, and the search is therefore restarted from the beginning by setting the page memory to the 0th page.

(4) Increment base pointer BP by one (
Step 16).

Address DATA4 Since data A is stored in the large capacity memory 2, it is the same as the case of data DATAI (first data A matches).

Address DATA5 Since data B is stored in large capacity memory 2, it is the same as the case of data DATA2 (the second data B
matches).

Address DATA6 (1) ASCT of data C indicated by address DATA6
Code “43” is transferred from large capacity memory 2 to pace register B.
Transfer to X (step 13).

(2) Obtain [BX] + [S I] and transfer it to accumulator AX (step 14). Therefore, since the data r2 0 0J is set in the index register S■, the total becomes "243", and the 43rd location of the second page of the management table 7 is accessed, so an interrupt occurs (3 th data match), the search condition is satisfied.

Therefore, according to the above embodiment, a pointer indicating the address of the next page is stored in advance at the address of each page of the management table 7 corresponding to the data patterns A and B to be searched, and a pointer indicating the address of the next page is stored in advance in the address of each page of the management table 7 corresponding to the data patterns A and B to be searched. The interrupt pointer INT is stored at the address of the corresponding page of the management table 7, and the pointer is read out using the data stored in the large capacity memory 2 as the address of the management table 7. Since it is determined whether or not continuous data corresponds to patterns ASB and C, the processing steps do not change even if the number of data strings increases, so a search can be performed at high speed.

In the above embodiment, a pointer is written at one address in the management table 7, but by writing next page pointers at a plurality of addresses, a plurality of data patterns can be searched.

Effects of the Invention As explained above, the present invention provides a table for storing a pointer indicating the address of the next page in advance at the address of each page corresponding to the data to be searched, and sequentially stores the pointer from the communication line to the memory. Sequentially read the pointer using the stored data as the address of this table,
Since this pointer is used to determine whether or not the continuous data stored in the memory has a specific pattern, data containing many strings can be searched at high speed.

[BRIEF DESCRIPTION OF THE DRAWINGS] FIG. 1 is a block diagram showing an embodiment of the data monitoring device according to the present invention, FIG. 2 is an explanatory diagram showing the storage contents of the large capacity memory of FIG. 1. FIG. 4 is a flowchart showing the operation of the data monitoring device shown in FIG. 1. FIG. 5 is a flowchart showing the operation of the conventional data monitoring device. It is. 1... Communication line interface, 2... Large capacity memory, 3... Central processing unit (CPU), 7... Management table, SI... Index register, BX...
Pace register, AX...Akinimulator, BP/
...Base pointer.

Claims (2)

[Claims] (1) A memory for sequentially storing data on a communication line; a table for storing a pointer indicating the next page address in advance at the address of each page according to the data to be searched; A data monitor comprising: means for sequentially reading out a pointer using stored data as an address of the table; and means for determining, using the pointer, whether a plurality of consecutive data sequentially stored in the memory corresponds to a specific pattern. Device. (2) A pointer indicating that the plurality of data sequentially stored in the memory is a specific pattern is stored at the address of the page of the table corresponding to the last pattern of data to be searched. Claims (
1) The data monitoring device described above.