RU2620996C1 - Input string searching method in the search tree with indexing, used in the string tree construction - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method is performed by means of the input string searching in the search tree, in which: create a character dictionary, defining the symbols set, that is used in the search; create the search tree; perform the search tree indexing by creating the index table, containing the symbols and the set of strings indices included in the strings set; determine the set of the strings indeces, that will be used when searching of the input string in the search tree; perform the search of the input string in the search tree.

EFFECT: improvement of the searching performance by the tree in comparison to the known tree search methods, the links of which contain the substrings, by comparing the substrings of the incoming string with substrings only in those links of the tree, which indices coincide with the indeces from the index table for the incoming string, that reduces the number of performed substrings comparing operations.

4 cl, 5 dwg

Description

Technical field

The invention relates to solutions for finding information in a tree, and more particularly to methods for finding an input string in a search tree containing masks.

State of the art

Currently, one of the ways to protect a computing device is to control the actions of software (software) by a security application (for example, an anti-virus application) when accessing objects (for example, files) in various ways (English path). In this case, the paths can be local (access to local directories and folders), registry (access to the registry of the operating system), network (access to other computing devices or Internet resources). It should also be noted that the path syntax may vary depending on the type of operating system and type of file system.

An anti-virus application, for example, can analyze the ways in which a program accesses and make decisions about the insecurity of certain program actions. But usually analysis is a time-consuming task, since any analysis methods require calculations, and the hardware resources of the computing device on which the antivirus application is installed are limited. In this regard, you can specify a list of allowed (or forbidden) paths. When accessing the program in a certain way, it is necessary to determine whether this action is allowed. To do this, the antivirus application can search for the path that the program accesses in the list of allowed (or forbidden) paths.

Since paths are generally strings, the number of allowed paths can be quite large, and the application can access hundreds or even thousands of paths, searching the list of allowed paths can take a long time. In addition, paths may contain “masks” - special characters or sequences of characters that are used to describe similar paths. The processor time spent searching can be significant. To speed up the search for the path, you need to use not data sets of lines (existing paths), but other data structures, such as trees.

The tree search task itself is not new. So, publication US 7403494 describes a tree search, and a key is generated for each tree node, which is used to accelerate port forwarding in network devices.

Publication US 8880507 describes an IP address lookup system using a tree whose nodes contain substrings.

Publication US 8572126 describes a search in a ternary tree in which regular expressions can be used.

Existing systems and methods do not solve the problem of finding various paths in a tree. The proposed method searches for an input string in a tree whose nodes may contain masks.

SUMMARY OF THE INVENTION

The technical result of the present invention is to increase the search performance of a tree compared to the known methods of searching a tree, the nodes of which contain substrings, by comparing substrings of the incoming string with substrings only in those nodes of the tree whose indices coincide with the indexes in the index table for the incoming string , which reduces the number of substring comparison operations performed.

According to one embodiment, a method is provided for searching for an input string in a search tree, in which: a dictionary of characters is created using a tree creation tool defining a plurality of characters used in the search, the dictionary comprising at least: alphabetical characters; masks, which are at least one character replacement symbol and a generalization symbol replacing an arbitrary number of characters in a string; creating a search tree using the tree creation tool, wherein: the set of lines used to create the tree includes at least one line containing masks and alphabetical characters; in the nodes of the tree, substring of each line in the set of strings is saved, while: in a separate node of the search tree, a substring is stored, which is the prefix of the line in the set of lines containing characters before the mask; the node to which the last substring of the line in the rowset is stored is the terminal; in the nodes of the tree, the indices of each row in the rowset are stored, with: the path index is the row number in the rowset; at least one row index is stored in one node; perform indexing of the search tree using the tree creation tool, creating an indexing table containing the characters and a set of indexes of the strings included in the set of strings, while: the characters from the character dictionary are used in the indexing table; the last character is extracted from the substring stored in each end node, while the selected character can be an alphabet character or a mask; for each last character selected, a set of row indices stored in the final node is added to the indexing table; determine the set of row indices using the search tool that will be used when searching for the input line in the search tree, in this case: select the last character of the input line to be found in the search tree; from the indexing table, a set of search tree row indexes is selected to search for the symbol, added in a step earlier; from the indexing table, a set of row indices is added, which was added at the stage earlier for masks; Combine selected sets of row indices into multiple row indices they search for the input line in the search tree using the search tool, while: from the input line, a substring is sequentially selected starting from the first character; comparing the selected substring with the substrings stored in the nodes of the search tree, first determining whether at least one row index stored in the compared node is included in the plurality of row indices determined in the previous step, then comparing the value of the selected substring and the substring stored in the node.

According to one particular embodiment, a method is provided in which the character dictionary further comprises numbers.

According to another particular embodiment, a method is provided in which the character dictionary further comprises punctuation marks.

According to yet another particular embodiment, a method is provided in which an end node of a tree has at least one child node.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows an example of how the software works on a computer.

FIG. 2A depicts a method for searching an input string in a search tree containing masks.

FIG. 2B displays the structure of the search tree.

FIG. 2B shows the structure of the search tree after indexing.

FIG. 3 is an example of a general purpose computer system on which the present invention may be implemented.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

FIG. 1 shows an example of the operation of applications on a computing device.

In general, the computing device is running an operating system 110. Applications 120 access various files, registry branches, and paths on the local network. For computing devices, security policies 170 may be defined according to which each application has its own specific set of paths by which the application is allowed access. A security application (eg, an anti-virus application) 160 can monitor other applications 120 and compare the paths accessed by applications, and if security policy violations occur by applications 120, block the access of these applications 120 to resources through unauthorized policies. In general, a security application 160 monitors the activity of other applications and blocks their access by intercepting calls to API functions. For example, security application 160 may intercept API function calls by application 120, determine intercepted call parameters, which in turn may contain paths, and compare settings with security policies 170.

In the particular case, the number of paths controlled by the security application 160 can be quite large. Also, security policies can contain both rules containing only allowed paths and rules containing forbidden paths. Paths can be:

- local paths to files and directories 130 (depending on the type of device and operating system, the format of the paths may vary);

- paths to registry branches 140;

- paths in the local network 150;

- addresses of resources on the Internet 155;

- paths to certain services and servers (for example, a connection string with database 165 on an SQL server);

- any other paths and addresses that can be represented as a formatted string.

Paths allowed or denied for the application can be described in the database that the security application 180 uses. Often, many paths contain paths from the same directory, which can be described using masks. In general, a mask is a string that can be used to describe many similar strings. In the general case, masks are described using special characters (special characters), for example, “?” (Mask of an arbitrary single character) and “*” (mask of an arbitrary number of arbitrary characters). The description using masks reduces the total number of paths controlled by the security application 160, for example, the paths “C: \ Windows \ System \ Drivers” and “D: \ Windows \ System32 \ Drivers” can be described using the mask “?: \ Windows \ System * \ Drivers. " However, the number of controlled (allowed or forbidden) paths, even in the case of using masks, can be significant. In a linear sequential search, comparing the path that the application accesses with all allowed (forbidden) paths takes considerable time, since it is a sequential comparison of strings with each other. In this case, it is possible to slow down the operation of a separate application 120, as well as a security application 160 or the operating system 110 as a whole. When performing resource-intensive tasks, for example, in mathematical calculations or processing database queries, on a computing device (for example, a computer or server), deceleration is unacceptable, you need a solution to quickly find the path that the application is accessing in the set of allowed paths.

The quick path search problem described above can be solved by using a search tree containing path masks that will be used by the security application 160 to search for the path that the application 120 accesses among the allowed or forbidden paths.

FIG. 2A depicts a method for searching a path through a search tree containing path masks.

The type of the search tree is not binary, each node (English node) can have more than one descendant or have no descendants at all. The search tree is a tree where the substrings included in the path are located in the nodes of the tree 220. In addition, in one embodiment, nodes of the same level that have the same parent node can be linked together in the form of a directed list (tree node contains a pointer to another node).

At an initial step 201, the tree builder 291 creates a character dictionary. The symbol dictionary contains symbols and special characters that can be used by the tree creation tool 291 to create the tree. For example, only uppercase English characters are used as characters. In addition, the mentioned characters “?” And “*” can be used as special characters. The location of special characters in the address bar is arbitrary, the number of special characters is not limited. In general, it is forbidden to use combinations of adjacent special characters (that is, you cannot specify "*?", "? *" Or "**").

In one embodiment, for each character in the dictionary, the tree builder 291 adds an index — a numerical value. For example, elements of a dictionary consisting of English uppercase characters, numbers and special characters have indices from “0” to “36” (26 indices are added for letters of the alphabet, 10 indices for numbers, index “36” is added for special characters).

An example of a search tree 220 constructed in step 202 by means of creating a tree 291 for a set of paths:

shown in FIG. 2B.

When constructing the search tree 220, the tool for creating the tree 291 saves (places) substrings consisting of dictionary characters in the nodes of the search tree 220, with each line from the set of paths being divided into substrings. In the General case, the implementation of the present invention from each line of the set of paths is allocated and placed in a separate node of the search tree 220 substring, which is the prefix of the line from the set of paths containing characters before the special character ("?" Or "*"). In one embodiment, the special character “?” Is also placed in a separate node of the search tree 220. The remaining substring (the rest of the line from the set of paths) is also (according to the above rules) divided into substrings if it contains other special characters, otherwise it is placed in a separate node search tree 220. If a string from a set of paths contains a substring that is contained in a substring of one of the nodes of the search tree 220, the substring of this node is divided into two substrings, while the first substring is stored in this tree node OISCA 220, and the second - in the child. The node of the search tree 220, which contains the last substring of the string included in the set of paths, is finite, but may contain descendants. The end nodes of the search tree 222 are marked in FIG. 2B using thickened contour lines.

When constructing a search tree, the tree builder 291 stores in the tree node a path index from a set of paths whose substring is stored in this node. Moreover, the path index is, in general, the line number in the set of paths along which the search tree is built. A single node can store more than one path index. The path indices stored in the nodes of the search tree 220 are indicated in FIG. 2B in square brackets. So, for example, the node "\ REGISTRY \ MACHINE \ S" stores the path indices from [1] to [9], since the specified substring is contained in each path from the set of paths.

At step 203, the tree builder 291 indexes the search tree 222, which after indexing has the structure shown in FIG. 2B. The tree builder using the character dictionary builds an index table. At each leaf node, the tree builder 291 selects the last character of the node substring, and stores indexes of paths that contain the substring stored in the leaf node in the index table.

As a result, the indexing table in one embodiment looks like this (the symbol itself, a set of path indices):

At step 204, the search tool 292 determines a plurality of node indexes that will be used when searching for an input row in the search tree 222. To do this, a set of indexes of the paths to be searched is determined from the index table for the last character of the row to be found. So, for example, in the line "REGISTRY \ MACHINE \ SYSTEM \ CONTROLSET001NUM \ ROOT \ LEGACY_KLP" the last character is "P", therefore, according to the indexing table, you must use the paths [2], [5] of the search tree 222. In addition, as the search tree 222 contains an arbitrary character in the final node, the path indices leading to it are also taken into account by the search tool 292, that is, when searching, you must also use the paths [3], [4]. The search tool 292 combines the sets of path indices into a plurality of path indices, as a result of which it determines that when searching for the mentioned string, the comparison should be performed only at the nodes containing path substrings [2], [5], [3], [4].

At step 205, the search tool 292 searches for the input string in the search tree 222. The input string is compared with the substrings stored in the nodes of the search tree 222, and it is first determined whether the node contains a path index included in the plurality of path indices determined in step 204 , then the substring of the node is looked up in the input string. Currently, there are many ways to quickly search for a substring in a string, there are also methods that perform the said search using masks. Consideration of these methods is beyond the scope of the present invention. If the substring from the node of the search tree 222 is contained in the input line and is at the beginning of the input line (is the prefix of the input line), then the part of the input line equivalent to the substring from the node of the search tree 222 is deleted from the input line and the search continues. The rest of the input string (substring) is compared with the child nodes of the tree node, the substring of which was contained in the input string. As before, it is first determined whether the node contains a path index included in the set of path indices determined in step 204, then the substring of the node is searched for in the remainder of the input string. Thus, tree branches that are formed by nodes containing path indices not listed in the index table are not used for search by the search tool 292.

So, in the example discussed above, the search for the mentioned input string “REGISTRY \ MACHINE \ SYSTEM \ CONTROLSET001 \ ENUM \ ROOT \ LEGACY_KLP" is performed using nodes of the search tree 222 that store the path indices [2], [5], [3], [four]. The topmost node of the search tree 222 stores path indices [1] to [9], the substring "\ REGISTRY \ MACHINE \ S" contained in it is part of the input line. This part of the string is removed from the input string, the search continues for the string "YSTEM \ CONTROLSET001 \ ENUM \ ROOT \ LEGACY_KLP", with which the substring "OFTWARE \" of the node of the search tree 222 is compared, storing path indices [4], [5], [6 ], [7], [8]. The path indexes [4], [5] are included in the indexing table, which means that in the child nodes of the branches of the search tree 222 there is a substring ending in the character "P" or containing a mask. However, the substring of the OFTWARE \ node is not part of the string for which the search continues. The search does not continue using the child nodes of this node, but continues using the YSTEM \ CONTROLSET node, which stores the path indices [0], [1], [2], [3], while the path [2] is also included the previously defined set of path indices. Since the string “YSTEM \ CONTROLSET” is part of the search string, the search string takes the form “001 \ ENUM \ ROOT \ LEGACY_KLP”, and the search continues using the child nodes of this node. Only one child node contains path indices [2], [3] among the indices, which are included in the indexing table. Since the substring of this node has the form “* \” (that is, it contains a mask), the mentioned methods of searching for a substring using masks are used. So, as a result of such a search, the substring “001 \” is equivalent to the substring “* \”. The input line takes the form "ENUM \ ROOT \ LEGACY_KLP", and the search continues. The “SERVICES \ KL” node does not contain a path index, which is part of the set of path indices defined earlier, therefore, a search using this node is not performed. The node with the index "ENUM \ ROOT \ LEGACY_KL" contains the path indices [2], [3] included in the previously defined set of path indices, the substring "ENUM \ ROOT \ LEGACY_KL" of the node is part of the search string. As a result, the search string takes the form "P". The previously defined set of node path indexes does not include the IF node, but includes the OR and? Nodes, so a substring of the OR node is searched in the search bar. The search is not successful, then the search for the substring of the node “?” In the search string. Since the substring of this node has the form “?” (That is, it contains a mask), the mentioned methods of searching for a substring using masks are used. So, as a result of such a search, the substring “P” is equivalent to the substring “?”. Thus, said input string is found by the search engine 292 in the search tree 222, that is, described by substrings and masks stored in the nodes of the search tree 222.

The functionality of the tree builder 291 and the search tool 292 can be implemented exclusively in hardware, as well as in the form of a combination, where some of the functionality is implemented by software and some by hardware. In some embodiments, the software part of the functionality of the said tools can be executed on a general-purpose computer processor (an example is shown in Fig. 3).

FIG. 3 represents an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (27)

1. A way to search for an input string in a search tree, in which: a) create a dictionary of characters using the means of creating a tree that defines the set of characters that are used in the search, while the dictionary contains at least: - characters of the alphabet; - masks, which are at least one character replacement symbol and a generalization symbol replacing an arbitrary number of characters in a string; b) create a search tree using the tree creation tool, while: - the set of lines used to create the tree includes at least one line containing masks and characters of the alphabet; - in the nodes of the tree the substring of each line in the rowset is saved, while: - a substring is saved in a separate node of the search tree, which is a prefix of a line in a set of lines of a string containing characters before the mask; - the node into which the last substring of the string included in the rowset is stored is the final one; - in the nodes of the tree, the indices of each row in the rowset are stored, while: - the path index is the line number in the rowset; - at least one row index is stored in one node; c) perform indexing of the search tree using the tree creation tool, creating an indexing table containing the characters and a set of indexes of the rows included in the set of rows, while: - symbols from the symbol dictionary are used in the indexing table; - the last character is extracted from the substring stored in each end node, while the selected character can be an alphabet character or a mask; - for each last character selected, a set of row indexes stored in the final node is added to the indexing table; d) determine the set of row indices using the search tool, which will be used when searching for the input string in the search tree, while: - select the last character of the incoming line, which must be found in the search tree; - from the indexing table, select a set of indexes of the rows of the search tree to search for the mentioned symbol, added at the stage earlier - from the indexing table, select the set of row indices added at the stage earlier for the masks; - combine the selected sets of row indices into a plurality of row indices; e) they search for the input string in the search tree using the search tool, while: - a substring is sequentially selected from the input line starting from the first character; - comparing the selected substring with the substrings stored in the nodes of the search tree, first determining whether at least one row index stored in the compared node is included in the set of row indices determined in the previous step, then comparing the value of the selected substring and substring, saved in the node. 2. The method of claim 1, wherein the character dictionary further comprises numbers. 3. The method of claim 1, wherein the character dictionary further comprises punctuation marks. 4. The method according to claim 1, in which the end node of the tree has at least one child node.

Images