RU2623882C1 - Method for searching inlet line in search tree with indexing of search tree nodes - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: in method for searching the input line in search tree, a character dictionary is created that defines the set of characters that is used in the search. Search tree is created and search tree is indexed by creating an indexing table containing the symbols and a set of search tree nodes indexes. Plurality of indexes of nodes is determined, that will be used when searching the input line with the search tree. The input line is searched in the search tree by comparing sublines of incoming line with sublines only in those tree nodes, whose indixes coincide with the indexes in index table for incoming line, which reduces the number of sublines comparison operations performed.

EFFECT: reducing path search time with search tree.

4 cl, 5 dwg

Description

Technical field

The invention relates to solutions for finding information in a tree, and more particularly to methods for finding an input string in a search tree containing masks.

State of the art

Currently, one of the ways to protect a computing device is to control the actions of software (software) by a security application (for example, an anti-virus application) when accessing objects (for example, files) in various ways (English path). In this case, the paths can be local (access to local directories and folders), registry (access to the registry of the operating system), network (access to other computing devices or Internet resources). It should also be noted that the path syntax may vary depending on the type of operating system and type of file system.

An anti-virus application, for example, can analyze the ways in which a program accesses and make decisions about the insecurity of certain program actions. But usually analysis is a time-consuming task, since any analysis methods require calculations, and the hardware resources of the computing device on which the antivirus application is installed are limited. In this regard, you can specify a list of allowed (or forbidden) paths. When accessing the program in a certain way, it is necessary to determine whether this action is allowed. To do this, the antivirus application can search for the path that the program accesses in the list of allowed (or forbidden) paths.

Since paths are generally strings, the number of allowed paths can be quite large, and the application can access hundreds or even thousands of paths, searching the list of allowed paths can take a long time. In addition, paths may contain “masks” - special characters or sequences of characters that are used to describe similar paths. The processor time spent searching can be significant. To speed up the search for the path, you need to use not data sets of lines (existing paths), but other data structures, such as trees.

The tree search task itself is not new. So, publication US7403494 describes a tree search, and a key is generated for each tree node, which is used to accelerate port forwarding in network devices.

Publication US 8880507 describes an IP address lookup system using a tree whose nodes contain substrings.

Publication US 8572126 describes a search in a ternary tree in which regular expressions can be used.

Existing systems and methods do not solve the problem of finding various paths in a tree. The proposed method searches for an input string in a tree whose nodes may contain masks.

SUMMARY OF THE INVENTION

The technical result of the present invention is to increase the search performance of a tree compared to the known methods of searching a tree, the nodes of which contain substrings, by comparing substrings of the incoming string with substrings only in those nodes of the tree whose indices coincide with the indexes in the index table for the incoming string, which reduces the number of substring comparison operations performed.

According to one embodiment, a method is provided for searching for an input string in a search tree, in which: a dictionary of characters is created using a tree creation tool defining a plurality of characters used in the search, the dictionary comprising at least: alphabetical characters; masks, which are at least one character replacement symbol and a generalization symbol replacing an arbitrary number of characters in a string; creating a search tree using the tree creation tool, wherein the set of lines used to create the tree includes at least one line containing masks and alphabetical characters; in the nodes of the tree, substring of each line in the set of strings is saved, while in the separate node of the search tree, the substring is saved, which is the prefix of the line in the set of lines containing characters before the mask; the node to which the last substring of the line in the rowset is stored is the terminal; perform indexing of the search tree using the tree creation tool, creating an indexing table containing symbols and a set of indexes of nodes of the search tree, while symbols from the symbol dictionary are used in the indexing table; Nodes that have the same parent node are assigned indices, and the assigned index for each node has a unique numerical value; the last character is extracted from the substring stored in each end node, while the selected character can be an alphabet character or a mask; for each last character selected, a set of indexes of the nodes of the search tree is added to the indexing table, through which the transition occurs from the node from which the last character is selected from the substring to the node that does not have a parent node; determining a plurality of node indices using a search tool that will be used when searching for an input line in the search tree, and the last character of the input line to be found in the search tree is selected; from the indexing table, a set of indexes of nodes of the search tree for searching the said symbol is added, added at the stage earlier; from the indexing table, a set of indexes of nodes of the search tree added at the stage earlier for masks is selected; Combine selected sets of nodes into multiple node indices. they search for the input line in the search tree using the search tool, and a substring is sequentially selected from the input line starting from the first character; comparing the selected substring with the substrings stored in the nodes of the search tree, it is first determined whether the index of the compared node is included in the set of node indices determined in the previous step, then the value of the selected substring and the substring stored in the node are compared.

According to one particular embodiment, a method is provided in which the character dictionary further comprises numbers.

According to another particular implementation embodiment, a method is provided in which the character dictionary further comprises punctuation marks.

According to yet another particular embodiment, a method is provided in which an end node of a tree has at least one child node.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows an example of how the software works on a computer.

Fig. 2A depicts a method for searching an input string in a search tree containing masks.

FIG. 2B displays the structure of the search tree.

FIG. 2B shows the structure of the search tree after indexing.

FIG. 3 is an example of a general purpose computer system on which the present invention may be implemented.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

FIG. 1 shows an example of the operation of applications on a computing device.

In general, the computing device is running an operating system 110. Applications 120 access various files, registry branches, and paths on the local network. For computing devices, security policies 170 may be defined according to which each application has its own specific set of paths by which the application is allowed access. A security application (eg, an anti-virus application) 160 can monitor other applications 120 and compare the paths accessed by applications, and if security policy violations occur by applications 120, block the access of these applications 120 to resources through unauthorized policies. In general, a security application 160 monitors the activity of other applications and blocks their access by intercepting calls to API functions. For example, security application 160 may intercept API function calls by application 120, determine intercepted call parameters, which in turn may contain paths, and compare settings with security policies 170.

In the particular case, the number of paths controlled by the security application 160 can be quite large. Also, security policies can contain both rules containing only allowed paths and rules containing forbidden paths. Paths can be:

- local paths to files and directories 130 (depending on the type of device and operating system, the format of the paths may vary);

- paths to registry branches 140;

- paths in the local network 150;

- addresses of resources on the Internet 155;

- paths to certain services and servers (for example, a connection string with database 165 on an SQL server);

- any other paths and addresses that can be represented as a formatted string.

Paths allowed or denied for the application can be described in the database that the security application 180 uses. Often, many paths contain paths from the same directory, which can be described using masks. In general, a mask is a string that can be used to describe many similar strings. In the general case, masks are described using special characters (special characters), for example, “?” (Mask of an arbitrary single character) and “*” (mask of an arbitrary number of arbitrary characters). The description using masks reduces the total number of paths controlled by the security application 160, for example, the paths “C: \ Windows \ System \ Drivers” and “D: \ Windows \ System32 \ Drivers” can be described using the mask “?: \ Windows \ System * \ Drivers. " However, the number of controlled (allowed or forbidden) paths, even in the case of using masks, can be significant. In a linear sequential search, comparing the path that the application accesses with all allowed (forbidden) paths takes considerable time, since it is a sequential comparison of strings with each other. In this case, it is possible to slow down the operation of a separate application 120, as well as a security application 160 or the operating system 110 as a whole. When performing resource-intensive tasks, for example, in mathematical calculations or processing database queries, on a computing device (for example, a computer or server), deceleration is unacceptable, you need a solution to quickly find the path that the application is accessing in the set of allowed paths.

The quick path search problem described above can be solved by using a search tree containing path masks that will be used by the security application 160 to search for the path that the application 120 accesses among the allowed or forbidden paths.

FIG. 2A depicts a method for searching a path through a search tree containing path masks.

The type of the search tree is not binary, each node (English node) can have more than one descendant or have no descendants at all. The search tree is a tree where the substrings included in the path are located in the nodes of the tree 220. In addition, in one embodiment, nodes of the same level that have the same parent node can be linked together in the form of a directed list (tree node contains a pointer to another node).

At an initial step 201, the tree builder 291 creates a character dictionary. The symbol dictionary contains symbols and special characters that can be used by the tree creation tool 291 to create the tree. For example, only uppercase English characters are used as characters. In addition, the mentioned characters “?” And “*” can be used as special characters. The location of special characters in the address bar is arbitrary, the number of special characters is not limited. In general, it is forbidden to use combinations of adjacent special characters (that is, you cannot specify "*?", "? *" Or "**").

In one embodiment, for each character in the dictionary, the tree builder 291 adds an index — a numerical value. For example, elements of a dictionary consisting of English uppercase characters, numbers and special characters have indices from “0” to “36” (26 indices are added for letters of the alphabet, 10 indices for numbers, index “36” is added for special characters).

An example of a search tree 220 constructed in step 202 by means of creating a tree 291 for a set of paths:

shown in FIG. 2B.

When constructing the search tree 220, the tool for creating the tree 291 saves (places) substrings consisting of dictionary characters in the nodes of the search tree 220, with each line from the set of paths being divided into substrings. In the General case, the implementation of the present invention from each line of the set of paths is allocated and placed in a separate node of the search tree 220 substring, which is the prefix of the line from the set of paths containing characters before the special character ("?" Or "*"). In one embodiment, the special character “?” Is also placed in a separate node of the search tree 220. The remaining substring (the rest of the line from the set of paths) is also (according to the above rules) divided into substrings if it contains other special characters, otherwise it is placed in a separate node search tree 220. If a string from a set of paths contains a substring that is contained in a substring of one of the nodes of the search tree 220, the substring of this node is divided into two substrings, while the first substring is stored in this tree node OISCA 220, and the second - in the child. The node of the search tree 220, which contains the last substring of the string included in the set of paths, is finite, but may contain descendants. The end nodes of the search tree 222 are marked in FIG. 2B using thickened contour lines.

At step 203, the tree builder 291 indexes the search tree 222, which after indexing has the structure shown in FIG. 2B. Tree Builder 291 assigns indexes to nodes that have neighboring nodes at the same level of search tree 222 (in general, to nodes that have the same parent node). For example, these are nodes 0 and 1 (the parent node without an index is “\ REGISTRY \ MACHINE \ S”); nodes 2, 3 and 4 (parent node - 1); nodes 5 and 6 (parent node - 4); nodes 7 and 8 (the parent node without an index is “* \”); nodes 9,10 and 11 (parent node - 8). Moreover, the assigned index for each node has a unique numerical value. The node indexes of the search tree 222 are indicated in parentheses in FIG. 2B.

Next, the tree builder 291 using the symbol dictionary builds an index table. At each end node, the tree builder 291 selects the last character of the substring of the node. Further, from each leaf node of the tree, the tree builder 291 moves to the uppermost node, and in the indexing table saves the indices of the nodes through which the movement was carried out. If the selected character (the last character of the substring of the finished node) occurs in more than one final node of the search tree 222, then the indices of the nodes through which the movement was carried out are combined by the tree builder 291.

As a result, the indexing table in one embodiment looks like this (the symbol itself, node indices):

At step 204, the search tool 292 determines a plurality of node indices that will be used when searching for an input row in the search tree 222. To do this, a set of node indices to be searched is determined from the index table for the last character of the row to be found. So, for example, in the line “REGISTRY \ MACHINE \ SYSTEM \ CONTROLSET001 \ ENUM \ ROOT \ LEGACY_KLP” the last character is “P”, therefore, according to the indexing table, you must use the nodes (3), (10) of the search tree 222. In addition to Moreover, since the search tree 222 contains an arbitrary symbol in the final node, the node indices leading to it are also taken into account by the search tool 292, i.e., nodes (1), (2), (0), (8) must also be used in the search , (eleven). The search tool 292 combines the sets of node indices into multiple node indices, as a result of which it determines that when searching for the mentioned row among nodes that have a branch (the parent node has more than one child node), the comparison should be performed only in nodes (3), ( 10), (1), (2), (0), (8), (11). In one embodiment, a plurality of node indices may be based on the index value.

At step 205, the search tool 292 searches for the input string in the search tree 222. The input string is compared with the substrings stored in the nodes of the search tree 222, and it is first determined whether the node index is included in the set of node indices determined in step 204 if the node an index is assigned, then the substring of the node is looked up in the input string. Currently, there are many ways to quickly search for a substring in a string, there are also methods that perform the said search using masks. Consideration of these methods is beyond the scope of the present invention. If the substring from the node of the search tree 222 is contained in the input line and is at the beginning of the input line (is the prefix of the input line), then the part of the input line equivalent to the substring from the node of the search tree 222 is deleted from the input line and the search continues. The rest of the input string (substring) is compared with the child nodes of the tree node, the substring of which was contained in the input string. As before, it is first determined whether the node index is included in the set of node indices determined in step 204, if the node is assigned an index, then the substring of the node is searched for in the remainder of the input string. Thus, tree branches that are formed by nodes whose indices are not listed in the index table are not used for search by the search tool 292.

So, in the example considered above, the search for the mentioned input string “REGISTRY \ MACHINE \ SYSTEM \ CONTROLSET001 \ ENUM \ ROOT \ LEGACY_KLP” is performed using nodes (3), (10), (1), (2), (0) , (8), (11) search tree 222. The topmost node of the search tree 222 does not have an index, the substring "\ REGISTRY \ MACHINE \ S" contained in it is part of the mentioned input line. This part of the string is removed from the input string, the search continues for the string "YSTEM \ CONTROLSET001 \ ENUM \ ROOT \ LEGACY_KLP", with which the substring "OFTWARE \" of the search tree node 222 is compared with index (1). The index of this node is included in the indexing table, which means that in the child nodes of the branches of the search tree 222 there is a substring ending in the character "P" or containing a mask. However, the substring of the node with index (1) is not part of the string for which the search continues. The search does not continue using the child nodes of the node with index (1), but continues using the node with index (0), which is also included in the previously defined set of node indices. Since the string “YSTEM \ CONTROLSET” is part of the search string, the search string takes the form “001 \ ENUM \ ROOT \ LEGACY_KLP”, and the search continues using the child nodes of the node (0). There is only one child node, it does not have an index, so it searches for its substring in the search bar. Since the substring of this node has the form “* \” (that is, it contains a mask), the mentioned methods of searching for a substring using masks are used. So, as a result of such a search, the substring “001 \” is equivalent to the substring “* \”. The input line takes the form "ENUM \ ROOT \ LEGACY_KLP", and the search continues. A node with index (7) is not included in the previously defined set of node indices, therefore, a search using this node is not performed. The node with index (8) is included in the previously defined set of node indices, the substring "ENUM \ ROOT \ LEGACY_KL" of node (8) is part of the string. As a result, the search string takes the form "P". The previously defined set of node indices does not include the node (9), but the nodes (10) and (11) enter, so the substring of the node (10) is searched in the search bar. The search was not successful, then the substring of the node (11) is searched in the search bar. Since the substring of this node has the form “?” (That is, it contains a mask), the mentioned methods of searching for a substring using masks are used. So, as a result of such a search, the substring “P” is equivalent to the substring “?”. Thus, said input string is found by the search engine 292 in the search tree 222, that is, described by substrings and masks stored in the nodes of the search tree 222.

The functionality of the tree builder 291 and the search tool 292 can be implemented exclusively in hardware, as well as in the form of a combination, where some of the functionality is implemented by software and some by hardware. In some embodiments, the software part of the functionality of the said tools can be executed on a general-purpose computer processor (an example is shown in Fig. 3).

FIG. 3 represents an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (25)

1. A way to search for an input string in a search tree, in which: a) create a dictionary of characters using the means of creating a tree that defines the set of characters that is used in the search, while the dictionary contains at least: - characters of the alphabet; - masks, which are at least a character replacement of one character and a generalization character that replaces an arbitrary number of characters in a string; b) create a search tree using the tree creation tool, while: - the set of lines used to create the tree includes at least one line containing masks and characters of the alphabet; - in the nodes of the tree the substring of each line in the rowset is saved, while: - a substring is saved in a separate node of the search tree, which is a prefix of a line in a set of lines of a string containing characters before the mask; - the node into which the last substring of the string included in the rowset is stored is the final one; c) perform indexing of the search tree using the tree creation tool, creating an indexing table containing symbols and a set of indexes of the nodes of the search tree, while: - symbols from the symbol dictionary are used in the indexing table; - nodes with the same parent node are assigned indices, while the assigned index for each node has a unique numerical value; - the last character is extracted from the substring stored in each end node, while the selected character can be an alphabet character or a mask; - for each last character selected, a set of indexes of nodes of the search tree is added to the indexing table, through which a transition occurs from the node from which the last character is selected from the substring to the node that does not have a parent node; d) determine the set of node indices using the search tool, which will be used when searching for the input string in the search tree, while: - select the last character of the incoming line, which must be found in the search tree; - from the indexing table, select the set of indexes of the nodes of the search tree to search for the mentioned symbol, added at the stage earlier; - from the indexing table, select the set of indexes of the nodes of the search tree added at the stage earlier for masks; - combine the selected sets of nodes into multiple node indices; e) they search for the input string in the search tree using the search tool, while: - a substring is sequentially selected from the input line starting from the first character; - compare the selected substring with the substrings stored in the nodes of the search tree, it is first determined whether the index of the compared node is included in the set of node indices determined at the stage earlier, then the value of the selected substring and the substring stored in the node is compared. 2. The method of claim 1, wherein the character dictionary further comprises numbers. 3. The method of claim 1, wherein the character dictionary further comprises punctuation marks. 4. The method according to claim 1, in which the end node of the tree has at least one child node.

Images