Multi-keyword matching method and device

Abstract

The embodiment of the invention discloses a multi-keyword matching method and a device. The method comprises the following steps: preprocessing a keyword set and building a corresponding data structure; the data structure comprises a skip list, a prefix list, a sub-skip list and a prefix length list; searching the skip list according to the content to be matched; when the skip value is zero, according to the prefix list item, calling the sub-skip list and the prefix length list to match contents to be matched. By adopting the embodiment of the invention, the skip capability of the prior art is effectively improved, the matching speed for a plurality of keywords with the same prefixes in an exact match is increased, and the efficiency of the pattern matching algorithm is greatly enhanced.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a multi-keyword matching method and device. Background technique [0002] With the rapid development of network applications, the network environment is becoming increasingly complex, and more and more security threats from the application layer (such as viruses, spam, rogue software, etc.) have caused a huge threat to network security. These threat means are encapsulated in the payload part of the TCP / IP (Transmission Control Protocol / Internet Protocol, Transmission Control Protocol / Internet Protocol) protocol. Traditional firewalls cannot intercept such security threats because they only check the header of the TCP / IP protocol but not the content of the data packet. [0003] In this situation, if figure 1 As shown, based on the detection of message content features, pay attention to the security gateway devices above the fourth layer of the message (especially t...

AI Technical Summary

Problems solved by technology

[0009] In the prior art, after the number of keywords increases, the number of items with a jump value of zero in the jump table will increase, and the average jump value will decrease accordingly, so that a large number of unnecessary character comparisons in the matching process cannot be effectively avoided; resulting in text Or the matching speed of network content decreases; as the number of keywords increases, the number of keywords with the same prefix will also increase greatly, and repeated matching of the same prefix in the process of exact matching will also lead to a decrease in the matching speed of text or network content

Images