Search

CN-121996688-A - Multi-table association query method and related equipment

CN121996688ACN 121996688 ACN121996688 ACN 121996688ACN-121996688-A

Abstract

The embodiment of the application provides a multi-table association query method and related equipment. The multi-table association query method comprises the steps of receiving a query instruction, wherein the query instruction comprises query conditions, querying a plurality of tables in an inverted index mode to obtain target inverted identifiers, wherein the target inverted identifiers are inverted identifiers meeting all the query conditions, determining query results in a global numbering table according to the inverted identifiers, wherein the query results comprise information abstract values of target logs, and the target logs are logs corresponding to the target inverted identifiers. According to the technical scheme provided by the embodiment of the application, the log identification meeting the conditions is found through the inverted index, and then the specific log information abstract is quickly positioned through the global numbering table, so that the scanning of all data sets one by one is avoided, and the query speed is improved.

Inventors

  • DING YULE

Assignees

  • 三六零数字安全科技集团有限公司

Dates

Publication Date
20260508
Application Date
20241106

Claims (10)

  1. 1. A multi-table associative query method, comprising: Receiving a query instruction, wherein the query instruction comprises a query condition; Inquiring a plurality of tables in an inverted index mode to obtain a target inverted mark, wherein the target inverted mark is an inverted mark meeting all inquiry conditions; And determining a query result in a global numbering table according to the inverted identification, wherein the query result comprises the information abstract value of a target log, and the target log is the log corresponding to the target inverted identification.
  2. 2. The multi-table associative query method of claim 1, wherein the querying the plurality of table logs in an inverted index manner to obtain the target inverted identifier specifically comprises: Mapping the logs in each table to inverted identifiers through a hash function; And determining the target inverted mark according to the query condition and the inverted mark.
  3. 3. The multi-table associative query method of claim 2, wherein mapping the log in each table to the inverted identifier by a hash function comprises: converting the information abstract value of the log in each table into a preset hash value through a preset hash algorithm; uniformly dispersing the preset hash value to obtain an inverted mark; and establishing a mapping relation between the inverted mark and the corresponding log.
  4. 4. The multi-table associative query method of claim 3, wherein the converting the information digest value of the log in each table to a predetermined hash value by a predetermined hash algorithm, specifically comprises: Converting the information abstract value of the log in each table into byte stream; splitting the byte stream into byte stream blocks of a predetermined size; Carrying out hash calculation on each byte stream block to obtain a block hash value corresponding to each byte stream block; And combining the block hash values corresponding to the byte stream blocks to obtain the preset hash value.
  5. 5. The multi-table associative query method of claim 4, wherein the combining the block hash values corresponding to each byte stream block to obtain the predetermined hash value specifically comprises: combining the block hash values corresponding to the byte stream blocks to obtain a combined value; And mixing the combined values to obtain the preset hash value.
  6. 6. The multi-table association query method of claim 2, wherein the determining the target inverted identifier according to the query condition and the inverted identifier specifically comprises: Establishing an inverted index table according to the query conditions and the inverted identifiers, wherein the inverted index table comprises inverted identifiers corresponding to the query conditions; and determining the target inverted mark according to the inverted index table.
  7. 7. The multi-table associative query method of claim 1, wherein determining a query result in a global numbering table according to the inverted identifier comprises: Determining a corresponding information abstract value in a global numbering table according to the inverted identification; and checking the corresponding information abstract value to obtain the query result.
  8. 8. A multi-table associative query device, the multi-table associative query device comprising: The instruction receiving module is used for receiving a query instruction, wherein the query instruction comprises a query condition; The form query module is used for querying a plurality of forms in an inverted index mode to obtain a target inverted identifier, wherein the target inverted identifier is an inverted identifier meeting all query conditions; and the result determining module is used for determining a query result in a global numbering table according to the inverted identification, wherein the query result comprises the information abstract value of a target log, and the target log is the log corresponding to the target inverted identification.
  9. 9. A computer readable medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements a multi-table associative query method according to any one of claims 1 to 7.
  10. 10. An electronic device, comprising: One or more processors; Storage means for storing one or more programs which when executed by the one or more processors cause the one or more processors to implement the multi-table associative query method of any one of claims 1 to 7.

Description

Multi-table association query method and related equipment Technical Field The application relates to the technical field of computers and communication, in particular to a multi-table association query method and related equipment. Background With the development of information technology, the data volume is rapidly increased, and log analysis becomes a key technical means in the fields of information security, operation and maintenance monitoring and the like. In these scenarios, multi-table associative queries of log data are a common requirement for tracking event chains, analyzing user behavior, and the like. The prior art generally employs an association (JOIN) operation in a database system to fulfill this need. However, the conventional JOIN operation suffers from low efficiency and slow response in a scenario of processing large data volume and high concurrency, and especially, the cross-table JOIN operation needs to search for a matching item in a huge data set, so that the calculation cost is very high. Disclosure of Invention The embodiment of the application provides a multi-table association query method and related equipment, which can further solve the problem of low multi-table association query efficiency in the prior art at least to a certain extent. Other features and advantages of the application will be apparent from the following detailed description, or may be learned by the practice of the application. According to one aspect of the embodiment of the application, a multi-table association query method is provided, which comprises the steps of receiving a query instruction, wherein the query instruction comprises query conditions, querying a plurality of tables in an inverted index mode to obtain target inverted identifiers, wherein the target inverted identifiers are inverted identifiers meeting all the query conditions, determining a query result in a global numbering table according to the inverted identifiers, and the query result comprises an information abstract value of a target log, and the target log is a log corresponding to the target inverted identifiers. In some embodiments of the present application, the method for querying a plurality of table logs in an inverted index manner to obtain a target inverted identifier specifically includes mapping the logs in each table to the inverted identifier through a hash function, and determining the target inverted identifier according to a query condition and the inverted identifier. In some embodiments of the present application, the mapping the log in each table to the inverted identifier by the hash function specifically includes converting, by a predetermined hash algorithm, an information digest value of the log in each table to a predetermined hash value, performing uniform dispersion processing on the predetermined hash value to obtain the inverted identifier, and establishing a mapping relationship between the inverted identifier and the corresponding log. In some embodiments of the present application, the converting the information digest value of the log in each table into the predetermined hash value by the predetermined hash algorithm specifically includes converting the information digest value of the log in each table into a byte stream, splitting the byte stream into byte stream blocks with a predetermined size, performing hash computation on each byte stream block to obtain a block hash value corresponding to each byte stream block, and combining the block hash values corresponding to each byte stream block to obtain the predetermined hash value. In some embodiments of the present application, the step of combining the block hash values corresponding to the byte stream blocks to obtain the predetermined hash value specifically includes the step of combining the block hash values corresponding to the byte stream blocks to obtain a combined value, and the step of performing a mixing process on the combined value to obtain the predetermined hash value. In some embodiments of the present application, the determining the target inverted identifier according to the query condition and the inverted identifier specifically includes establishing an inverted index table according to the query condition and the inverted identifier, where the inverted index table includes inverted identifiers corresponding to the query conditions, and determining the target inverted identifier according to the inverted index table. In some embodiments of the present application, determining a query result in a global numbering table according to the inverted identifier specifically includes determining a corresponding information digest value in the global numbering table according to the inverted identifier, and verifying the corresponding information digest value to obtain the query result. According to one aspect of the embodiment of the application, a multi-table association query device is provided, which comprises an instruction receivi