CN107402959A - URL matching process, URL matching units and storage medium - Google Patents

Abstract

The invention provides a URL matching method, a URL matching device and a storage medium. In the method, the input original URL data to be matched is checked in the URL result cache whether its corresponding information has been stored, and if so, the flag bit and the hit rule are checked. The table gets the information of whether it matched before, and outputs the matching result; otherwise, it matches in the pattern matching engine and stores the URL data. This method deduplicates a large amount of repeated URL data to reduce the number of repeated URL data matches and improve the matching speed. At the same time, the present invention adopts a polynomial hash algorithm with a lower complexity than the actual string matching, but it is not limited to the polynomial hash algorithm. After the data deduplication operation is added, the matching times of duplicate URL data can be reduced, so as to achieve the purpose of deduplication and reduce the matching time.

Description

URL matching method, URL matching device and storage medium

technical field

The invention relates to the fields of content filtering, information security and the like, and in particular relates to a URL matching method, a URL matching device and a storage medium.

Background technique

With the development of computer networks, entertainment, work, and leisure through the network have occupied most of the time in life, and the application of the World Wide Web has accounted for 90% of Internet traffic. In this case, it is necessary to match the accessed URL (Uniform Resource Locator, uniform resource locator), and then control the accessed URL to improve work efficiency.

A traditional URL matching method mainly uses a string matching algorithm to process URL rule sets. For example, according to the filtering characteristics of the URL "blacklist", the AC (Aho-Corasick) algorithm is used to select certain URL rules from the URL rules using a heuristic strategy. Long, characteristic substrings are compressed using double arrays. Another traditional URL matching method mainly utilizes a communication protocol (WCCP) between a router and a cache engine to complete URL matching.

The above two traditional URL matching methods mainly implement the URL matching process from the perspective of a conventional content filtering system. However, when actually performing URL matching, there are a large number of repeated URL data in the URL data to be matched. The URL data makes the matching process repeatedly match the data, thereby reducing the matching efficiency of the traditional URL matching method.

Contents of the invention

Due to the relatively high repetition rate of URL data under real network traffic, a large amount of data is often matched repeatedly when matching network traffic, which will reduce the matching speed. The present invention aims to provide a URL matching method, a URL matching device, and a storage medium. The method can quickly match rules for text matching problems in network traffic, and can deduplicate large-scale URL data to achieve the purpose of avoiding repeated matching data .

For above-mentioned purpose, the technical scheme that the present invention adopts is:

A URL matching method, the steps of which are:

1) Perform a double hash operation on the original URL data to be matched to obtain double hash values hash ₁ , hash ₂ and their corresponding hash values h;

2) If a hash node with a hash value h is found in the hash table, then query whether the double hash value of the hash node is equal to the double hash value of the above-mentioned original URL data to be matched;

3) If they are equal, it is judged whether the flags start and end of the above-mentioned hash nodes meet the preset conditions;

4) If the flags start and end of the above-mentioned hash node meet the preset conditions, then the above-mentioned original URL data to be matched matches a rule in the matched rule table.

Further, the hash table in step 2) and the hit rule table in step 4) are located in the URL result cache.

Further, step 2) also includes: if no hash node with a hash value of h is found in the hash table, then directly end, go to the pattern matching engine to match the original URL data to be matched, and return the result .

Further, the preset condition in step 3) means that the flag bits start and end of the hash node are not equal.

Further, step 3) also includes: if the double hash value of the above-mentioned hash node is not equal to the double hash value of the original URL data to be matched, then query whether there are other hashes in the above-mentioned hash table A hash node whose value is h; if not, use a pattern matching engine to match the original URL data to be matched, and return the result.

Furthermore, when the pattern matching engine matches the original URL data to be matched and returns a result, the original URL data to be matched is stored in the URL result cache, and the steps include:

a) Determine whether the number of URL data J in the URL result cache exceeds the threshold M, if not, record the double hash values hash ₁ and hash ₂ of the original URL data to be matched to the current hash node hash_node[J] Medium; if it exceeds, a replacement strategy will be adopted for the URL result cache of the block; where M is the size of the URL data that can be cached;

b) When the pattern matching engine returns a result of 0, the flag bit hash_node[J].start=hash_node[J].end=K in the hash node hash_node[J]; when the pattern matching engine returns a result of 1 , then the flags hash_node[J].start=K, hash_node[J].end=K+1 in the hash node hash_node[J], and store the matching rule number returned from the pattern matching engine in matched_rules[]. matched_rules[K]=RuleId, at this time K=K+1; where 0 means that the original URL data to be matched does not match a rule, 1 means that the original URL data to be matched matches a rule, K is the number of matched rules, matched_rules [] represents the hit rule table;

c) Obtain the hash value h of the original URL data to be matched, store the hash nodes with the same hash value in next, and the number of stored URL data is J=J+1.

Furthermore, the replacement strategy in step a) refers to: clearing the URL result cache of the block, and reallocating space to store new URL data.

Furthermore, the hash value h of the original URL data to be matched is obtained by ANDing hash ₁ and (N-1), where N is the size of the hash table.

Further, step 4) further includes: if the flag bits start and end of the above-mentioned hash node do not meet the preset condition, then the above-mentioned original URL data to be matched does not match the rule.

Further, the rule in step 4) refers to a rule that matches the data corresponding to the hash value of the above-mentioned hash node.

Further, the double hash operation adopts a polynomial hash algorithm, and uses a multi-thread method to match URL data in parallel.

A URL matching device, including a processor and a memory, the processor and the memory are connected through a bus;

The memory is used to store computer-executed instructions corresponding to any of the methods described above;

When the URL matching device is running, the processor reads the computer-executable instructions in the memory, so that the URL matching device executes the steps of any one of the methods described above.

A non-volatile computer-readable storage medium storing a computer program. When a computer executes the computer program, the computer executes the steps of any one of the methods described above.

The beneficial effects of the present invention are:

1. The method of the present invention queries whether its corresponding information has been stored in the URL result cache by querying the input original URL data to be matched, and if so, queries the flag position and the hit rule table to obtain information on whether it has matched before, and outputs the matching result ; Otherwise, match in the pattern matching engine and store the URL data.

2. The method and device of the present invention deduplicate a large amount of repeated URL data, so as to reduce the number of repeated matching of URL data and improve the matching speed.

3. After the number of URL data in the URL result cache exceeds the threshold, the present invention adopts a replacement strategy for the URL result cache to ensure the smooth progress of the current URL data storage process.

4. The present invention uses a polynomial hash algorithm with a lower complexity than the actual string matching, but it is not limited to the polynomial hash algorithm. After the data deduplication operation is added, the matching times of duplicate URL data can be reduced, so as to achieve the purpose of deduplication and reduce the matching time.

5. The storage medium provided by the present invention can be applied in the fields of intrusion detection system, spell checking, network traffic monitoring, etc., and can also run on a single computer hardware or multiple servers.

Description of drawings

Fig. 1 is a structural diagram of a URL matching device provided by the present invention.

Fig. 2 is a schematic diagram of basic data types of URL matching provided by the present invention.

Fig. 3 is a flow chart of the matching phase in the URL result cache provided by the present invention.

FIG. 4 is a flow chart of the storage stage in the URL result cache provided by the present invention.

Fig. 5 is a schematic diagram of rule storage according to an embodiment of the present invention.

FIG. 6 is a schematic diagram of storage changes in each table when url1 is stored according to an embodiment of the present invention.

FIG. 7 is a schematic diagram of storage changes in each table when url2 is stored according to an embodiment of the present invention.

FIG. 8 is a schematic diagram of storage changes in each table when url3 is stored according to an embodiment of the present invention.

FIG. 9 is a schematic diagram of storage changes in each table when url5 is stored according to an embodiment of the present invention.

FIG. 10 is a schematic diagram of storage changes in each table when url8 is stored according to an embodiment of the present invention.

detailed description

For various hashing methods, the present invention collects tens of millions of pieces of real URL data from the backbone network, and the data size is 2.06GB. Different hash algorithms have different calculation speeds on URL data, and their effects are shown in Table 1. To improve the matching speed in the end, it is necessary to de-duplicate the URL data, but if the complexity of the de-duplication processing is too high, the hashing speed is very slow, which will eventually affect the final string matching speed. Therefore, in order to improve its hash efficiency, it is necessary to select the hash function with the fastest hash calculation speed as the invented hash function, that is, polynomial hash algorithm (poly_hash).

Table 1: Calculation speed of different hash algorithms on URL data

hash algorithm Specific hash algorithm Calculation speed (MB/s) Lookup table hash algorithm crc_hash 274 polynomial hashing algorithm poly_hash 552 bitwise hash algorithm xor_hash 370 ELF elf_hash 274 Hf HfIp_hash 515

It has been verified by experiments that the complexity of the hash algorithm used for deduplication is lower than that of actual string matching. Therefore, after adding deduplication data operations, the matching speed can be greatly improved. The matching speed and performance can be greatly improved by using the operation of the present invention for URL string matching on a scale of tens of millions.

Assuming that in URL data, the proportion of unique URLs is p, the time for one data deduplication is C ₁ , the time for one string matching is C ₂ , and the time for one ULR data insertion into URL result cache is C ₃ , then data deduplication is used After technology, the expected time is:

T＝(1-p)*C ₁ +p*(C ₂ +C ₃ )

Therefore, as long as the data is redone fast enough, T<C ₂ . Experiments verify that the time required for deduplication of data is very short, and the final experimental result proves that T<C ₂ , so the present invention can reduce the matching times of repeated URL data, achieve the purpose of deduplication and reduce matching time.

The hash function in the present invention adopts a polynomial hash algorithm, and adopts a multi-thread method to match URL data in parallel. When aiming at tens of millions of URL rule sets, the deduplication result of URL data is more efficient.

Please refer to Figure 1. For the convenience of brief description, only for the single-threaded model, the main idea includes the URL result cache stage and the pattern matching engine stage.

The URL result caching stage refers to: firstly, a memory is allocated for URL result caching. The original URL data to be matched is hashed into the hash table through a double hash operation, and whether the corresponding data (that is, the original URL data to be matched) has been stored in the current hash table is inquired. If so, check whether there is a corresponding rule number in the hit rule table. If there is a corresponding rule number, the corresponding result is returned, that is, the rule number is returned; if there is no corresponding rule number, the original URL data to be matched does not match any rule; the above process is a data deduplication process. If not, a pattern matching engine is used to match the above-mentioned original URL data to be matched.

The pattern matching engine stage refers to: when the original URL data to be matched is not queried in the hash table, that is, the original URL data to be matched is queried for the first time, that is to say, no same URL data has entered the hash table In the Hashtable, the pattern matching engine is firstly matched and the result is returned, and then the hash value of the original URL data to be matched is recorded in the Hashtable, and the rule number if matched is recorded in the hit rule table. Record.

The present invention also provides a URL matching device, which includes a processor and a memory, the processor and the memory are connected through a bus;

The memory includes internal memory and external storage, and is used to store computer-executed instructions corresponding to any of the methods described in the present invention;

When the URL matching device is running, the processor reads the computer-executable instructions in the memory to cause the URL matching device to perform the steps of any one of the methods of the present invention.

In order to solve the problems caused by hash conflicts, the present invention adopts a double hash function, and sets the form of a linked list to store URLs with the same hash value but different data itself, so as to ensure the balance of the hash. Please refer to Figure 2. For the convenience of the following description, the relevant symbols are defined to describe the following hash deduplication process.

M: The size of the URL data that can be cached, generally a multiple of 2, which is convenient for subsequent operations;

N: the size of the hash table, the present invention sets N to be 8 times of M to ensure the balance of the hash;

K: the number of matched rules, the initial value is 0, record the last subscript in matched_rules[];

J: The value is the number of input URL data, and the initial value is 0;

data[]: a certain URL data;

A1, A2: Hash constants, fixed values, constants used for polynomial iterative algorithms;

H1, H2: random operator, fixed value, used to initialize the hash function;

hash ₁ , hash ₂ : generally refers to the hash value obtained after each URL data passes through the hash function;

matched_rules[]: the rule table has been hit, storing the rule number of the matching data;

hash_table[]: hash table, which stores the number of hash_node[] corresponding to the hash value of the data, which is related to the J value, and all values in the initial value hash table are set to -1;

hash_node[]: a hash node, which is a structure, its content includes h ₁ , h ₂ hash values, start, end flag bits and the next hash node next with the same hash value;

RuleId: A rule number in this matching process.

Among the present invention, A1=6364136223846793005, A2=2862933555777941757, H1=1442695040888963407, H2=3037000493, have chosen the hash constant and random operator that often adopt in the C++ kernel, A1, A2 and H1, H2 can be other constants. The present invention is mainly aimed at the URL result caching stage, and the pattern matching engine stage mainly provides data matching results for later storage, so only the URL result caching stage is introduced, which can be divided into a matching stage and a storage stage.

Please refer to Figure 3, the matching stage includes the following steps:

1) Double hash the URL data, using the length of the URL data, the hash function is:

hash ₁ ＝A1*hash ₁ +data[i]

hash ₂ ＝A2*hash ₂ +data[i]

Among them, i starts to take the value from the first character of the URL data to the last character. The initial values of hash ₁ and hash ₂ are hash ₁ =H1 and hash ₂ =H2.

In the above hash function, when the last character of the URL data is fetched, the result of the AND operation of hash ₁ and (N-1) is h, so as to ensure that the hash value can fall into the subscript in the hash table hash_table[] within range.

2) Start from the value of hash_table[h], set j=hash_table[h], access this hash node, first determine whether the double hash values are equal, that is, the hash ₁ and hash_node[j of the matching URL data this time ].h ₁ is equal, whether hash ₂ is equal to hash_node[j].h ₂ , if they are equal at the same time, it means that the hash verification is successful, the URL data has been accessed and the corresponding information has been stored in the URL result cache , you can go to step 3) to make a judgment on whether the URL data matches the rule, otherwise the URL data has not been accessed, return matching failure, and let the pattern matching engine process the current data situation.

3) When the flags start and end in the structure stored in hash_node[j] are equal, it means that the URL data was originally stored but cannot match any rules, and the return does not match any rules; if start and end are not equal, it means that the A piece of URL data was originally stored and matched with a certain rule. The value of start indicates that the subscript stored in the rule table has been hit, that is, RuleId=matched_rules[hash_node[j].start], then the matched rule number RuleId will be returned. If the matching is successful, the matching process ends.

4) Then select the hash node hash_node[j].next with the same hash value in hash_node[j], let j=hash_node[j].next, go to step 2) and continue to take the next in hash_node[j] Visit the next hash node until j=-1 (all data with the same hash value hash ₁ has been visited) or the result has been matched.

Please refer to Figure 4, the storage stage includes the following steps:

When the pattern matching engine stage matches a piece of URL data that has not been stored in the URL result cache and returns the result, it needs to store the URL data in the URL result cache so that it can be directly retrieved from the URL result cache when processing duplicate data in the future. Use the matching stage to output matching results. When initializing, first set each item in the hash table hash_table[] to -1.

1) Determine whether the number of URL data J in the URL result cache exceeds the current threshold M, if so, clear the URL result cache for this block, reallocate the space, reset the counters K and J to 0, and store the new URL data; if not exceeded, store the URL data in the pattern matching engine for each processing.

2) When storing URL data, assuming that the Jth unique URL data is now stored, first record the two hash values hash ₁ and hash ₂ in the current hash node hash_node[J], namely hash_node [J].h ₁ =hash ₁ , hash_node[J].h ₂ =hash ₂ , so as to be used for hash verification in the matching stage.

3) When the result returned in the pattern matching engine stage is 0, it means that the URL data cannot match any rules. When storing the URL data, set the flag bits in the hash node hash_node[J] to be equal, that is, hash_node [J].start=hash_node[J].end=K;

When the result returned in the pattern matching engine stage is 1, it means that the URL data can match a certain rule in the rule set. When storing the URL data, set the flag in the hash node hash_node[J] to unequal. That is, hash_node[J].start=K, hash_node[J].end=K+1, where K is the number of matched rules, and at the same time store the matching rule number RuleId returned from the pattern matching engine stage in matched_rules[], namely matched_rules[K]=RuleId. Since a piece of matched URL data information has been added, the number of matched rules is increased by 1, that is, K=K+1.

4) The result of the AND operation of hash ₁ and (N-1) is h, and the value of the next hash node of the hash node hash_node[J] is set to the value of the hash table hash_table[h], that is, hash_node[ J].next=hash_table[h]. Store the hash value h in the hash table hash_table[h], and set the value to J, that is, hash_table[h]=J. Since a piece of URL data is added, J=J+1.

The following mainly uses a specific example to show the specific implementation manner, and mainly introduces the process from the storage stage and the matching stage.

Table 2: Example of URL data

URL data number URL specific content url1 www.abcd.com url2 www.ccef.cn url3 www.cdef.cn url4 www.abcd.com url5 www.mmmm.cn url6 www.cdef.cn url7 www.mmmm.cn url8 www.zhihu.com

Table 3: Example rules

rule number content r1 www.abcd.com r2 www.ccef.cn r3 www.baidu.com

Please refer to Table 2, Table 3 and Figure 5, assuming that there are three rules, r1, r2, r3; url1 and url4 have the same content; url3 and url6 have the same content; url2 and url3 have different content, but the hash value h=hash ₁ &(N-1) is the same; the contents of url5 and url7 are exactly the same, among which, url1 matches r1, url2 matches r2, and other url data are different and do not match the rules.

Let's start the specific operation process, because at the beginning, there is no data in the URL result cache, and the first process starts from the storage stage. First define M=4, then N=32. data[i-1]=urli, i=1...8.

When matching the first URL data url1, because the data information is not obtained in the URL result cache, the pattern matching engine is first used for matching, and the matching result returns the rule number r1. When storing, the storage changes of each table are shown in Figure 6 .

After url1 passes through the hash function, hash ₁ = 5, hash ₁ and 31 (ie N-1) do AND operation to get h = 5, hash ₂ = 4, due to the matching rule r1, start = 0, end = 1, next node is -1.

Please refer to Figure 7. Similarly, since url2 does not have result information in the URL result cache, after passing through the pattern matching engine, url2 passes through the hash function, hash ₁ = 287, and hash ₁ and 31 (ie N-1) are combined After the operation, h=11, hash ₂ =359, because of the matching rule r2, start=1, end=2, and the next node is -1.

Please refer to Figure 8, since url3 does not have result information in the URL result cache, after passing through the pattern matching engine, url3 passes through the hash function, hash ₁ = 287, hash ₁ and 31 (ie N-1) are obtained after AND operation h=11, which is consistent with the h value in url2, then the hash node next stores the hash node subscript 1 of url2 data storage, hash ₂ =344, since it does not match any rules, start=2, end =2, the next node is 1.

When the url4 data is matched, since the information of the url4 data already exists in the URL result cache (exactly the same as the content of the url1), the result information can be directly matched, because the hash ₁ of url4 = 5, hash ₂ = 4, h = hash ₁ &31＝5, query hash_table[5]＝0, query hash_node[0] node, find url4's hash ₁ =hash_node[0].h ₁ , hash ₂ =hash_node[0].h ₂ , and hash_node[0 ].start is not equal to hash_node[0].end, indicating the matching rules, query matched_rules[hash_node[0].start]=r1, and return the rule number r1.

Please refer to Figure 9, since url5 does not have result information in the URL result cache, after passing through the pattern matching engine, url5 passes through the hash function, hash ₁ = 520, hash ₁ and 31 (ie N-1) are obtained after AND operation h=8, hash ₂ =9, since no rule is matched, start=2, end=2, and the next node is -1.

When the url6 data is matched, since the information of the url6 data already exists in the URL result cache (identical to the content of the url3), the result information can be directly matched, because the hash ₁ of url6 = 287, hash ₂ = 344, h = hash ₁ &31＝11, query hash_table[11]＝2, query hash_node[2] node, find url6 hash ₁ =hash_node[2].h ₁ , hash ₂ =hash_node[2].h ₂ , and hash_node[2 ].start is equal to hash_node[2].end, which means that no rule is matched. Although the next node is not -1, since the current hash verification has been completed, it means that the data is the same and no longer matches hash_node[hash_node[2]next] (i.e. hash_node[0]) node, directly return does not match any rules.

When the url7 data is matched, since the information of the url7 data already exists in the URL result cache (which is exactly the same as the content of the url5), the result information can be directly matched, because the hash ₁ of url7 = 520, hash ₂ = 9, h = hash ₁ &31＝8, query hash_table[8]＝3, then query hash_node[3] node, find url7's hash ₁ =hash_node[3].h ₁ , hash ₂ =hash_node[3].h ₂ , and hash_node[3 ].start is equal to hash_node[3].end, indicating that it does not match, and directly returns the result that does not match any rules.

Please refer to Figure 10, since url8 does not have result information in the URL result cache, it needs to be stored after passing through the pattern matching engine, but at this time the URL result cache area is full (J=M), then the URL result cache needs to be The area is cleared. url8 undergoes a double hash function, hash ₁ = 514, hash ₁ and 31 (ie N-1) do AND operation to get h = 2, hash ₂ = 469, because it does not match any rules, start = 0, end = 1, The next node is -1.

The present invention refers to the URL matching method described above as the DDB algorithm, and selects two classic character string matching algorithms Aho-Corasick (AC) algorithm and Karp-Rabin (KR) algorithm as the comparison algorithm, and implements the data before and after the deduplication strategy. The performance of the matching method is compared and tested.

The hardware and software environment of the experiment is:

CPU: Intel(R) Core(TM) i7-3820 CPU@3.60GHz; memory: 32GB; operating system: Red Hat CentOS Linux release 7.2.1511(Core); kernel version: 3.10.0.

URL data set: The real URL data collected from the backbone network is used as the input text to be matched.

Rule set: 5 million URL rules generated by simulating real URL characteristics.

Table 4: Performance comparison of AC, KR, and DDB algorithms on real data sets (the rule set is fixed at 5 million)

It can be seen from Table 4 that the matching efficiency of the algorithm after the data deduplication strategy is improved compared with that before deduplication, and the effect is more obvious on the real data set. For processing large-scale URL rules of millions or even tens of millions, the matching acceleration effect is remarkable.

The present invention also provides a non-volatile computer-readable storage medium storing a computer program. When a computer executes the computer program, the computer executes the steps of any one of the methods described in the present invention. Moreover, the storage medium can be applied in fields such as intrusion detection systems, spell checking, network flow monitoring, etc., and can also be run on a computer hardware stand-alone or multiple servers.

The above implementation is only used to illustrate the technical solution of the present invention and not to limit it. Those skilled in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. Protection of the present invention The scope should be defined by the claims.

Claims (13)

1. A URL matching method, the steps of which are: 1) Perform a double hash operation on the original URL data to be matched to obtain double hash values hash ₁ , hash ₂ and their corresponding hash values h; 2) If a hash node with a hash value h is found in the hash table, then query whether the double hash value of the hash node is equal to the double hash value of the above-mentioned original URL data to be matched; 3) If they are equal, it is judged whether the flags start and end of the above-mentioned hash nodes meet the preset conditions; 4) If the flags start and end of the above-mentioned hash node meet the preset conditions, then the above-mentioned original URL data to be matched matches a rule in the matched rule table. 2. The method according to claim 1, wherein the hash table in step 2) and the matched rule table in step 4) are located in the URL result cache. 3. The method according to claim 1, characterized in that, step 2) also includes: if the hash node with a hash value of h is not found in the hash table, then directly end, and go to the pattern matching engine to match The original URL data to be matched, and return the result. 4. The method according to claim 1, wherein the preset condition in step 3) means that the flag bits start and end of the hash node are not equal. 5. The method according to claim 2, wherein step 3) further comprises: if the double hash value of the above-mentioned hash node is not equal to the double hash value of the original URL data to be matched, then in the above-mentioned Query whether there are other hash nodes with a hash value of h in the hash table; if not, use the pattern matching engine to match the original URL data to be matched, and return the result. 6. method as claimed in claim 5, is characterized in that, when pattern matching engine matches described original URL data to be matched, and when returning result, this original URL data to be matched is stored in URL result cache, its step include: a) Determine whether the number of URL data J in the URL result cache exceeds the threshold M, if not, record the double hash values hash ₁ and hash ₂ of the original URL data to be matched to the current hash node hash_node[J] Medium; if it exceeds, a replacement strategy will be adopted for the URL result cache of the block; where M is the size of the URL data that can be cached; b) When the pattern matching engine returns a result of 0, the flag bit hash_node[J].start=hash_node[J].end=K in the hash node hash_node[J]; when the pattern matching engine returns a result of 1 , then the flags hash_node[J].start=K, hash_node[J].end=K+1 in the hash node hash_node[J], and store the matching rule number returned from the pattern matching engine in matched_rules[]. matched_rules[K]=RuleId, at this time K=K+1; where 0 means that the original URL data to be matched does not match the rules, 1 means that the original URL data to be matched matches the rules, K is the number of matched rules, matched_rules [] represents the hit rule table; c) Obtain the hash value h of the original URL data to be matched, store the hash nodes with the same hash value in next, and the number of stored URL data is J=J+1. 7 . The method according to claim 6 , wherein the replacement strategy in step a) refers to: clearing the URL result cache of the block, and reallocating space to store new URL data. 8 . 8. The method according to claim 1 or 6, wherein the hash value h of the original URL data to be matched is obtained according to an AND operation of hash ₁ and (N-1), wherein N is a hash table size. 9. The method according to claim 1, wherein step 4) further comprises: if the flags start and end of the hash node do not meet the preset conditions, then the original URL data to be matched does not match the rule. 10. The method according to claim 1, wherein the rule in step 4) refers to a rule matching the data corresponding to the hash value of the hash node. 11. The method according to claim 1, wherein the double hash operation adopts a polynomial hash algorithm, and uses a multi-thread method to match URL data in parallel. 12. A URL matching device, comprising a processor and a memory, the processor and the memory are connected through a bus; The memory is used to store computer-executed instructions corresponding to the method in any one of claims 1 to 11; When the URL matching device is running, the processor reads the computer-implemented instructions in the memory to cause the URL matching device to perform the steps of any one of the methods of claims 1-11. 13. A non-volatile computer-readable storage medium storing a computer program, characterized in that, when a computer executes the computer program, the computer executes the steps of the method according to any one of claims 1 to 11.