24results about How to "Reduce performance overhead" patented technology

The invention discloses a compiling method for compiling a C language source code into an RISC-V assembly code. The method comprises the following steps: acquiring a C language source code; performing lexical analysis on the C language source code to generate a mark flow; performing syntactic analysis on the mark flow, and constructing an abstract syntax tree; performing semantic analysis on the abstract syntax tree to generate a target abstract syntax tree; constructing a runtime environment of the RISC-V assembly code; generating an intermediate code and a control flow diagram corresponding to the intermediate code according to a rule in the runtime environment and the target abstract syntax tree; generating a target code by using the intermediate code and the control flow diagram corresponding to the intermediate code; according to the technical scheme, the intermediate representation more adaptive to RISC-V custom instruction mapping can be generated, so that the execution efficiency of assembly codes is improved; and meanwhile, by designing a lightweight runtime environment, the performance overhead is further reduced.

The embodiment of the invention provides a memory leak detection method and device, equipment and a storage medium, and relates to the technical field of operating systems and performance tuning. The method comprises the following steps: monitoring memory allocation and release operation of a process by adopting a probe program; collecting memory use information of a stack of the process on memory allocation and release operation; through a collaborative caching mechanism of a kernel mode and a user mode, sharing memory use information to the user mode, and analyzing the memory use information in the user mode to obtain a comprehensive hotspot score representing a memory occupation growth trend of a stack; and determining whether the stack has memory leak according to the comprehensive hotspot score. Based on the method, whether the memory leaks or not can be accurately detected under the condition of low performance overhead.

The invention relates to a self-adaptive management method and system for a database plan cache, and the method comprises the steps: firstly judging whether the plan cache is hit or not after a database receives an SQL statement, and triggering a hard analysis generation plan and caching the plan when the plan cache is not hit; if the cache is hit, further judging whether a corresponding multi-execution plan exists or not; and when only a single execution plan exists, analyzing the relationship between the number distribution of execution tuples and the number of execution times by adopting an execution efficiency algorithm to dynamically judge whether the data is inclined. And when a plurality of execution plans exist, entering a multi-plan cache management stage, selecting the execution plans according to a matching result of the current binding variable predicate selection rate and the cache plan historical selection rate, and generating and caching a new plan when the matching fails. According to the method, the data skew is accurately identified by executing the efficiency algorithm, intelligent matching and multiplexing of plans are realized by means of a multi-plan cache management mechanism, and the overall performance of the database in a data skew scene is improved.

This invention discloses a fuzz testing method based on program termination points, comprising: inserting breakpoint instructions at the entry point of each basic block of the module under test; constructing a set of mutation seed files based on an initial seed file set, and providing each mutation seed in the set to the program under test for testing; loading an auxiliary tracing module in the debugger, recording the sequence of basic blocks executed by the program under test through a breakpoint tracing mechanism, and determining the termination basic block; triggering potential vulnerabilities in the program under test through continuous testing; simultaneously optimizing the seed mutation strategy based on coverage; during test execution, when the program under test triggers a debugging exception or a crash signal by executing a breakpoint instruction, the debugger pauses the execution of the program under test and resumes the original instructions; after the breakpoint handling is completed, the execution of the program under test is resumed, allowing it to continue running until the next breakpoint is encountered or execution ends; the test is completed when the test process reaches the preset termination conditions, and a test report is generated.

The embodiment of the invention provides a debugging method and device, electronic equipment, a storage medium and a computer program product, the debugging method is applied to a processor, the debugging method comprises the steps that an insertion enable signal is acquired, and the insertion enable signal is used for indicating an instruction fetching position of the processor; under the condition that the insertion enable signal is the first enable signal, taking out an original instruction from a target buffer area of the processor, and executing the original instruction; wherein the first enable signal represents that the processor fetches an instruction from a target buffer area, and the target buffer area is used for storing an original instruction at a target address where the breakpoint instruction is inserted.

A method comprises detecting execution of a fork() operation in a cryptographic computing system that generates a parent process and a child process, assigning a parent kernel data structure to the parent process and a child kernel data structure to the child process, detecting, in the child process, a write operation comprising write data and a cryptographic target address, and in response to the write operation blocking access to a corresponding page in the parent process, allocating a new physical page in memory for the child process, encrypting the write data with a cryptographic key unique to the child process, and filling the new physical page in memory with magic marker data.

This invention belongs to the field of computer security technology and relates to a container isolation and hardening method and system based on restricted eBPF technology. The method mainly includes: constructing an eBPF program capable of hardening container security isolation; attaching the eBPF program to kernel hook points; triggering the eBPF program and executing corresponding security protection logic when the kernel executes a critical point on a specific path; constructing a two-level eBPF function permission restriction model based on eBPF program granularity and eBPF helper function granularity; and using this two-level eBPF function permission restriction model to restrict the eBPF functions of the container, enabling the secure use of eBPF technology in container isolation and hardening scenarios. This invention improves the security of container environment isolation while ensuring that eBPF technology itself is not maliciously exploited, making eBPF technology more adaptable to container environments and enhancing its flexibility and security at the container level.

The invention relates to the field of data processing, and discloses a risk management method and device for incremental codes and a storage medium. The method comprises the following steps: receiving code change information, and filtering the code change information to obtain an analysis source file; according to the abstract syntax tree, performing syntax analysis processing on the analysis source file to obtain an incremental code list; performing collection instrumentation processing on the target code to obtain a target instrumentation code; based on a preset JaCoCo tool, collecting incremental code coverage data of the target instrumentation code to obtain collected original data; performing cleaning association processing on the collected original data to generate structured coverage rate data; according to a preset detection threshold value, performing threshold value analysis on the structured coverage rate data to generate a risk result; based on the risk result, a management action is performed on the target code. In the embodiment of the invention, fine analysis of the coverage rate of the incremental code in the target code is realized, the performance overhead is reduced, and the risk management of the target code is improved.

The present application belongs to the technical field of integrated circuit design, and particularly relates to a hardware security speculation execution unit and method based on value prediction and early verification. In order to solve the problem that the existing security speculation mechanism leads to a significant decline in the instruction level parallelism of a processor, the hardware security speculation execution unit is tightly coupled in the out-of-order processor pipeline, and comprises a speculative value prediction module, data-independent speculation conversion and execution logic, and multi-stage early verification logic. The present application generates a predicted value completely irrelevant to the physical address of an operand through value prediction, converts an unsafe memory access instruction into a data-independent speculative memory access operation, and forwards data to wake up subsequent dependent instructions. At the same time, a traceless cache read request without changing any micro-architecture state and a conflict-free shared cache detection transaction with a timeout silence mechanism are used for early verification. The present application absolutely prevents speculation execution attacks, deeply restores system performance, and avoids bus congestion and deadlock risks.

This invention discloses a method for defending against cached covert communication on an ARM platform based on noise loading injection. Due to the expanding attack surface of TEEs and the vulnerabilities of TrustZone technology in microarchitectural isolation, cached covert communication has become possible. This invention adds a defense mechanism against cached covert communication based on TrustZone technology, designing a cached covert communication defense architecture based on noise loading injection. Based on this architecture, a dynamic monitoring mechanism, a strategy optimization mechanism, and a noise injection mechanism are proposed. The dynamic monitoring mechanism monitors system security and system performance. The strategy optimization mechanism generates the optimal noise injection strategy and calculates the noise injection frequency and intensity in real time. The noise injection mechanism loads data to resist cached covert communication. This defense method improves the security of the original architecture and achieves low performance overhead, balancing system security and performance.

This invention discloses a privacy data management method and computing gateway based on a serverless architecture, relating to the field of computer technology. One specific implementation of the method includes: receiving a service request sent by an upstream computing service application; determining a target lifecycle rule corresponding to the service request based on the identifier of the target computing service application in the service request; routing the service request with the target lifecycle rule added to it to the target computing service application, so that the target computing service application stores the target privacy data from the service request in memory; and controlling the visibility of the target privacy data to the computing logic of the target computing service application when the data in memory satisfies the target lifecycle rule. This implementation controls the visibility of privacy data based on the memory where the privacy data resides, which can reduce performance overhead, avoid key security issues, and has high management efficiency.

The invention provides a method and device for adding a watermark in an image, a storage medium and a program product, and relates to the technical field of image processing, the method comprises the following steps: if it is detected that a screen image of a cloud computer is changed, performing target detection in the changed screen image; if the target is detected, acquiring watermark information to be added; and adding the watermark information into the changed screen image. In the embodiment of the invention, under the condition of detecting that the screen image of the cloud computer is changed, if the target is detected in the changed screen image, the watermark is added, otherwise, the watermark is not added, so that the problems of performance overhead and user experience interference caused by the fact that the watermark always takes effect in a user session once the watermark is started are avoided, and the user experience is improved. Dynamic adding of watermarks is achieved, performance overhead is reduced, and user experience is improved.

The invention relates to the technical field of network security, in particular to an eBPF-based access control method and device and electronic equipment, and is used for improving the efficiency and accuracy of IP black and white list access control. The method comprises the following steps: receiving target network feature information of a to-be-detected network data packet; according to a preset access control rule, performing matching query on the target network feature information through an eBPF program to obtain a matching result of the to-be-detected network data packet; the access control rule is predefined by the user space and transmitted to the kernel space; the access control rule comprises at least one of the following rules: a blacklist rule used for defining a first network feature information set forbidden to access, and a white list rule used for defining a second network feature information set allowed to access; the matching result represents a matching relationship between the network feature information and the access control rule; and performing corresponding access control on the to-be-detected network data packet through the eBPF program according to a matching result.

The application discloses a memory management method and electronic equipment, and relates to the technical field of system security. The method comprises the following steps: obtaining a kernel native heap memory allocation function and a heap memory release function; obtaining a vulnerability object allocation function; monitoring the kernel heap memory allocation function and the vulnerability object allocation function through dynamic extension of a kernel program, collecting memory pre-allocation data according to a monitoring result, and performing a write operation on the memory; comparing double-boundary memory write operation parameters with the memory pre-allocation data, and detecting heap overflow of the memory write operation according to a comparison result; and in response to a detection result of the heap overflow of the memory write operation being failed, releasing an original memory application through the heap memory release function, and reallocating the memory application through a dynamic cache pool algorithm. The application can block privilege escalation and kernel crash caused by memory heap overflow in real time, solve the problems of memory fragmentation and defense lag, and significantly improve the continuous guarantee capability of a key business scenario.

The application discloses a binary program dynamic analysis method based on a process hollowing technology, utilizes a system kernel module to further expand the ability of a traditional binary dynamic plug-in tool when performing fine-grained analysis, constructs a brand-new fine-grained analysis environment in a new hollowing process by combining a code decoupling analysis thought, can reduce the influence on the execution of a target program, improves the application range and analysis reliability of binary analysis, and can reuse the function of an application layer dynamic plug-in tool. The application utilizes the operating system characteristics to realize more flexible and efficient analysis function, gives a hollowing process environment and an analysis task construction method, and can realize fine-grained data flow analysis on special binary programs such as a vulnerability exploitation program and a countermeasure malicious program. The application method can effectively improve the application range of binary program automatic analysis, simplifies the complexity of analysis memory management, and improves the performance and stability of dynamic analysis on binary codes.

The invention relates to a file management method, device and system and a storage medium. The method comprises the steps that when an operation request of a client for a target file is received, metadata management operation matched with the operation request is executed in an embedded database of a file management system through a metadata manager of the file management system, and metadata of the target file is obtained; the metadata comprises a data reference identifier; analyzing the data reference identifier to obtain a data storage position; the data storage position is used for indicating a storage position of the target file in a target data storage rear end, and the target data storage rear end is one of a plurality of data storage rear ends butted with a storage abstraction layer of the file management system; and executing a file management operation matched with the operation request on the target file based on the data storage position in the target data storage rear end through a storage abstraction layer of the file management system. According to the scheme provided by the invention, the problems of function redundancy and hierarchical redundancy in the related technology can be solved.

This specification provides a transaction processing method and apparatus for use in a database management terminal, which manages relational databases. The transaction processing method includes: determining a target transaction based on the database logs of the relational database; determining the data file corresponding to the target transaction in the relational database and the memory object corresponding to the target transaction in memory space; establishing a mapping relationship between the target transaction, the memory object, and the data file, and storing data from the data file into a memory block contained in the memory object based on the mapping relationship; wherein the memory blocks storing the data constitute a storage link; and reading the target data corresponding to the target transaction from the memory block contained in the memory object based on the storage link, for executing the target transaction. Storing data based on the mapping relationship achieves ordered data writing, avoiding the performance overhead of random writes; and reduces the number of bytes read during data reading, improving data reading efficiency.

The present application relates to a kind of data stream integrity detection method, device, equipment and medium, its method includes: receiving the source code to be detected input by user generates original assembly file with line number information;According to read instruction and write instruction in original assembly file, define sdDFIx instruction and ldDFIx instruction using the EUI attribute of preset data;Again, code insertion is carried out to original assembly file, and new assembly file is generated;Using original instruction set architecture, the new instruction set architecture of the new assembly file containing sdDFIx instruction and ldDFIx instruction after compiling is extended to execute;Using the new instruction set architecture after extension, the new assembly file after compiling and linking is executed, and the inspection result to the code to be checked is obtained;The purpose of the present application is to solve the defects that performance overhead is large in prior art, cannot more efficiently monitor program abnormal behavior, cannot effectively protect the problems of program runtime.

This disclosure provides a method, apparatus, computer-readable storage medium, and electronic device for processing the projection of virtual objects, relating to the field of computer technology. The method includes: in response to a controlled virtual object entering an indoor game scene, acquiring first position information of the controlled virtual object in the indoor game scene and second position information of a specified pseudo-light source in the indoor game scene; determining the projection position and projection angle of the controlled virtual object in the indoor game scene based on the first and second position information; displaying a projection decal at the projection position and according to the projection angle in the indoor game scene to simulate the projection of the controlled virtual object in the indoor game scene; wherein the projection decal is generated by rendering based on scene information in the indoor game scene and a specified projection material. This disclosure improves the realism of virtual object projection and enhances the user experience.

The application discloses a kind of based on post-quantum signature operating system security authentication and key management method, belong to operating system security and quantum security technical field, including the following steps, establish the three-layer security architecture model based on hardware trust root-post-quantum signature chain-mixed key management;Operating system security authentication is carried out based on three-layer security architecture model;After security authentication passes, the whole life cycle management of post-quantum key is executed to generate key, and in the process, the way of hardware isolation and encryption protection is used to ensure that key is not leaked, traceable and controllable;Post-quantum signature and the post-quantum key obtained in the above step are deployed to the operating system and terminal equipment that have passed security authentication, the application uses the above method, realizes operating system full-scene anti-quantum security authentication, guarantees the safety of the whole life cycle of key, realizes the smooth compatibility with existing traditional cryptographic system, reduces migration cost, improves the overall security level of operating system.

The invention discloses a memory damage detection method and device, electronic equipment and a readable storage medium, and belongs to the technical field of memories. The method comprises the steps that under the condition that access operation for any target memory object is obtained, multiple real-time feature values of the target memory object are collected and based on the target memory object, and a real-time verification code to be verified is generated; obtaining a reference verification code of the target memory object from the target space; the reference verification code is generated based on a plurality of characteristic values of the collected target memory object at a historical moment; verifying the verification code to be verified based on the reference verification code, and continuing to execute the access operation under the condition that the verification code to be verified passes the verification; or, under the condition that the verification code to be verified does not pass verification, it is determined that the memory is damaged. The damage of the memory can be found in time, the process is realized through pure software, special hardware is not needed, only a small amount of extra memory is occupied, the performance overhead is small, and the real-time performance is high.

Embodiments of the present application provide a memory access processing method, device, storage medium and program product. In the embodiments of the present application, a second address page table with sub-page protection function is introduced for MMIO access, a target memory region to which a target device with write operation protection is mapped is divided into multiple sub-pages with finer granularity based on the second address page table, and a second page table entry for performing sub-page write protection on the target memory region is created on the second address conversion page table, by setting a target bit field corresponding to a target sub-page to which the target device is mapped as read-only permission, write operation on the target sub-page is intercepted. The scheme intercepts the write operation with sub-page as granularity, which can avoid intercepting the read operation on each sub-page and the write operation on other sub-pages except the target sub-page, is conducive to reducing the number of falling into the virtualization manager, reducing the performance overhead caused by the falling operation, and improving the efficiency of the memory access operation as a whole.

The invention discloses a take-out data security protection method and system. The system comprises a take-out platform module, a merchant module, a rider module, a user module and an acquisition module. And establishing a vertical alliance chain network and a horizontal alliance chain network, accessing the take-out platform modules, the merchant modules and the rider modules into the vertical alliance chain network, and accessing two or more take-out platform modules into the horizontal alliance chain network. In the vertical alliance chain network, the user personal information in the take-out platform module is encrypted by using an RSA + AES hybrid encryption algorithm, and a merchant and / or a rider needs to obtain the user personal information according to the order number and order time of the user as a decryption mode. In a horizontal alliance chain, a W-K mean value clustering analysis method is utilized to obtain user take-out dish preference, a take-out recommendation model is trained in combination with a secure multi-party calculation method, and training order data of each take-out platform is encrypted by utilizing a U-A5 stream cryptographic algorithm to ensure that the data is kept in an encrypted state in a transmission process.

The invention discloses a timeout control method and system with a security cleaning mechanism for RTOS (Real Time Operating System), and the method comprises the steps: obtaining a caller task ID (Identity) through a preset security calling interface; searching a corresponding TCB (Task Control Block) from a TCB array according to the caller task ID; checking whether a delegation task is created in the obtained TCB or not, and if not, creating a new delegation task according to the task priority of a caller and executing the new delegation task; if so, directly multiplexing and executing the existing entrusted task; after the delegation task is normally executed, the TCB is marked as an unused state, and the delegation task of the TCB is marked as a waiting state to be reused by a caller; and after timeout of the entrusting task occurs, using a security cleaning mechanism to complete timeout control. The invention aims to overcome the defects of the prior art, and provides a dynamic, safe and efficient overtime control scheme.