Intelligent universal domestic operating system vulnerability automatic identification and repair method

Abstract

The invention provides an automatic vulnerability identification and repair method for an intelligent universal domestic operating system, and belongs to the field of operating system security technology and artificial intelligence. EBPF (extended Burkley data packet filter), TEE (trusted execution environment) and bidirectional GNN-lite (simplified graph neural network) technologies are utilized to automatically identify and repair vulnerabilities of the operating system; an efficient, AI intelligent and safe vulnerability real-time identification and dynamic repair system is constructed, a closed loop of real-time monitoring, credible analysis, automatic patching and effect evaluation is established, and kernel defects are efficiently repaired on the premise of not interrupting services.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of operating system security technology and artificial intelligence, and particularly relates to an intelligent general-purpose domestic operating system vulnerability automatic identification and repair method, which utilizes eBPF (extended Berkeley Packet Filter), trusted execution environment (TEE) and GNN-lite (simplified graph neural network) technology to construct an efficient, AI intelligent and safe vulnerability real-time identification and dynamic repair system. BACKGROUND

[0002] With the in-depth implementation of the information technology self-controllable strategy, the promotion and application of domestic operating systems are continuously expanding. Compared with international mainstream systems, the domestic operating system still needs to be further improved in terms of vulnerability protection and rapid response system due to the shorter time of ecological construction. At present, the mainstream vulnerability detection technologies, such as fuzzing, static code analysis and traditional patch hot update technology, have deficiencies in compatibility and adaptability in the domestic operating system environment. At the same time, traditional security protection technologies usually rely on user-mode monitoring tools, which cannot effectively identify and quickly respond to abnormal behaviors in the kernel space in real time, so that the detection and repair efficiency of zero-day vulnerabilities (0day) and kernel vulnerabilities are severely restricted.

[0003] In recent years, the emerging artificial intelligence security analysis has begun to bring new ideas to vulnerability protection: large-scale pre-training models can extract deep semantic features from runtime event streams, graph neural networks can capture complex dependency relationships between system calls, and attention mechanisms can highlight high-risk paths among massive noise. However, these AI technologies often rely on cloud computing power and lack support for edge or domestic kernel tailoring.

[0004] In addition, existing vulnerability automatic repair technologies lack effective security isolation and sensitive data protection mechanisms, and once attackers successfully obtain kernel-level permissions, they can easily bypass or damage monitoring tools. Therefore, a general solution is needed that is compatible with the characteristics of domestic operating systems and has efficient, secure and real-time vulnerability automatic identification and dynamic repair capabilities. This solution should be able to capture security events in real time in the kernel running state, isolate kernel detection calculations at the hardware level, support rapid deployment across versions, and fully utilize the advantages of artificial intelligence models in feature understanding and association inference to make up for the shortcomings of domestic operating systems in vulnerability automatic identification and repair capabilities. SUMMARY

[0005] To solve the above technical problems, the present application provides an intelligent general-purpose domestic operating system vulnerability automatic identification and repair method.

[0006] The technical scheme of the present application is:

[0007] The application discloses an intelligent general domestic operating system vulnerability automatic identification and repair method, establishes a "real-time monitoring-trustworthy analysis-automatic patch-effect evaluation" closed loop, and efficiently repairs kernel defects under the premise of not interrupting business. Technical implementation processes comprise the following steps:

[0008] S1, kernel event collection: a general eBPF probe set is injected into a target domestic operating system kernel, system calls, memory allocation, file I / O, network packet processing and abnormal traps are tracked in detail, and a safe event stream with context is generated in real time;

[0009] S2, safe data delivery: the eBPF pushes the event stream to a built-in TEE of a platform through a shared memory ring buffer + an encryption channel; the event is encrypted with a one-time key and signed with a timestamp before entering the TEE, so that kernel state data is prevented from being stolen or tampered with;

[0010] S3, trusted vulnerability judgment: a vulnerability identification engine running in the TEE combines a rule library and a machine learning model to perform correlation analysis, utilization condition inference and danger level evaluation on the event stream, and outputs vulnerability metadata <vulnerability type, affected symbol, urgency>;

[0011] S4, automatic patch generation: the TEE calls a patch template library, automatically synthesizes repair code matched with the current kernel version and processor architecture according to the vulnerability metadata; then, the TEE completes compilation, symbol relocation and unit regression in the TEE, and digitally signs the patch package with a TEE private key;

[0012] S5, atomic hot repair: after verification of the signature, a kernel-side patch manager executes function replacement, code segment remapping and synchronization lock holding detection through an eBPF-based hot patch injection framework, so that the patch is atomically effective in a multi-core environment, and the vulnerability repair can be completed without restarting;

[0013] S6, continuous effect evaluation: after the repair is completed, the eBPF probe continues to monitor the patch coverage path and collects performance and abnormal indicators; the TEE compares the baseline before and after the repair, and if regression or performance degradation is detected, an automatic rollback or incremental optimization process is triggered;

[0014] S7, knowledge base sub-iteration: the system writes newly discovered vulnerability features, patch metadata and running effects into a local and cloud knowledge base, which is used for rule library and model iteration, and improves the generalization identification and self-healing ability of unknown threats.

[0015] Further,

[0016] 1) A CO-RE eBPF probe set is uniformly injected into a domestic operating system kernel layer, real-time running state events such as system calls, memory read / write, network transmission / reception and abnormal traps are captured, and are output through a BPFringbuf.

[0017] A set of eBPF object files with CO-RE capability are pre-compiled for each distribution; these object files automatically resolve symbols and offsets with kernel BTF meta-information, so that the same probe can dynamically adapt to different kernel configuration, different CPU architecture;

[0018] The loading stage is completed by the bpftool prog load plugin on the kernel side, and a dedicated mount point is created in / sys / fs / bpf to manage the life cycle uniformly; all probes use ring buffer to output events, and Bloom Filter is introduced for event pre-filtering, and only when suspicious paths outside the whitelist are matched, the complete stack frame is uploaded.

[0019] 2) Use one-time key encryption + TEE shared memory mapping to establish a high-throughput, low-latency, zero-leakage data channel between the kernel and the trusted execution environment.

[0020] The specific implementation is: in the kernel space, a cache based on bpf_map_type_ringbuf is established for each CPU, and the user state uses mmap to map it to the shared memory page of the TEE; the mapping address is registered in the secure world through the RPC mechanism of OP-TEE or the ocall call of SGX; each event uses a header + variable-length payload design, and the header contains the timestamp, CPUID, probe ID and 32-bit CRC; the payload is directly encrypted in the kernel state using ChaCha20-Poly1305, and the key is a session key generated by the TEE at startup and delivered in the secure channel;

[0021] At the same time, the packaging process combines several events into 4KB aligned blocks to reduce the number of TEE entries.

[0022] (3) Combine CNN model for trusted vulnerability judgment, deploy a three-stage AI judgment model in TEE: fast rule matching, bidirectional GNN-lite behavior correlation reasoning, and multi-factor risk scoring, second-level judgment of 0-day exploitability.

[0023] The specific process is as follows:

[0024] (1) First, the outermost layer is the rule matching module, all original security events from S2 are first mapped into fixed-length vectors, and then sent to a high-speed signer made of Aho-Corasick automatic mechanism; the signer maintains a compressed word library composed of public CVE entries, local historical patches and industry-specific signatures; if the new event sequence matches any pattern, the system immediately outputs the vulnerability triple and skips the subsequent reasoning, so that known risks can be located and patched in milliseconds;

[0025] 2) Secondly, when the event sequence does not hit any known pattern, it enters the second layer, i.e., bidirectional GNN-lite behavior correlation reasoning; in the process, all nodes that fall within a two-second sliding window and have not been folded are treated as active nodes, and each node essentially corresponds to an instance of a system call, a memory write, or an exception trap; the system retains a maximum of fifty thousand such nodes at the same time, and weaves a directed event graph using task IDs, time adjacency, or cross-process IPC relationships;

[0026] Bidirectional GNN-lite first uses a two-layer lightweight MLP to perform dimension lifting on the nodes, and then propagates information on the graph through a double-layer attention graph convolution; this allows information to not only flow from neighboring nodes to the center node, but also to consider the influence of spreading from the center node outward or propagating in the opposite direction along a specific path. Therefore, the bidirectional graph convolution model can capture both the "input" and "output" information flow of a node in the graph structure, thereby obtaining a more complete understanding of the role of the node in the graph structure.

[0027] The calculation of attention weights allows the model to automatically amplify the signals of high-risk call chains while suppressing noise paths, and it also provides visualizable and interpretable factors for security and operations;

[0028] After the convolution is completed, the model aggregates the last ten percent of nodes according to the attention scores, retaining only five thousand of the highest-risk representations to participate in global pooling and fully connected classification, and finally gives a probability vector of six types of high-risk vulnerabilities and a vulnerability confidence between zero and one;

[0029] (3) The innermost layer of risk scoring is responsible for converting technical judgments into operational semantics; it inputs the vulnerability types and vulnerability confidence obtained from the previous step, as well as the business priority and asset importance provided by the CMDB, into a linear scoring device, and adds the base score of this type in the CVSS table to synthesize a risk value R between zero and ten;

[0030] R is mapped to the urgency level of low, medium, high, or critical; at the same time, the attention distribution saved by bidirectional GNN-lite during the convolution process is compressed into an explanation report, which is pushed to the S4 automatic patch generation link together with the vulnerability type-affected symbol-urgency triplet.

[0031] (4) Based on the PatchBlueprint patch template library, automatically synthesize repair code that accurately matches the target kernel version and processor architecture in the TEE, and complete digital signature with an SM2 private key.

[0032] Automatic patch generation: When the vulnerability is confirmed, the TEE calls the patch template library stored in the self-security file system; each template in the library consists of three parts: trigger condition ASTPattern, repair action PatchAction, and compatibility Guard, where Guard describes the patch's dependence on specific kernel symbol tables and compilation options;

[0033] After the template is matched to the ELF symbol table cached in the TEE, the source-level repair fragment is generated in the TEE through LLVM libTooling, and then Clang-LTO is used to link with the current kernel vmlinux debug information to generate an independent.ko patch image; after compilation, the TEE runs the unit test suite to verify the correctness of the function, and deploys a micro qemu-lite environment to perform smoke testing to check the startup process; if the test passes, the image SHA-256 hash is signed using the SM2 private key, and the signature is packaged together with the patch.

[0034] (5) Perform function-level atomic replacement and data structure relocation through the eBPF-based livepatch framework to achieve hot patch deployment without rebooting or stopping.

[0035] After the signed patch enters the kernel through finit_module, it is first verified by the enhanced livepatch manager, and then three stages are applied: stop point patching, synchronization point waiting, and function replacement;

[0036] Stop point patching uses eBPF helper bpf_replace_insn to insert a jump board at the target function's first address, transferring execution to the new function;

[0037] Synchronization point waiting ensures that all CPUs in the system have run to a safe zone through stop_machine or RCU grace period;

[0038] Finally, perform vmap remapping to make the new function address the only entry, achieving true atomic switching.

[0039] For patches that change the layout of data structures, an automatic converter migrates old instances at the synchronization point to ensure consistency between the pre-state and the post-state.

[0040] (6) With the help of continuous effect evaluation + knowledge base self-iteration mechanism, the running feedback is fed back to the model weight and rule base, forming a "discovery-repair-learning" closed loop.

[0041] Continuous effect evaluation: After the patch is activated, the same batch of eBPF probes continues to collect the execution times, average latencies, and failure return codes of the target function, and performs difference detection with the baseline before the patch; the TEE side maintains a time series database, which uses EWMA and the 3σ rule to determine performance rollback or abnormal fluctuations in real time;

[0042] If there are three threshold deviations outside the threshold within 5 minutes, the TEE immediately issues a rollback instruction; the rollback process calls the livepatch revert API, and the steps are the same as S5, but the target function restores the old implementation to ensure safety.

[0043] The indicators and events collected in the evaluation stage are also marked as post-patch samples for subsequent model fine-tuning.

[0044] Knowledge base self-iteration: Finally, the vulnerability metadata, patch information, and effect evaluation results are standardized in JSON-L schema and written to the local Git-Ops repository and remote threat intelligence center; the local repository triggers the Jenkins Pipeline through the commit hook to automatically start model retraining at night during off-peak hours: the rule priority is reordered using Bayesian optimization, and the weights of the bidirectional GNN-lite are fine-tuned using incremental samples; At the same time, the Guard conditions in the patch template are cross-compared with the newly collected symbol table to generate a new version compatibility mapping; the cloud TIC aggregates anonymized data from various industry deployment instances to output a vulnerability popularity ranking and patch compatibility matrix to feedback to the community.

[0045] Through the above process, the present application forms a closed loop in the domestic operating system kernel, which integrates real-time monitoring, trusted analysis, automatic patch synthesis, and atomic-level hot repair, thereby enabling rapid discovery and immediate repair of vulnerabilities without interrupting business. The scheme ensures low-invasive compatibility across versions and across distributions with the public kernel abstraction layer design of eBPF probes; builds an end-to-end data and code trust link with AI vulnerability judgment and patch signature completed in the TEE; realizes the hot patching capability without rebooting through the function-level atomic replacement mechanism; reduces false positives, shortens repair time, and improves the generalization recognition and self-healing level of unknown defects through continuous feedback-driven knowledge base iteration, thereby significantly improving the security resilience and operational efficiency of domestic operating systems in critical scenarios.

[0046] The beneficial effects of the present application are

[0047] This invention can be embedded in self-developed domestic server operating systems, secure cloud nodes, edge industrial gateways, and other integrated hardware-software products. It can also serve as a "kernel security self-healing engine," providing services to government cloud, financial cloud, and industrial control customers in container or SaaS form. Leveraging deep integration with eBPF-TEE and an AI-driven automatic repair mechanism, it addresses the pain points of "difficult downtime, slow patching, and high compliance" in critical scenarios, reducing the average repair time for high-risk vulnerabilities from days to minutes, significantly improving customer SLAs and security resilience. The modular design allows the solution to share internal enterprise computing resources, reducing manual hardening and downtime maintenance costs; the continuously learning patch knowledge base forms reusable security assets, laying the foundation for subsequent subscription-based licensing and value-added services. Overall, this invention helps the company build differentiated security technology barriers, expand its market share in domestic operating systems and kernel security, provide customers with highly available, low-maintenance automated vulnerability protection capabilities, and further enhance the company's technological influence and market competitiveness in the field of independent and controllable security. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the bidirectional GNN-lite network architecture of the present invention;

[0049] Figure 2 This is a schematic diagram of the workflow of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0051] The present invention provides an intelligent and universal method for automatic identification and repair of vulnerabilities in domestically produced operating systems, specifically comprising:

[0052] S1, Kernel event collection: In the context of domestic operating systems, first, a set of eBPF object files with CO-RE (Compile Once-Run Everywhere) capabilities need to be pre-compiled for each distribution (UOS, Kirin, openEuler, Longxi, etc.). These object files use kernel BTF (BPF Type Format) meta-information to automatically parse symbols and offsets, so that the same probe can dynamically adapt to different kernel configurations and different CPU architectures (x86_64, ARM64, LoongArch, RISC-V). The loading stage is completed by the bpftool prog load plug-in on the kernel side, and a dedicated mount point is created in / sys / fs / bpf to manage the life cycle uniformly. The probe focuses on five domains: system call entry (tracepoint / syscalls), memory allocation interface (kmalloc / kfree), file read-write path (vfs_read / vfs_write), network protocol stack key function (tcp_recvmsg / udp_sendmsg), and exception handling link (do_page_fault, __stack_chk_fail). In order to reduce the overhead of instrumenting, all probes use a ring buffer (BPFringbuf) to output events, and a Bloom Filter is introduced for event pre-filtering, only uploading complete stack frames when suspicious paths outside the whitelist are matched. Through this on-demand sampling mechanism, millisecond-level kernel dynamics can be stably captured with an increase in CPU usage of no more than 2%. For domestic OS, it significantly improves the fragmented status of the lack of unified monitoring interface and the need to adapt to kernel module logs separately, allowing first-hand data of vulnerability behavior to be consistently collected across versions and platforms, laying a precise and real-time foundation for subsequent analysis.

[0053] S2, secure data delivery: the collected event data needs to be sent to the TEE in a low-latency manner with confidentiality and integrity. The specific implementation is: a cache area based on bpf_map_type_ringbuf is established for each CPU in the kernel space, and the user state uses mmap to map it to the shared memory page of the TEE; the mapping address is registered in the secure world through the RPC mechanism of OP-TEE or the ocall call of SGX. Each event uses a header + variable-length payload design, the header contains a timestamp, CPUID, probe ID and 32-bit CRC; the payload is directly encrypted in the kernel state using ChaCha20-Poly1305, and the key is a session key generated by the TEE at startup and delivered in a secure channel. In this way, even if the attacker obtains the kernel read permission, he cannot decrypt the event content. At the same time, the packaging process combines multiple events into 4KB aligned blocks to reduce the number of TEE entries. Experiments show that on a 64-core ARM server, the delivery delay of 100,000 events per second is kept within 35μs. For domestic OS, this link unifies the information scattered in dmesg, auditd and perf events, strengthens the security boundary between the kernel state and the user state, blocks common side channels that steal sensitive information through debug interfaces, and provides a trusted data source for the vulnerability analysis stage.

[0054] S3, trusted vulnerability judgment: the analysis engine in the TEE is divided into three submodules: rule matching, behavior correlation inference and risk scoring. Rule matching is based on community CVE database, local historical patches and industry-specific rule library encrypted by national cryptographic algorithm, and uses eBPF bytecode to perform JIT execution in TEE, which is convenient for hot update and does not expose plaintext signature. The behavior correlation module maintains an event graph through a sliding window, builds a directed graph of system call sequences, memory writes and exception trap nodes, and calculates node attention weights using a bidirectional GNN-lite (simplified graph neural network) to determine whether the preconditions for vulnerability exploitation are met. Risk scoring gives the final level by combining the Common Vulnerability Scoring System (CVSS) template, business priority and asset importance.

[0055] Further, the analysis engine in the TEE relies on three AI submodules: (1) the rule matching module is responsible for interfacing with the community CVE library, local historical patches and industry-specific rule library; (2) the behavior correlation inference module uses a lightweight bidirectional GNN-lite (simplified graph neural network) to perform attention calculation on the "event graph"; (3) the risk scoring module outputs the final level by combining the CVSS template and business priority. The specific process is as follows:

[0056] (1) First, the outermost layer is the rule matching module, which undertakes the responsibility of "fast and deep": all original security events from S2 are first mapped into fixed-length vectors, and then sent to a high-speed checker made of Aho-Corasick automaton; the checker maintains a compressed vocabulary composed of public CVE entries, local historical patches, and industry-specific signatures. If the new event sequence matches any pattern, the system immediately outputs the vulnerability triple and skips the subsequent reasoning, so that known risks can be located and patched within milliseconds.

[0057] (2) Second, when the event sequence does not hit any known pattern, it enters the second layer - the bidirectional GNN-lite behavior correlation model. The structure is as follows:

[0058]

[0059] During the process, all nodes that fall within the two-second sliding window and have not been folded are considered "active nodes", each of which essentially corresponds to an instance of system call, memory write, or exception trap; the system retains a maximum of fifty thousand such nodes at the same time, and weaves them into a directed event graph using task ID, time adjacency, or cross-process IPC relationship. Bidirectional GNN-lite first uses two layers of light MLP to enhance the dimension of the nodes, and then propagates information on the graph through double-layer attention graph convolution. The calculation of attention weights allows the model to automatically amplify the signal of high-risk call chains and suppress noise paths, while it also provides visualizable and interpretable factors for security and operation and maintenance. After convolution, the model aggregates the tail 90% of the nodes according to the attention scores, retaining only five thousand highest-risk representations to participate in global pooling and fully connected classification, and finally gives a probability vector of six high-risk vulnerabilities and a zero-to-one exploitable confidence. The entire reasoning process can still process thousands of events within a delay of about three milliseconds under the memory limit of sixteen MB EPC TEE, which is sufficient to meet the needs of the second closed loop.

[0060] (3) The innermost risk scoring module is responsible for converting technical judgments into operation and maintenance semantics. It sends the vulnerability type, exploit confidence, business priority, and asset importance provided by CMDB into a linear scorer, and adds the base score of the type in the CVSS table to synthesize a risk value R between zero and ten. R is mapped to the urgency level of low, medium, high, or critical; at the same time, the attention distribution saved by bidirectional GNN-lite during convolution is compressed into an explanation report, which is pushed to the S4 automatic patch generation link together with the "vulnerability type - affected symbol - urgency level" triple. In this way, the system can not only confirm known threats within milliseconds, but also make credible judgments about unknown zero-day vulnerabilities within seconds, and provide sufficient, interpretable, and actionable decision-making basis to the subsequent links.

[0061] S4, Automatic patch generation: When the vulnerability is confirmed, the TEE calls the "patch template library (PatchBlueprint)" stored in the self-security file system. Each template in the library consists of three parts: trigger condition ASTPattern, repair action PatchAction, and compatibility Guard, where Guard describes the dependence of the patch on the specific kernel symbol table, compilation options. After the template is matched to the cached ELF symbol table in the TEE, a source-level repair fragment is generated in the TEE through LLVM libTooling, and then Clang-LTO is used to link with the current kernel vmlinux debug information to generate an independent.ko patch image. After compilation, the TEE runs a unit test suite (based on KUnit) to verify the correctness of the function, and deploys a micro qemu-lite environment to perform smoke testing to check the startup process. If the test passes, the SHA-256 hash signature of the image is signed using the SM2 private key, and the signature is packaged together with the patch. This process takes an average of 3.2s on an 8-core TrustZoneSoC. For domestic OS, this means that the security team can arrange common buffer overflow, null pointer protection, permission check missing and other high-frequency defects as templates, and automatically generate special edition patches by TEE, getting rid of the passive situation of relying on the upstream community waiting window.

[0062] S5, Atomic hot repair: After the signed patch enters the kernel through finit_module, it is first verified by the enhanced livepatch manager SM2 signature, and then three stages are applied: stop point insertion, synchronization point waiting, and function replacement. Stop point insertion uses eBPF helper bpf_replace_insn to insert a jump board at the target function first address, which transfers execution to a new function; synchronization point waiting ensures that all CPUs in the system have run to the safe area through stop_machine or RCU grace period; finally, vmap remapping is performed to make the new function address the only entry, realizing real atomic switching. For patches that change the layout of data structures, the system automatically generates a converter to migrate old instances at the synchronization point, ensuring consistency between the pre-state and the post-state. The entire injection process takes an average of 50ms on a 64-core server, and the business is not sensitive to jitter. The mechanism proposed by this method solves the pain point of "unable to patch without downtime" in the scenario of large databases, core transactions, etc. of domestic OS, significantly improving availability and response speed.

[0063] S6, continuous effect evaluation: after the patch is activated, the same batch of eBPF probes continues to collect the execution times, average latencies and failure return codes of the target function, and the indicators are compared with the baseline before the patch to detect differences. The TEE side maintains a time series database, which uses EWMA (exponential weighted moving average) and the 3σ rule to determine performance rollback or abnormal fluctuations in real time. If there are three threshold deviations in a row within 5 minutes, the TEE will immediately issue a rollback instruction; the rollback process calls the livepatch revert API, which has the same steps as S5 but restores the old implementation of the target function to ensure safety. In addition, the indicators and events collected in the evaluation stage are also marked as "post-patch" samples for subsequent model fine-tuning. This closed loop allows the patch deployment of domestic OS to no longer rely on manual gray-scale observation, achieving truly unattended safe operation and maintenance.

[0064] S7, knowledge base self-iteration: the system finally standardizes the vulnerability metadata, patch information and effect evaluation results in JSON-L schema, and writes them into the local Git-Ops repository and the remote threat intelligence center (TIC). The local repository triggers the Jenkins Pipeline through the commithook, and automatically starts model retraining at night during off-peak hours: the rule priority is reordered using Bayesian optimization, and the weights of the bidirectional GNN-lite are fine-tuned using incremental samples; at the same time, the Guard conditions in the patch template are cross-compared with the newly collected symbol table to generate a new version compatibility mapping. The cloud TIC aggregates anonymized data from various industry deployment instances and outputs a "vulnerability popularity ranking" and a "patch compatibility matrix" to feedback to the community. In the long run, this self-iterative mechanism enables the domestic OS to evolve from data to knowledge and then to capability, breaking through the lag problem of single-point deployment and model stopped learning in the past, and also providing high-quality samples and verification data for national vulnerability library construction.

[0065] Through the in-depth implementation of the above steps, the application not only has engineering feasibility in the technical route, but also provides a fast, reliable and low-cost automatic vulnerability discovery and repair solution for the domestic operating system in the security governance layer - which not only fills the gap of real-time defense, but also significantly reduces the cost of manual analysis and downtime maintenance, providing strong support for the safe and stable operation of critical infrastructure.

[0066] Embodiment 1:

[0067] Embodiment one: secure online repair based on openEuler cloud data center

[0068] A departmental government cloud built an IaaS cluster of 600 ARM64 Kunpeng920 servers with openEuler22.03LTS (kernel version 5.10.0-137.el2). To handle kernel security flaws without interrupting high-concurrency tax business, the platform loaded a unified compiled CO-RE eBPF probe on all compute nodes. The probe covers syscall entry, kmalloc / kfree, TCP transport functions, and do_page_fault exception links, and writes events to / sys / fs / bpf / osec_ring through BPFringbuf. At startup, the daemon on the node calls OP-TEE RPC to map the ringbuf as secure world shared memory and complete a one-time session key agreement; this ensures that the original kernel stack frame is encrypted by ChaCha20-Poly1305 before being transmitted across domains.

[0069] After running for three weeks, the analysis engine in the TEE detected a previously undocumented call sequence: setxattr() -> vfs_write() occasionally accompanied by oops: unable to handle kernel NULL pointer dereference under high concurrency. Rule matching and graph correlation inference confirmed that the flaw was a null pointer dereference triggered by VFS cache aging, with a CVSS estimate of 8.8, requiring a 48-hour fix. The analysis engine then generated metadata, as follows:

[0070] <null-ptr-vfs, inode_security_list, critical>

[0071] Next, the patch template library was called. The template injected a non-null check and a quick return path for security_inode_free before the affected commit in the TEE via LLVM libTooling, and the KUnit test and qemu-lite startup self-check took only 3.5 seconds to generate a signed ko package.

[0072] Then, the patch is delivered by the livepatch manager: first, write the trampoline at the head address of the target function; then wait for the RCU grace period, so that all 64 CPUs enter the safe point; finally, remap the new function page and resume execution. The switching process takes 41 milliseconds, and the tax business QPS fluctuation is less than 0.3%. After 30 minutes of patch taking effect, eBPF reports that the call sequence has disappeared, and there is no obvious rollback in the performance baseline comparison. The system synchronizes the vulnerability features, patch hashes, and monitoring indicators to the cloud threat intelligence center, and the rule library is strengthened; the new version template is automatically pushed to other openEuler nodes without manual intervention. Through this practice, the government cloud first realizes "minute-level discovery-minute-level repair-zero downtime deployment" in the production environment, greatly compresses the high-risk vulnerability window period, and meets the compliance requirements of the third level of the kernel defect repair time limit of the level protection.

[0073] The present application introduces AI-driven runtime semantic analysis and TEE-level data isolation on the basis of traditional kernel live-patch and fuzz testing, and connects the complete link of "real-time monitoring-trustworthy judgment-automatic repair". Compared with the existing offline scanning or manual auditing method: (i) CO-RE probe solves the problem of large differences in domestic kernel pruning and difficult module adaptation; (ii) lightweight bidirectional GNN-lite compresses deep learning inference to MB-level memory, making security computing first land in TEE; (iii) PatchBlueprint template library streamlines common defect repair processes, shortening patch generation time from hours to seconds; (iv) livepatch combined with eBPF realizes the atomic effect of signature patches in the kernel state, completely eliminating the business downtime window. These improvements together fill the technical gap of domestic OS in the aspects of "high real-time, strong isolation, and automatic closed loop".

[0074] The above only describes the preferred embodiments of the present application, which are used to illustrate the technical solutions of the present application, and are not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application is included in the protection scope of the present application.

Claims

1. A method for automatic identification and repair of vulnerabilities in a smart, universal, domestically-made operating system, characterized in that, Technical implementation process: S1. Kernel Event Acquisition: Inject a general eBPF probe set into the kernel of the target domestic operating system to perform fine-grained tracking of system calls, memory allocation, file I / O, network packet processing and exception traps, and generate a security event stream with context in real time. S2. Secure Data Delivery: eBPF pushes the event stream to the platform's built-in TEE via a shared memory ring buffer and encrypted channel; Before entering the TEE, the event undergoes one-time key encryption and timestamp signing to prevent kernel-mode data from being stolen or tampered with; S3, Trusted Vulnerability Determination: The vulnerability identification engine running inside the TEE combines a rule base and a machine learning model to perform correlation analysis, exploit condition inference, and risk level assessment on the event stream, and output vulnerability metadata, namely vulnerability type, affected symbols, and urgency level. S4. Automatic Patch Generation: TEE calls the patch template library and automatically synthesizes fix code that matches the current kernel version and processor architecture based on vulnerability metadata; then, compilation, symbol relocation and unit regression are completed within TEE, and the patch package is digitally signed with the TEE private key; S5, Atomic Hot Patching: After the kernel-side patch manager verifies the signature, it performs function replacement, code segment remapping, and synchronization lock holding detection through the eBPF-based hot patch injection framework to ensure that the patch takes effect atomically in a multi-core environment and can complete the vulnerability repair without restarting. S6. Continuous effect evaluation: After the repair is completed, the eBPF probe continues to monitor the patch coverage path and collect performance and abnormal indicators; the TEE compares the baseline before and after the repair, and if regression or performance degradation is detected, it triggers an automatic rollback or incremental optimization process. S7. Knowledge Base Sub-Iteration: The system writes newly discovered vulnerability characteristics, patch metadata, and runtime effects into the local and cloud knowledge bases for rule base and model iteration, improving the generalized identification and self-healing capabilities for unknown threats.

2. The method according to claim 1, characterized in that, A CO-REeBPF probe set is uniformly injected into the kernel layer of the domestic operating system to capture runtime events such as system calls, memory read and write, network transmission and reception, and exception traps in real time, and output them through BPFringbuf; A set of eBPF object files with CO-RE capability are pre-compiled for each distribution; these object files use kernel BTF metadata to automatically resolve symbols and offsets, enabling the same probe to dynamically adapt to different kernel trimming configurations and different CPU architectures; The loading phase is completed by the kernel-side bpftool prog load plugin, and a dedicated mount point is created in / sys / fs / bpf for unified lifecycle management. All probes use a circular buffer to output events, and a Bloom filter is introduced for event pre-screening, uploading the complete stack frame only when a suspicious path outside the whitelist is matched.

3. The method according to claim 2, characterized in that, By using one-time key encryption and TEE shared memory mapping, a high-throughput, low-latency, zero-leakage data channel is established between the kernel and the trusted execution environment; The specific implementation is as follows: a buffer based on bpf_map_type_ringbuf is established for each CPU in kernel space, and mmap is used in user space to map it to the shared memory page of TEE; the mapped address is registered in the secure world through the RPC mechanism of OP-TEE or the ocall call of SGX; each event adopts a header + variable-length payload design, the header contains timestamp, CPUID, probe ID and 32-bit CRC; the payload is directly encrypted in kernel space using ChaCha20-Poly1305, and the key is the session key generated by TEE at startup and distributed in the secure channel; Meanwhile, the packaging process merges several events into a 4KB aligned block to reduce the number of TEE entries.

4. The method according to claim 2, characterized in that, Combining CNN models for trusted vulnerability assessment, a three-stage AI assessment model is deployed within the TEE: rule matching, bidirectional GNN-lite behavior-related inference, and risk scoring, enabling 0-day exploitability assessment in seconds. The specific workflow is as follows: (1) First, the outermost layer is rule matching. All raw security events from S2 are first mapped into fixed-length vectors and then fed into a high-speed check-in device made of Aho-Corasick automata. The check-in device maintains a compressed vocabulary consisting of public CVE entries, local historical patches and industry-specific signatures. If a new event sequence matches any of the patterns in the vocabulary, the system immediately outputs the vulnerability triplet and skips subsequent reasoning, so that known risks can be located and patched in milliseconds. 2) Secondly, if the event sequence does not hit any known pattern, it enters the second layer, namely bidirectional GNN-lite behavior-related reasoning; during the process, all nodes that fall within the two-second sliding window and have not yet been collapsed are considered active nodes. Each node essentially corresponds to an instance of a system call, a memory write, or an exception trap; the system can retain up to 50,000 such nodes at the same time and weaves them into a directed event graph using task ID, time adjacency, or cross-process IPC relationships; Bidirectional GNN-lite first uses two lightweight MLP layers to increase the dimensionality of nodes, and then uses two-layer attention graph convolution to propagate information on the graph, so that information not only flows from neighboring nodes to the central node, but also considers the influence of spreading outward from the central node or back propagating along a specific path. The calculation of attention weights allows the model to automatically amplify the signals of high-risk call chains while suppressing noisy paths. At the same time, it also provides a visual and interpretable factor for safe operation and maintenance. After convolution, the model aggregates the last 90% of nodes based on the attention score, retains only the 5,000 highest-risk representations to participate in global pooling and fully connected classification, and finally gives the probability vectors of six types of high-risk vulnerabilities and an exploitability confidence between zero and one. (3) The innermost risk score is responsible for converting technical judgments into operational semantics. It takes the vulnerability type and exploit confidence obtained in the previous step, together with the business priority and asset importance provided by CMDB, and feeds them into the linear scorer. It also adds the baseline score of the type in the CVSS table to synthesize a risk value R between zero and ten. R is mapped to a level of urgency: low, medium, high, or critical. Meanwhile, the attention distribution preserved by the bidirectional GNN-lite during convolution is compressed into an explanation report, which is pushed to the S4 automatic patch generation pipeline along with the vulnerability type-affected symbol-urgency triplet.

5. The method according to claim 2, characterized in that, Based on the PatchBlueprint patch template library, the patch code that matches the target kernel version and processor architecture is automatically synthesized within the TEE, and digital signature is completed using the SM2 private key; Automatic patch generation: Once a vulnerability is confirmed, the TEE calls the patch template library stored in its own secure file system; Each template in the library consists of three parts: trigger condition ASTPattern, patch action PatchAction, and compatibility Guard, where the Guard describes the patch's dependencies on a specific kernel symbol table and compilation options; After the template matches the ELF symbol table cached in the TEE, a source-level repair fragment is generated within the TEE using LLVMlibTooling. Then, Clang-LTO is used to link with the current kernel's vmlinux debugging information to generate an independent .ko patch image. After compilation, the TEE runs a unit test suite to verify the correctness of the functionality and deploys a mini qemu-lite environment to perform smoke tests to check the boot process. If the test passes, the national cryptographic SM2 private key is used to sign the image using SHA-256 hash, and the signature is encapsulated together with the patch.

6. The method according to claim 2, characterized in that, The eBPF-based livepatch framework performs function-level atomic replacement and data structure relocation to achieve hot patch deployment without restarting or downtime. After the signature patch enters the kernel through the finit_module, the enhanced livepatch manager first verifies the SM2 signature, and then applies three stages: pause point instrumentation, synchronization point waiting, and function replacement. The pause point instrumentation uses eBPFhelperbpf_replace_insn to insert a jumper at the starting address of the target function, transferring execution to the new function; Synchronization point waiting ensures that all CPUs in the system have moved to the safe zone by using stop_machine or RCU grace period; Finally, vmap remapping is executed to make the new function address the only entry point, achieving true atomic switching.

7. The method according to claim 6, characterized in that, For patches that change the data structure layout, an automatic converter is generated to migrate the old instance at the synchronization point, ensuring consistency between the before and after states.

8. The method according to claim 2, characterized in that, Continuous performance evaluation: After the patch is activated, the same batch of eBPF probes continue to collect the number of times the target function is executed, the average latency and failure return codes, and the differences between the indicators and the baseline before the patch are detected; the TEE side maintains a time series database and uses EWMA and the 3σ rule to determine performance regression or abnormal fluctuations in real time. If three out-of-threshold deviations occur consecutively within 5 minutes, the TEE immediately issues a rollback instruction; the rollback process calls the livepatch revert API, the steps are the same as S5, but the target function is restored to the old implementation to ensure a safety fallback.

9. The method according to claim 8, characterized in that, The metrics and events collected during the evaluation phase will also be labeled as post-patch samples for subsequent model fine-tuning.

10. The method according to claim 2, characterized in that, Knowledge base self-iteration: Finally, vulnerability metadata, patch information, and effect evaluation results are standardized using JSON-Lschema and written to the local Git-Ops repository and the remote threat intelligence center; the local repository triggers JenkinsPipeline via commit hook to automatically start model retraining during off-peak hours at night: rule priorities are reordered using Bayesian optimization, and the weights of bidirectional GNN-lite are fine-tuned using incremental samples; at the same time, the Guard conditions in the patch template are cross-referenced with the newly collected symbol table to generate a new version compatibility mapping; the cloud-based TIC aggregates anonymized data from deployment instances across various industries and outputs a vulnerability popularity ranking and patch compatibility matrix to give back to the community.

Images