Quantum state-based program behavior intervention method

Abstract

The application discloses a quantum state-based program behavior intervention method, and particularly relates to the technical field of computer security protection, and is used for solving the resource conflict and stability decline caused by systematic mismatch when quantum randomness is directly introduced into a classical computing system; through real-time acquisition of a quantum random number sequence and synchronous monitoring of system state parameters of a target program, a cluster mode in the random sequence is identified, and the system state is coupled to determine an intervenable scheduling gap of the operating system; subsequently, the matching degree of the cluster mode and the scheduling gap is evaluated to determine a compatibility relationship; based on the relationship and the system state parameters, a Pareto frontier of intervention efficiency and system stability is constructed, and an optimized solution set is determined; through evaluation of the cumulative effect of the optimized solution and historical intervention, an adaptive operation point is selected; finally, an intervention instruction is generated according to the operation point by modulating the quantum random number sequence, and the intervention instruction is injected into the target program; and the adaptive cooperation of quantum randomness and system determinism is realized.

Description

Technical Field

[0001] This invention relates to the field of computer security protection technology, and more specifically, to a method for intervening in program behavior based on quantum states. Background Technology

[0002] In the field of software security, dynamic program behavior intervention is an important defense technique. Its core idea is to increase the difficulty for attackers to analyze and exploit vulnerabilities by changing the program's execution environment or code presentation in real time. Existing technologies generally employ randomization methods based on classical computing resources, such as using pseudo-random number generators to periodically change the program's memory address space layout or instruction encoding. To further enhance the unpredictability of this change, the industry has begun to explore the introduction of physical random sources. Among these, quantum random number generators based on quantum measurement principles have attracted attention due to their ability to generate sequences with theoretically true randomness and are being considered for driving the aforementioned dynamic intervention strategies to address high-level persistent threats.

[0003] However, directly introducing this extreme randomness derived from quantum processes into classical computing systems that heavily rely on deterministic scheduling and resource management can lead to systemic mismatch problems. Classical operating systems and runtimes are designed based on predictable logical states for resource allocation and task scheduling, while extremely high-frequency truly random intervention signals can disrupt this deterministic premise, leading to underlying resource access conflicts, decreased system stability, and even potentially exposing new attack timing windows due to the specific statistical characteristics of random sequences. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the present invention provides a quantum state-based method for intervening in program behavior to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] Quantum state-based methods for intervening in programmed behavior include:

[0007] S1. Obtain a quantum random number sequence from the quantum random number generator and monitor the runtime state of the target program to obtain system state parameters;

[0008] S2. Identify the clustering patterns in the process of quantum random number sequence changes, and determine the interventionable scheduling gap of the operating system where the target program is located based on the system state parameters.

[0009] S3. Evaluate the matching degree between the clustering pattern and the intervenable scheduling gap to determine their compatibility.

[0010] S4. Based on the compatibility relationship and system state parameters, construct a Pareto front with intervention effectiveness and system stability as optimization objectives, and determine the set of optimal solutions on the Pareto front.

[0011] S5. Evaluate the cumulative effect of each operation point in the optimal solution set combined with the historical intervention command sequence, and select the fit operation point from the optimal solution set that makes the cumulative effect tend to be optimal.

[0012] S6. Modulate the quantum random number sequence according to the adaptive operation point to generate an intervention instruction sequence and send it to the target program to execute the program behavior intervention.

[0013] Furthermore, a quantum random number sequence is obtained from a quantum random number generator, and the runtime state of the target program is monitored to obtain system state parameters, including:

[0014] The system receives raw random number streams generated by a quantum random number generator in real time and buffers the raw random number streams in a first-in-first-out queue to form a quantum random number sequence.

[0015] Meanwhile, by calling the operating system kernel interface, the CPU utilization, memory page fault frequency, and I / O wait time of the target process are continuously monitored and recorded as system status parameters.

[0016] Furthermore, the clustering patterns in the quantum random number sequence variation process are identified, and the operable scheduling gaps of the operating system where the target program resides are determined based on system state parameters, including:

[0017] Based on the dynamic division of active and silent intervals by the jump frequency between consecutive bits in a quantum random number sequence, the active interval is identified as a clustering mode.

[0018] The intersection of the CPU utilization valley range and the memory page fault frequency stable range in the system status parameters is calculated, and the intervenable scheduling gap is determined based on the calculation result.

[0019] Among them, the identification of the active range of the clustering mode and the determination of the intervenable scheduling gap are both based on the same set of system state parameters for synchronous adaptive adjustment.

[0020] Furthermore, the intersection calculation of the CPU utilization trough range and the stable range of memory page fault frequency in the system status parameters is performed, including:

[0021] Monitor the CPU utilization rate and mark periods of continuous low load threshold as valley intervals;

[0022] Monitor the frequency of memory page faults and mark periods with fluctuations less than the stability threshold as stable intervals;

[0023] Align the valley interval and the stable interval on the system time axis, and take the time overlap as the interventional scheduling gap.

[0024] Furthermore, the matching degree between the clustering pattern and the operable scheduling gap is evaluated to determine their compatibility, including:

[0025] The synergy between the duration distribution of the active intervals of the clustering pattern and the periodic distribution of the occurrence of the intervenable scheduling gaps was analyzed.

[0026] Based on synergy, determine whether the active interval can be fully contained within the intervenable scheduling gap, and identify the lead or lag deviation patterns between the two on the time axis.

[0027] Based on the inclusion integrity and deviation mode, a compatibility relationship graph is dynamically constructed to quantify the matching degree. The compatibility relationship graph represents the matching degree as a multi-level compatibility relationship from conflict, adaptability to synchronization.

[0028] Furthermore, the synergy between the duration distribution of active intervals and the periodic distribution of intervenable scheduling gaps is analyzed, including:

[0029] Calculate the ratio of the expected duration of the active interval to the length of the scheduling gap period;

[0030] Analyze the phase deviation between the start time of the active interval and the opening time of the scheduling gap;

[0031] The magnitude of the ratio and the direction of the phase deviation determine whether a clustered event can be fully contained within the scheduling gap.

[0032] Furthermore, based on compatibility relations and system state parameters, a Pareto front is constructed with intervention effectiveness and system stability as optimization objectives, and the set of optimal solutions on the Pareto front is determined, including:

[0033] The multi-level compatibility relationships in the compatibility relationship graph are mapped as the basic weights of intervention effectiveness, while the CPU utilization rate and memory page fault frequency in the system state parameters are used as dynamic constraints on system stability.

[0034] Using basic weights and dynamic constraints as boundaries, multiple candidate solutions in the two dimensions of intervention effectiveness and system stability are generated through enumeration.

[0035] Candidate solutions that are surpassed by other candidate solutions in both intervention effectiveness and system stability are eliminated, and the remaining set of unsurpassable candidate solutions is determined as the set of optimal solutions on the Pareto front.

[0036] Furthermore, generating candidate solutions through enumeration includes:

[0037] The basic weights are used as the basic values ​​for intervention effectiveness, and dynamic constraints are used as boundary limits;

[0038] Discretize the intervention parameters to generate candidate solutions with different parameter combinations;

[0039] Each candidate solution corresponds to a set of estimated intervention efficacy values ​​and system stability indicators.

[0040] Furthermore, the cumulative effect of each operation point in the optimal solution set combined with the historical intervention command sequence is evaluated, and the fit operation point that makes the cumulative effect tend to be optimal is selected from the optimal solution set, including:

[0041] A time decay window was set for the historical intervention command sequence, and the long-term impact trend of the clustering intensity of similar intervention commands within the time decay window on the memory page fault frequency in the system status parameters was analyzed.

[0042] Each operation point in the optimized solution set is superimposed with the long-term influence trend for prediction, and the expected change trajectory of the system state parameters after superposition is calculated.

[0043] By comparing the smoothness and convergence of the expected change trajectory corresponding to each operation point, the operation point that makes the expected change trajectory smoothest and stabilizes fastest is selected as the adaptive operation point.

[0044] Furthermore, the quantum random number sequence is modulated according to the adaptive operating point to generate an intervention instruction sequence, which is then sent to the target program to execute program behavior intervention, including:

[0045] Based on the intervention intensity parameter characterized by the adaptive operation point, the active region in the quantum random number sequence is selectively sampled and remapped;

[0046] The remapped active region data stream is encoded into a sequence of memory address offset instructions that conform to the target program's memory management interface specification;

[0047] By injecting a sequence of memory address offset instructions into the target program's runtime environment through the operating system's inter-process communication mechanism, the program's behavior can be intervened.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. By introducing a deep coordination mechanism between quantum random number sequences and system runtime states, the systemic mismatch problem caused by directly introducing quantum randomness into classical computing systems is effectively solved. By monitoring the system state parameters of the target program in real time and intelligently identifying the clustering patterns in the quantum random number sequences, the intervention behavior can be precisely aligned with the operable scheduling gaps of the operating system. This ensures that the unpredictability brought by quantum randomness will not undermine the deterministic scheduling foundation of the underlying system, thereby significantly improving the system stability and reliability of the intervention process. At the same time, by constructing a Pareto front optimized with intervention effectiveness and system stability as multiple objectives, and considering the cumulative effect of historical interventions in the decision-making process, a highly adaptive intervention strategy generation method is realized, which can maximize the protective benefits brought by randomization while ensuring security.

[0050] 2. By evaluating the compatibility of the activity characteristics of quantum random sequences with system scheduling gaps and generating an optimized solution set based on this, the generation of intervention commands is no longer blindly randomized, but transformed into a controlled and predictable optimization process. This transformation allows quantum randomness to be introduced in a way that is coordinated with the system's operating rhythm, preserving the security advantages of randomness while avoiding performance jitter or resource contention caused by timing conflicts. Finally, by modulating quantum random number sequences to generate intervention commands that conform to the target program specifications, non-intrusive and fine-grained behavior guidance is achieved, effectively improving the software's dynamic defense capabilities against advanced threats, while ensuring the continuous availability and performance of the application. Attached Figure Description

[0051] Figure 1 This is a flowchart of the quantum state-based program behavior intervention method of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Example: Figure 1 The present invention provides a quantum state-based method for intervening in program behavior, comprising:

[0054] S1. Obtain a quantum random number sequence from the quantum random number generator and monitor the runtime state of the target program to obtain system state parameters;

[0055] S2. Identify the clustering patterns in the process of quantum random number sequence changes, and determine the interventionable scheduling gap of the operating system where the target program is located based on the system state parameters.

[0056] S3. Evaluate the matching degree between the clustering pattern and the intervenable scheduling gap to determine their compatibility.

[0057] S4. Based on the compatibility relationship and system state parameters, construct a Pareto front with intervention effectiveness and system stability as optimization objectives, and determine the set of optimal solutions on the Pareto front.

[0058] S5. Evaluate the cumulative effect of each operation point in the optimal solution set combined with the historical intervention command sequence, and select the fit operation point from the optimal solution set that makes the cumulative effect tend to be optimal.

[0059] S6. Modulate the quantum random number sequence according to the adaptive operation point to generate an intervention instruction sequence and send it to the target program to execute the program behavior intervention.

[0060] To achieve quantum-state-based intervention in program behavior, the acquisition of quantum random number sequences and monitoring of system state parameters are first required. In practice, a data connection is established with a quantum random number generator following relevant communication protocols via a physical connection using a universal serial bus interface or Ethernet interface. The generator continuously reads the raw random number stream generated by the device based on physical effects such as photonic vacuum fluctuations or quantum noise from semiconductor light sources. This raw random number stream is a continuous data stream composed of binary bits, and its generation rate is determined by the physical characteristics of the quantum random number generator, potentially reaching several gigabits per second. To smooth out data flow fluctuations and temporarily store the data, the received raw random number stream is buffered in real-time by a software-implemented first-in-first-out (FIFO) queue in memory. This FIFO queue has a fixed capacity, the size of which is set according to the processing power of the target system and the expected intervention delay requirements; for example, it can be set to hold 1024 bytes. This capacity selection ensures data freshness while providing sufficient data for subsequent analysis. When the data in the queue reaches half its capacity, a quantum random number sequence of a certain length is considered to have been formed and is ready for subsequent processing steps. The purpose of this approach is to ensure that the random number sequences processed in subsequent steps are of sufficient length for statistical analysis, while avoiding data loss due to mismatch in data processing speed.

[0061] While acquiring the quantum random number sequence, the runtime state of the target program needs to be monitored in parallel to obtain system status parameters. Monitoring is achieved by calling standard kernel interfaces provided by the operating system, such as the proc filesystem or the perf_event_open system call in Linux. For monitoring CPU utilization, the task control block structure corresponding to the target process in the operating system's process scheduler is read periodically. The ratio of the actual CPU time occupied by the target process in the most recent scheduling cycle to the total scheduling cycle time recorded in this structure is extracted and used as the CPU utilization rate, which is a floating-point number between 0 and 1. The monitoring period can be consistent with the system scheduling clock interrupt cycle; for example, in Linux, it can be set to 10 milliseconds. This period balances the real-time performance of the monitoring with system overhead.

[0062] Monitoring the frequency of memory page faults is achieved by intercepting page fault events reported by the operating system kernel to the target process. Specifically, a page fault event callback function is registered through a kernel interface such as the PageFault interrupt handler. Whenever a major or minor page fault occurs in the target process, this callback function is triggered, and an error count variable is incremented within the function. Simultaneously, a high-precision timer is set, for example, at 1-second intervals, to periodically read the value of this error count variable and reset it to zero. The number of page faults recorded per second is the memory page fault frequency, measured in faults per second.

[0063] Monitoring input / output wait times is achieved by parsing process state statistics maintained by the target process in the operating system kernel. The value is obtained by reading a field in the process descriptor that specifically records the time consumed waiting for input / output operations to complete, such as the `iowait_time` field in the `task_struct` structure. This value is typically in nanoseconds; dividing it by 1,000,000 yields the actual wait time in milliseconds. This value is then periodically sampled at 1-second intervals, and the increment between two consecutive samples is recorded. This increment represents the input / output wait time within that second, in milliseconds.

[0064] Finally, the periodically collected performance metrics—CPU utilization, memory page fault frequency, and I / O latency—are organized and recorded in a structured log in timestamp order. Each record in this log constitutes a set of system status parameters. These system status parameters provide real-time, quantitative evidence for subsequent steps analyzing the system's maneuverability. The entire data acquisition and monitoring process runs in the background as an independent system thread or daemon process, ensuring it does not interfere with the normal execution of the target program and maintains low system resource overhead; for example, CPU utilization is typically below 2%.

[0065] After acquiring the quantum random number sequence and monitoring the system state parameters, step S2 is executed next, which involves identifying the clustering patterns during the changes in the quantum random number sequence and determining the operable scheduling gaps of the operating system where the target program resides based on the system state parameters. Specifically, the quantum random number sequence cached in the first-in-first-out queue is first analyzed to identify the clustering patterns. A clustering pattern refers to an interval in the sequence where randomness is significantly enhanced, identified by analyzing the jump frequency between consecutive bits. The jump frequency is calculated as follows: the quantum random number sequence is treated as a continuous binary stream, and a sliding window of fixed length is used to traverse the sequence, for example, with a window size of 8 bits. One bit is traversed each time, and the number of times adjacent bit values ​​change within each window—that is, the number of transitions from 0 to 1 or from 1 to 0—is calculated. This number is the jump frequency value of that window. The jump frequency value reflects the activity level of randomness within that window.

[0066] To dynamically divide active and silent regions, a dynamic threshold is needed to distinguish between high and low jumps. This dynamic threshold is calculated in real time based on the statistical characteristics of the sequence. For example, the moving average and standard deviation of the jump frequencies over a certain number of recent windows (e.g., 100 windows) can be calculated, and the threshold can be set as the moving average plus one standard deviation. When the jump frequency of a window exceeds this threshold, the window is considered active; otherwise, it is considered silent. Multiple consecutive active windows constitute an active region, while multiple consecutive silent windows constitute a silent region. Active regions are identified as clustering patterns, representing periods of concentrated bursts of randomness in the quantum random number sequence. This dynamic thresholding method can adapt to the statistical fluctuations of the sequence itself, ensuring the accuracy of identification. If the number of consecutive windows is insufficient, for example, only one window exceeds the threshold, it is not considered a valid active region to avoid transient noise interference.

[0067] While identifying clustering patterns, intervention-friendly scheduling gaps are determined based on the same set of system state parameters. An intervention-friendly scheduling gap refers to a time window within the operating system suitable for intervention without affecting system stability. First, CPU utilization and memory page fault frequency are extracted from continuously monitored system state parameters. For CPU utilization, its valley ranges need to be identified. A valley range refers to a period of sustained low CPU utilization. The low load threshold is dynamically adjusted based on the system's baseline load. For example, by analyzing historical system state parameters, the long-term average CPU utilization is calculated, and the low load threshold is set to 50% of this average. When the CPU utilization is below this low load threshold for multiple consecutive sampling periods (e.g., 5 periods, each 10 milliseconds), these consecutive periods are marked as valley ranges. If the system load suddenly increases, causing the CPU utilization to exceed the threshold, the current valley range is immediately terminated.

[0068] For memory page fault frequency, it is necessary to identify its stable intervals. A stable interval refers to a period of time where the memory page fault frequency fluctuates relatively little. The stability threshold is set based on the volatility of the memory page fault frequency. For example, the standard deviation of the memory page fault frequency within a sliding window is calculated, and the stability threshold is set to a small value, such as 2 errors per second. When the difference between the maximum and minimum values ​​of the memory page fault frequency within a continuous period (e.g., within 1 second) is less than this stability threshold, that period is marked as a stable interval. This calculation of fluctuation amplitude ensures the stability of the interval. If a single extremely high page fault peak occurs, the current stable interval determination immediately becomes invalid.

[0069] Next, an intersection operation is performed between the CPU utilization trough intervals and the stable memory page fault frequency intervals. First, the two types of intervals are aligned on the system timeline, using a unified timestamp as a reference, such as the operating system's high-precision clock. After alignment, the overlapping portions of the trough and stable intervals are examined in time, i.e., time windows that simultaneously satisfy low CPU load and stable memory page fault frequency are identified. These overlapping portions represent interventionist scheduling gaps, indicating moments when system resources are relatively idle and stable, suitable for program behavior intervention. The intersection operation is specifically implemented by comparing the start and end points of the time intervals to find all time-overlapping segments.

[0070] The identification of active intervals for clustering patterns and the determination of interventionable scheduling gaps are both based on synchronous adaptive adjustments to the same set of system state parameters. This means that the dynamic threshold used to identify clustering patterns and various thresholds used to determine scheduling gaps (such as low load thresholds and stability thresholds) are adjusted in tandem according to real-time system state parameters. For example, when system state parameters indicate a high overall system load, the sensitivity of clustering pattern identification is increased accordingly (e.g., adjusting the standard deviation coefficient in the dynamic threshold calculation formula from 1 to 0.8), while the criteria for determining interventionable scheduling gaps are relaxed (e.g., adjusting the low load threshold from 50% to 60%) to ensure that feasible intervention opportunities can still be found under high system load. This synchronous adjustment mechanism is achieved through a feedback loop: periodically (e.g., every second), the overall trend of system state parameters is evaluated, a load index is calculated, and all relevant thresholds are updated based on this index using a linear interpolation function, thereby maintaining a real-time match between the intervention strategy and the system state. If the system is in an extremely high load state, such as a CPU utilization rate consistently exceeding 90%, clustering pattern identification can be temporarily suspended until the system load returns to a normal level.

[0071] The implementation of step S2 ensures that the identification of clustering patterns and the determination of interventionable scheduling gaps are logically coordinated, laying the foundation for the matching degree evaluation in subsequent steps. All calculations are based on explicit data inputs and algorithmic steps, and threshold settings are based on quantifiable system indicators, avoiding subjective judgment and ensuring the feasibility and repeatability of the method. When dealing with boundary conditions, such as when two intervals partially overlap, only the completely overlapping part is taken as a valid result; when no interventionable scheduling gaps are detected, the process waits for the next monitoring cycle to recalculate without forcibly intervening.

[0072] After successfully identifying the active regions and manipulable scheduling gaps of the clustering pattern, step S3 is executed to evaluate the matching degree between them and determine their compatibility. This evaluation process begins with a detailed analysis of the synergy between the active regions and manipulable scheduling gaps over time. The synergy analysis first requires quantifying the duration characteristics of the active regions and the periodic characteristics of the manipulable scheduling gaps. The duration distribution of the active regions is obtained by statistically analyzing the lengths of multiple current and recent active regions. For example, the durations of the last 20 active regions are recorded, and the arithmetic mean of these durations is calculated. This average is used as the expected value of the duration of the active regions. The occurrence cycle length of the manipulable scheduling gap is obtained by measuring the time interval between the start points of consecutively occurring, valid manipulable scheduling gaps and calculating the average of these intervals.

[0073] After obtaining the two key parameters mentioned above, the ratio of the expected duration of the active interval to the length of the intervened scheduling gap period is calculated. This ratio is a dimensionless number that reveals the proportional relationship between the average timescale of clustered events and the system idle window period. For example, if the calculated ratio is 0.6, it means that, on average, the length of the active interval accounts for approximately 60% of the scheduling gap period. This calculation forms the basis for subsequent judgments.

[0074] Another key aspect of synergy analysis is analyzing the phase deviation between the start time of the active interval and the start time of the interventionist scheduling gap. Phase deviation is defined as the difference between the start timestamp of a specific active interval and the start timestamp of the next upcoming interventionist scheduling gap. This difference can be positive or negative; a positive difference indicates that the active interval started before the scheduling gap (leading), and a negative difference indicates that the active interval started after the scheduling gap (lagging). It is necessary to analyze the phase deviation of all pairs of active intervals and scheduling gaps over a period of time (e.g., the past 10 cycles) to observe their distribution patterns, such as whether they tend towards a constant leading, a constant lagging, or a random distribution.

[0075] Subsequently, based on the calculated duration ratio and the observed phase deviation direction and stability, a comprehensive judgment is made as to whether the active interval can be completely contained within the operable scheduling gap. The judgment logic includes multiple conditions: the primary condition is that the duration ratio must be less than 1, indicating that the active interval, on average, is no longer than the scheduling gap. Secondly, the typical value of the phase deviation and its fluctuation range need to be examined. For example, even if the ratio is less than 1, if the typical phase deviation is a large positive value (e.g., leading by 50 milliseconds), and the scheduling gap period is 100 milliseconds, it means that a considerable portion of the active interval will occur outside the scheduling gap, resulting in incomplete containment. Therefore, a tolerance threshold for phase deviation needs to be set, which can be related to the period length of the scheduling gap, for example, set to 10% of the period length. Only when the absolute value of the phase deviation is consistently less than this tolerance threshold is the timing condition for complete containment considered met.

[0076] Based on a qualitative judgment of the completeness of the fit (yes or no) and the identification of deviation patterns (leading, lagging, and their degree), a compatibility relationship map is dynamically constructed to quantify the degree of fit. This map is essentially a multi-level classification system, characterizing the degree of fit into three main levels: "conflict," "adaptable," and "synchronous." A "conflict" relationship corresponds to a situation where fit is impossible, such as a duration ratio greater than or equal to 1.2, or a phase deviation that is extremely large and unpredictable even though the ratio is less than 1.2. A "synchronous" relationship represents the optimal fit, requiring a duration ratio close to 1 but slightly smaller (e.g., between 0.9 and 1.0), and a very small and stable phase deviation (e.g., less than 5% of the period length). A "adaptable" relationship lies between the two, referring to situations where there is some timing deviation or length mismatch, but effective utilization can be achieved through fine-tuning (e.g., slight delayed triggering intervention), such as a ratio between 1.0 and 1.1, or a phase deviation between 5% and 15% of the period length.

[0077] This compatibility graph is dynamically constructed, and its level classification boundary thresholds are not fixed but adaptively adjusted based on recent system intervention success rate data. The adjustment mechanism, for example, involves monitoring cases deemed "adaptable" and successfully intervened over a past period, analyzing the actual distribution of duration ratios and phase deviations in these cases, and then fine-tuning the boundary thresholds between "adaptable," "synchronized," or "conflicted" to make the graph's judgments more reflective of the system's current behavioral characteristics. If a "synchronized" relationship does not occur for an extended period, the system may moderately relax the "synchronization" criteria to increase the probability of finding suitable intervention opportunities. Ultimately, for each pair of active intervals and intervened scheduling gaps to be evaluated, a specific level in the compatibility graph is mapped based on its specific ratio and phase deviation values, resulting in a clear and quantifiable compatibility judgment. This result provides direct and structured input for constructing the optimization objective in step S4. The entire evaluation process is executed in each scheduling cycle to ensure real-time response to changes in system state.

[0078] After evaluating the compatibility relationship between the clustering pattern and the interventionable scheduling gap, step S4 is executed. Based on this compatibility relationship and continuously monitored system state parameters, a Pareto front is constructed with intervention effectiveness and system stability as optimization objectives, and the set of optimal solutions on this front is determined. This process begins by transforming the qualitative evaluation results into quantifiable optimization parameters. Specifically, the multi-level compatibility relationships defined in the compatibility relationship graph, such as "conflict," "adaptability," and "synchronization," are mapped to a linear basic weight for intervention effectiveness based on the quality of intervention timing they represent. This mapping follows a preset rule: when the compatibility relationship is "synchronization," it indicates the best matching degree and is assigned the highest basic weight, for example, a value of 1.0; when the compatibility relationship is "adaptability," it indicates a decent matching degree but with adjustable deviations and is assigned a medium basic weight, for example, a value of 0.6; when the compatibility relationship is "conflict," it indicates a poor matching degree and high intervention risk and is assigned a low basic weight, for example, a value of 0.2. This baseline weight directly reflects the expected outcome of intervention under the current compatibility relationship.

[0079] Meanwhile, CPU utilization and memory page fault frequency in the system status parameters are used as dynamic constraints to define the system stability boundaries. These dynamic constraints are not fixed but adaptively adjusted based on the real-time system load. The system presets an absolute safety limit for CPU utilization, such as 90%, and an absolute safety limit for memory page fault frequency, such as 200 times per second. However, the dynamic constraints actually used in the current optimization cycle are a ratio of the difference between these absolute safety limits and the current monitored values. For example, if the current CPU utilization is 70%, the dynamic constraint might be set to prevent intervention from causing the utilization to exceed 70% + (90% - 70%) * 0.5 = 80%. Similarly, if the current memory page fault frequency is 50 times per second, the constraint might be set to prevent intervention from causing this frequency to exceed 50 + (200 - 50) * 0.5 = 125 times per second. This dynamic adjustment mechanism ensures that the constraints are both safe and not overly conservative, thus preserving reasonable intervention space.

[0080] After clarifying the basic weights of intervention effectiveness and the dynamic constraints of system stability, an enumeration method is used to systematically generate a set of candidate solutions within the solution space composed of intervention parameters. The implementation of the enumeration method includes two steps: parameter discretization and combinatorial sampling. First, the key intervention parameters that significantly affect intervention effectiveness and system stability are identified, mainly including the intervention trigger timing and intervention intensity. The intervention trigger timing is defined as the delay time calculated from the start of the interventionizable scheduling gap, and the intervention intensity is defined as the maximum CPU time planned for a single intervention operation. Next, these parameters are discretized and sampled within their reasonable ranges. For example, the sampling range for the intervention trigger timing may be set from 0 milliseconds to 80% of the estimated length of the interventionizable scheduling gap, with a sampling interval of 5 milliseconds as needed. The sampling range for the intervention intensity may be set from 1 millisecond to 20 milliseconds, with a sampling interval of 2 milliseconds. By performing a full combinatorial traversal of all sampling points, all possible parameter pairs are generated, and each unique parameter pair constitutes a candidate solution.

[0081] For each candidate solution generated by the enumeration method, two key evaluation metrics need to be calculated: the estimated intervention efficacy value and the estimated system stability index. The estimated intervention efficacy value is calculated by multiplying the previously obtained base weight by the intervention intensity parameter value corresponding to the candidate solution. For example, a candidate solution with a base weight of 0.6 and an intervention intensity of 10 milliseconds has an estimated intervention efficacy value of 0.6 * 10 = 6. This value is a relative unit used to compare the relative strength of intervention effects among different candidate solutions. The estimated system stability index is obtained by estimating the incremental impact of the candidate solution on the system state parameters after implementation. For example, a candidate solution with an intervention intensity of 10 milliseconds might, based on historical data or empirical models, predict an increase of 2 percentage points in CPU utilization and an increase of 5 memory page faults per second. Adding this estimated increment to the current system state parameters yields the expected CPU utilization and expected memory page fault frequency after intervention.

[0082] After generating all candidate solutions and their corresponding estimated intervention effectiveness values ​​and estimated system stability indices, the selection of the Pareto optimal solution set begins. The selection process strictly follows the Pareto dominance principle, performing pairwise comparisons. Specifically, for a candidate solution A and another candidate solution B, A is said to dominate B if one of the following conditions is met: 1. The estimated intervention effectiveness value of candidate solution A is greater than or equal to the estimated intervention effectiveness value of candidate solution B, and the expected CPU utilization rate of candidate solution A is lower than the expected CPU utilization rate of candidate solution B, while the expected page fault frequency of candidate solution A is lower than or equal to the expected page fault frequency of candidate solution B; 2. The estimated intervention effectiveness value of candidate solution A is greater than or equal to the estimated intervention effectiveness value of candidate solution B, and the expected CPU utilization rate of candidate solution A is lower than or equal to the expected CPU utilization rate of candidate solution B, while the expected page fault frequency of candidate solution A is lower than the expected page fault frequency of candidate solution B. Furthermore, in both cases, at least one dimension is strictly better (greater than or less than). Among all candidate solutions, those not dominated by any other candidate solution are called non-dominated solutions. The set of all these non-dominated solutions forms the Pareto front of this optimization cycle, which is the set of optimal solutions. This set represents the set of optimal trade-offs that, under the current constraints, cannot further improve both intervention effectiveness and system stability. If the enumeration process fails to generate any candidate solutions whose predicted system stability index does not exceed the upper limit of the dynamic constraints, it is determined that there is currently no feasible solution, and the optimization process will restart in the next monitoring and evaluation cycle. The set of optimal solutions on the Pareto front provides a rich set of non-dominated alternatives for the final decision in step S5.

[0083] After obtaining the set of optimal solutions on the Pareto front, step S5 is executed, which evaluates the cumulative effect of each operation point in the set combined with the historical intervention command sequence, and selects the final suitable operation point to be executed. The core of this step is to consider the long-term impact of the intervention and avoid system state oscillations or performance degradation caused by short-term optimization. First, a time decay window is set for the historical intervention command sequence. This window is a sliding time interval, the length of which is dynamically determined according to the system's response memory characteristics to the intervention, for example, it can be set to the most recent 30 seconds. Each historical intervention command within the window is assigned a decay weight according to its distance from the current time, with the weight decreasing as the distance increases. For example, a linear decay or exponential decay model can be used to ensure that the impact of recent interventions dominates while the long-term impact gradually weakens. The size of the time decay window is not fixed, but can be fine-tuned according to the overall volatility of the system state parameters. For example, when the system state parameters fluctuate greatly, the window can be appropriately reduced to focus more on recent effects.

[0084] This study analyzes the long-term impact of the clustering intensity of similar intervention instructions within a time decay window on the frequency of memory page faults in the system's state parameters. Specifically, the implementation involves: First, classifying historical intervention instructions within the time decay window by type, such as memory access mode intervention instructions and computational resource scheduling intervention instructions. Next, calculating the clustering intensity of each type of intervention instruction within the window. Clustering intensity can be defined as the sum of the products of the number of occurrences of this type of instruction per unit time and its average intervention intensity, adjusted for time decay weights. Then, performing correlation analysis between the calculated time series of clustering intensities of various intervention instructions and the time series of memory page fault frequencies monitored within the same time period. For example, Pearson correlation coefficients or Spearman rank correlation coefficients can be calculated. Based on the sign and magnitude of the correlation coefficients, and combined with prior knowledge of the system's memory management mechanism (e.g., frequent interventions of specific types may lead to increased cache coherence operations, potentially increasing page fault frequency), the long-term impact trend on the frequency of memory page faults if the current intervention pattern continues is inferred. For example, analysis may show that the clustering intensity of a certain type of intervention instruction is significantly positively correlated with the frequency of page errors, and its long-term effect is to cause the frequency of page errors to slowly increase at a rate of several times per hour.

[0085] Next, each operation point in the optimized solution set is superimposed with the inferred long-term impact trend for prediction. Each operation point represents a candidate intervention scheme, including specific intervention parameters such as intervention type, triggering timing, and intensity. The superposition prediction process is as follows: First, assuming the execution of the intervention instruction represented by a certain operation point, its instantaneous effect (e.g., the estimated change in memory page fault frequency that may be immediately caused by executing the intervention instruction) is superimposed onto the baseline of the system state parameters at the current moment. Then, the long-term impact trend of the historical intervention instruction sequence (i.e., the aforementioned inferred slope of page fault frequency change) is used as the background trend and convolved or superimposed with the instantaneous effect of this intervention and its possible subsequent effects (e.g., the recovery characteristics of the system state after intervention) to generate a predicted change trajectory of memory page fault frequency in the system state parameters over a future period (e.g., the next 60 seconds). This trajectory depicts the complete change path of memory page fault frequency under the combined effect of historical cumulative effects and this intervention.

[0086] Finally, the smoothness and convergence of the expected trajectory for each operation point are compared. Smoothness is mainly used to quantify the degree of trajectory fluctuation and can be evaluated by calculating the standard deviation of the first difference of the expected trajectory (i.e., the difference between predicted values ​​at adjacent time points). The smaller the standard deviation, the smoother the trajectory and the more stable the system state change. Convergence is used to determine whether and how quickly the trajectory can approach a stable state or an acceptable range of change. Convergence can be evaluated by observing the later stages of the expected trajectory, such as the trajectory in the last 20 seconds, and calculating the absolute value of its slope. If the slope is consistently below a preset convergence threshold (e.g., 0.1 errors per second), the trajectory is considered convergent; the shorter the time required to reach this convergence condition, the faster the convergence speed. The criterion for selecting suitable operation points is to prioritize those whose expected trajectory simultaneously satisfies high smoothness (low standard deviation of the difference) and fast convergence (short convergence time). If multiple operation points are difficult to distinguish on these metrics, auxiliary decision-making rules can be introduced. For example, priority can be given to operation points whose expected trajectory eventually stabilizes at a lower memory page fault frequency level, or operation points with less intervention intensity can be prioritized to follow the principle of minimum intervention. Through this series of evaluations, the finally selected suitable operation point is not only an excellent solution in the current optimization solution set, but also the solution with the most positive impact on the long-term stability of the system after fully considering the synergistic effect with historical interventions, thus completing the transition from multi-objective optimization to final decision-making.

[0087] After finally selecting the suitable operating point, step S6 is executed, which modulates the quantum random number sequence according to this operating point to generate a specific intervention instruction sequence and sends it to the target program to complete the behavioral intervention. This step begins with selective sampling and remapping of the active region in the quantum random number sequence based on the intervention strength parameter characterized by the suitable operating point. The intervention strength parameter is a quantized value passed from the optimization and decision-making process in steps S4 and S5, usually corresponding to a normalized value between 0 and 1, such as 0.7, which determines the scale of random resources to be utilized in this intervention. The specific implementation of selective sampling is as follows: First, locate the active region with a high transition frequency at the current time or the most recently identified active region, which contains a series of consecutive random bits. Then, calculate the length of consecutive bits to be extracted from this active region according to the magnitude of the intervention strength parameter. The calculation method can be to multiply the intervention strength parameter by the total number of bits contained in the active region and then round down. For example, if the active region has 100 bits and the intervention strength parameter is 0.7, then 70 consecutive bits are extracted. The starting position for extraction can be randomly selected within this active region to introduce additional randomness. The remapping operation transforms the extracted raw random bit data according to a pre-defined deterministic mapping function related to the target program's memory layout. This mapping function ensures that the original, potentially large, random value is mapped to a legitimate and safe offset address range within a specific memory segment of the target program (e.g., a pre-defined secure memory pool). For example, taking the modulo of the extracted 70 bits into a binary number with a fixed modulus (such as the size of the secure memory pool) yields a legitimate memory offset address. This process transforms quantum randomness into spatially bounded, securely usable address information.

[0088] Next, the remapped active region data stream is encoded into a sequence of memory address offset instructions conforming to the target program's memory management interface specification. The encoding process must strictly adhere to the specific instruction format and application programming interface specification that the target program can understand and execute. For example, if the target program is an application that supports dynamic link library injection and exposes an internal function called `apply_memory_offset` that accepts a parameter of type `size_t` representing a memory offset, then the encoding process involves encapsulating the remapped memory address offset value (e.g., a 64-bit unsigned integer) according to the binary application binary interface specification of that function call. This includes placing the offset value into a specified register (such as the RDI register in x86-64 architecture) or pushing it onto the stack according to a specific calling convention, and generating the machine code for the corresponding function call instruction (such as the `call` instruction). If an intervention requires applying multiple consecutive memory address offsets to form an access pattern, these offsets must be encapsulated sequentially to generate a series of sequentially executed `apply_memory_offset` function call instructions, forming a complete instruction sequence. The entire encoding process ensures that the generated instruction sequence can be correctly recognized and executed by the target program's runtime environment loader at the binary level.

[0089] Finally, the encapsulated memory address offset instruction sequence is injected into the target program's runtime environment through the operating system's inter-process communication (IPC) mechanism. The specific choice of IPC mechanism depends on the architecture and configuration of the operating system and the target program. A typical implementation involves the intervention program (as the sender) and the target program (as the receiver) establishing a communication channel beforehand. For example, in Linux, a named POSIX message queue can be created. The intervention program writes the encoded instruction sequence as one or more messages to this message queue. The target program then needs to continuously or event-drivenly read messages from the same message queue in one of its monitoring threads. To achieve event-driven efficiency, after successfully writing the instruction sequence message, the intervention program can send a real-time signal (e.g., SIGRTMIN) to the target process. The signal handler function registered by the target program for this signal will be triggered, and inside this function, the operation of reading and parsing the instruction sequence from the message queue will be performed. The parsed instruction sequence (i.e., the memory address offset) is passed to the corresponding processing logic inside the target program, thereby affecting its subsequent memory access behavior and completing the intervention in program behavior. The entire injection process ensures minimal interference with the normal execution flow of the target program and strictly adheres to the operating system's process isolation and security permission management mechanisms, ultimately achieving non-intrusive and fine-grained program behavior guidance based on quantum randomness modulation. If an error occurs during the injection process, such as a full message queue or signal transmission failure, the system will record the error and abandon the intervention, waiting for the next interventionable scheduling gap to retry, thus ensuring the system's robustness.

[0090] All calculations involved in the embodiments are dimensionless numerical calculations, and the preset parameters and thresholds in the calculations are set by those skilled in the art according to the actual situation.

[0091] It should be noted that this invention can be deployed on the device itself to realize embedded applications, or it can run on a PC or other terminal with a user interface, thereby meeting various hardware environments and usage requirements.

[0092] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wireless or wired transmission; wired transmission methods include optical fiber, twisted pair, coaxial cable, etc.; wireless transmission includes infrared, microwave, etc. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center containing one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0093] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0095] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0096] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0097] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0098] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0099] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method of program behavior intervention based on quantum states, characterized by, include: S1. Obtain a quantum random number sequence from the quantum random number generator and monitor the runtime state of the target program to obtain system state parameters; S2. Identify the clustering patterns during the quantum random number sequence change process, and determine the intervention-friendly scheduling gaps of the operating system where the target program resides based on system state parameters, including: Based on the dynamic division of active and silent intervals by the jump frequency between consecutive bits in a quantum random number sequence, the active interval is identified as a clustering mode. The intersection of the CPU utilization valley range and the memory page fault frequency stable range in the system status parameters is calculated, and the intervenable scheduling gap is determined based on the calculation result. Among them, the identification of the active range of the clustering mode and the determination of the intervenable scheduling gap are both based on the same set of system state parameters for synchronous adaptive adjustment; S3. Evaluate the matching degree between the clustering pattern and the operable scheduling gap to determine their compatibility, including: Calculate the ratio of the expected duration of the active interval to the length of the scheduling gap period; Analyze the phase deviation between the start time of the active interval and the opening time of the scheduling gap; Based on the magnitude of the ratio and the direction of the phase deviation, it can be determined whether the clustered events can be fully contained within the intervenable scheduling gap, and the leading or lagging deviation patterns of the two on the time axis can be identified. Based on the inclusion integrity and deviation mode, a compatibility relationship map is dynamically constructed to quantify the matching degree. The compatibility relationship map represents the matching degree as a multi-level compatibility relationship from conflict, adaptability to synchronization. S4. Based on the compatibility relationship and system state parameters, construct a Pareto front with intervention effectiveness and system stability as optimization objectives, and determine the set of optimal solutions on the Pareto front. S5. Evaluate the cumulative effect of each operation point in the optimal solution set combined with the historical intervention command sequence, and select the fit operation point from the optimal solution set that makes the cumulative effect tend to be optimal. S6. Modulate the quantum random number sequence according to the adaptive operation point to generate an intervention instruction sequence and send it to the target program to execute the program behavior intervention.

2. The quantum state-based program behavior intervention method according to claim 1, characterized in that, Obtain quantum random number sequences from a quantum random number generator and monitor the runtime state of the target program to obtain system state parameters, including: The system receives raw random number streams generated by a quantum random number generator in real time and buffers the raw random number streams in a first-in-first-out queue to form a quantum random number sequence. Meanwhile, by calling the operating system kernel interface, the CPU utilization, memory page fault frequency, and I / O wait time of the target process are continuously monitored and recorded as system status parameters.

3. The quantum state-based program behavior intervention method according to claim 1, characterized in that, The intersection of the CPU utilization trough range and the stable range of memory page fault frequency in the system status parameters is calculated, including: Monitor the CPU utilization rate and mark periods of continuous low load threshold as valley intervals; Monitor the frequency of memory page faults and mark periods with fluctuations less than the stability threshold as stable intervals; Align the valley interval and the stable interval on the system time axis, and take the time overlap as the interventional scheduling gap.

4. The quantum state-based program behavior intervention method according to claim 1, characterized in that, Based on compatibility relations and system state parameters, a Pareto front is constructed with intervention effectiveness and system stability as optimization objectives, and the set of optimal solutions on the Pareto front is determined, including: The multi-level compatibility relationships in the compatibility relationship graph are mapped as the basic weights of intervention effectiveness, while the CPU utilization rate and memory page fault frequency in the system state parameters are used as dynamic constraints on system stability. Using basic weights and dynamic constraints as boundaries, multiple candidate solutions in the two dimensions of intervention effectiveness and system stability are generated through enumeration. Candidate solutions that are surpassed by other candidate solutions in both intervention effectiveness and system stability are eliminated, and the remaining set of unsurpassable candidate solutions is determined as the set of optimal solutions on the Pareto front.

5. The quantum state-based program behavior intervention method according to claim 4, characterized in that, Candidate solutions are generated through enumeration, including: The basic weights are used as the basic values ​​for intervention effectiveness, and dynamic constraints are used as boundary limits; Discretize the intervention parameters to generate candidate solutions with different parameter combinations; Each candidate solution corresponds to a set of estimated intervention efficacy values ​​and system stability indicators.

6. The quantum state-based program behavior intervention method according to claim 1, characterized in that, Evaluate the cumulative effect of each operation point in the optimal solution set combined with the historical intervention command sequence, and select the fit operation point from the optimal solution set that makes the cumulative effect tend to be optimal, including: A time decay window was set for the historical intervention command sequence, and the long-term impact trend of the clustering intensity of similar intervention commands within the time decay window on the memory page fault frequency in the system status parameters was analyzed. Each operation point in the optimized solution set is superimposed with the long-term influence trend for prediction, and the expected change trajectory of the system state parameters after superposition is calculated. By comparing the smoothness and convergence of the expected change trajectory corresponding to each operation point, the operation point that makes the expected change trajectory smoothest and stabilizes fastest is selected as the adaptive operation point.

7. The quantum state-based program behavior intervention method according to claim 1, characterized in that, Based on the adaptive operation point, the quantum random number sequence is modulated to generate an intervention command sequence, which is then sent to the target program to execute program behavior intervention, including: Based on the intervention intensity parameter characterized by the adaptive operation point, the active region in the quantum random number sequence is selectively sampled and remapped; The remapped active region data stream is encoded into a sequence of memory address offset instructions that conform to the target program's memory management interface specification; By injecting a sequence of memory address offset instructions into the target program's runtime environment through the operating system's inter-process communication mechanism, the program's behavior can be intervened.

Images