82 results about "Call stack" patented technology

The invention discloses an open source software supply chain security intelligent monitoring and risk assessment method, relates to the technical field of software supply chain security, and solves the problem that only existence of indirect dependence can be identified generally in the prior art, but whether a vulnerability code can be called on an actual execution path cannot be accurately judged. According to the method, through dependence locking and Hash fingerprint embedding during construction, cryptographic-level accurate traceability of a component version is realized, and version ambiguity is thoroughly eliminated; in combination with deep interception of a JVM probe for method calling and class loading events during operation, a loading source and a call stack context of each class in a real execution path can be captured, bidirectional association mapping is performed on dynamic behavior data and a static dependency tree, and whether a vulnerability component is located on an executable call chain or not is accurately identified. Compared with the defect that coarse-grained warning is carried out only through version matching in a traditional tool, the method has the advantage that by means of dynamic-static data fusion, it is avoided that a large number of unavailable indirect dependency vulnerabilities are misjudged to be high in risk.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention discloses a PHP application vulnerability verification sample automatic generation method based on a large language model and RAG, and the method comprises the following steps: 1, recognizing a frame, configuration and routing of a target application, and generating an entry candidate set; 2, extracting a reachable path from an entrance to a sensitive operation by utilizing static analysis, and generating a structured path constraint list; 3, integrating the entry set and the constraint list into a prompt, retrieving an enhanced fragment from a knowledge base based on the constraint list, and driving a large language model to generate a candidate request sequence; 4, executing the sequence, verifying vulnerability triggering through a typed rule, and analyzing and confirming that a request is triggered by a legal entry in combination with a call stack; and 5, when verification fails, extracting diagnosis information as an increment constraint and feeding back the increment constraint to the generation step for iterative optimization until an effective sample is generated. According to the method, misjudgment is reduced through retrieval enhancement, entry constraint and call stack proofreading, feedback iterative optimization is utilized, and the automation efficiency and accuracy of PHP application vulnerability verification sample generation are improved.

The invention discloses a Web security auditing method and device based on browser operation, and relates to the technical field of network security. Comprising the following steps: forcibly activating a credible type mechanism in a browser environment of a to-be-audited page, and constructing a hybrid monitoring environment with the assistance of API instrumentation; javaScript code data of a page are obtained, and a path control function is injected into a control flow branch of the JavaScript code data through abstract syntax tree analysis; executing the converted code in a monitoring environment, guiding to traverse different logic branches by utilizing a path control function, and capturing a call stack containing a vulnerability trigger point and a code snippet when triggering monitoring is executed; and based on call stack information, extracting precise code slices, combining with cue words, inputting the cue words into a large language model to perform safety semantic reasoning, and generating an audit report according to a structured result output by the model. High-coverage and low-false-alarm automatic detection of deep DOM XSS vulnerabilities is realized, and the problems that a path is difficult to reach and intelligent analysis is insufficient in a traditional security audit technology are solved.

The invention provides an attack detection method and device, electronic equipment and a storage medium, and the attack detection method comprises the steps: detecting whether there is an intersection between a memory region corresponding to a modified memory attribute and a function address range of a target event tracking function if the modification of the memory attribute of the target event tracking function is detected; if the intersection exists, obtaining function call stack information triggering the modification; and carrying out attack detection based on the function call stack information. Through the technical scheme provided by the invention, the modification monitoring of the memory area of the target event tracking function is combined with the function call stack information for triggering the modification, so that the ETW bypassing attack based on the memory patch mode is accurately detected.

The application provides a dead loop processing method and device, electronic equipment and storage medium, a preset script function is run, and the number of instructions executed when the preset script function is run is monitored; if the number of instructions is greater than a preset number threshold, a function call stack when the preset script function executes instructions is acquired and recorded; the number of times that the function call stack is recorded within a preset time period is determined, if the number of times recorded satisfies a preset condition, the function call stack is determined as a dead loop stack; the dead loop stack is interrupted to remove the current dead loop. Through monitoring the number of instruction executions and the number of times that the function call stack is recorded, the method can realize fault positioning to the function point level, greatly shortening the dead loop positioning time; meanwhile, after the existence of a dead loop problem is found, the method automatically removes the dead loop, improving the server dead loop troubleshooting efficiency.

The invention belongs to the field of machine learning, and discloses a deep learning framework vulnerability test method and related device.The method comprises the steps that a vulnerability report of a to-be-recognized deep learning framework is obtained, and a vulnerability API of the to-be-recognized deep learning framework and a vulnerability test case of the vulnerability API are obtained according to the vulnerability report; based on call stack similarity analysis, obtaining an API associated with the vulnerability API in the to-be-identified deep learning framework and taking the API as a to-be-identified API; generating a vulnerability test case of the to-be-identified API according to the vulnerability test case of the vulnerability API, and testing the to-be-identified API according to the vulnerability test case of the to-be-identified API to obtain a vulnerability test result of the to-be-identified API. By reusing the verified test basis, the test case is generated in a targeted manner, so that the test efficiency and accuracy are remarkably improved, and the problem of low efficiency of randomly generating the test case in the prior art is avoided. And meanwhile, by focusing on the high-similarity associated API, the test range is narrowed, and the resource overhead is reduced, so that the overall efficiency of the test process is improved.

Provided in the embodiments of the present disclosure are a function processing method and apparatus, and an electronic device and a storage medium. The function processing method comprises: acquiring a first function from a first stack and executing same; during the process of executing the first function, determining a second function that is called by the first function and is to be executed, wherein the first function and the second function are respectively functions corresponding to different nodes in a node graph, and the node graph is a graph that is obtained by performing programming by means of visual programming and consists of a plurality of nodes; writing the second function into the first stack; after the first function is executed, acquiring the second function from the first stack; and using the second function as the first function, and returning to continue executing the first function until the first stack is empty. Functions in a first stack are cyclically read and executed, a function called by a read function is pushed into the first stack and is then executed after being read from the first stack, and stack push and pop operations are continuously performed until the first stack is empty, such that the problem of a function call stack overflow during the execution of a node graph in a visual programming environment can be solved.

The invention relates to the technical field of network security, provides an interactive attack mitigation method and system based on runtime application self-protection, and solves the technical problems that complex interactive attacks cannot be effectively identified and defended and the false alarm rate is relatively high. The method comprises the steps of collecting call stack information and a thread identifier of an application thread when a target application runs, and session context information associated with the application thread; carrying out vectorization coding on the call stack information to generate a context snapshot; taking external input data from an external request in the context snapshot as a taint source, and constructing a dynamic attribute graph; performing structural similarity analysis and path abnormal value calculation with a preset reference map to obtain a topology deviation value; the attribute flow direction relation between the starting node and the termination node in the transmission path is identified, the monitoring probe triggers the security blocking abnormity to terminate the application thread, self-protection interactive attack mitigation is achieved, and the context awareness defense capability of the application during operation is improved.

The invention provides an exception handling method and device, equipment and a storage medium, and aims to solve the problems that the exception of embedded equipment is difficult to locate and the operation and maintenance operation is complicated, and the method comprises the steps: obtaining an exception interrupt signal generated in the operation process of the embedded equipment; in response to the exception interrupt signal, extracting call stack information when an exception occurs, and executing self-defined exception handling function analysis on the call stack information to obtain a current exception function address; according to an instruction pointer register value in the current abnormal function address and a base address pointer register value in a stack pointer position in the call stack information, backtracking traversal is carried out, a function call chain relation is constructed, and structured abnormal information is generated; performing priority grading processing on the structured exception information, and writing the structured exception information into a corresponding partition of the storage device according to a priority grading result; and in response to a maintainable command input by a user, reading the structured exception information stored in the corresponding partition from the storage device.

The invention provides a method for obtaining a call stack and computer equipment. According to the method, a stack return statement is added in a code file during running of a Rust programming language, so that control during running is increased. The asynchronous task (or coroutine) is expanded on the thread, and when the execution is in order to obtain the call stack, the task on the thread is returned to the stack, so that the call stack is obtained and recorded. In the execution process, the data and the state of the stack-free coroutine cannot be changed, and the task logic cannot be influenced. According to the method for obtaining the call stack and the computer equipment provided by the invention, the code file cannot be modified in a large range, a large amount of operation overhead cannot be occupied for obtaining the call stack, so that function call or task logic cannot be influenced, the call stack can be conveniently and efficiently obtained, and the user experience is improved. Therefore, the operation condition of the coroutine in the Rust programming language can be accurately judged.

The embodiment of the invention provides an Android cross-thread message tracking method, which belongs to the technical field of data processing, and specifically comprises the following steps: intercepting a native method related to message processing in an Android system; when a client thread delivers a Message object to the message queue, a recording process is triggered by an enqueueMessage method of Hook, and call stack information of the client thread is acquired and stored and is subjected to associated storage; when the server thread takes out the Message object from the message queue and processes the Message object, an application process is triggered through a DispatchMessage method of Hook, and the current server thread is associated with the Message object; in response to a request for obtaining the stack information, judging whether the current thread is associated with a message object which is being processed or not; through the scheme of the invention, efficient, stable and low-intrusion message tracking is realized.

Methods and apparatus for a runahead process are provided to prevent frontend stalls when executing a computer program. Methods and apparatus profile and analyze the computer program when it is compiled to extract meta-data defining hyperblocks for the computer program. The hyperblocks each encompass a respective series of basic blocks having transitions that meet a specified threshold. When the computer program is executed, the runahead process is performed for program branches. In this process, a future path of hyperblocks is predicted from each branch and the instructions corresponding to those hyperblocks are prefetched to a memory cache so that they can be readily fetched. Cycles or large call stacks are removed to enable deep runaheads, which may span about a thousand instructions.

A debugging method and an electronic device relate to the technical field of computers, and dynamically call a debugging interface of a second programming language by registering the debugging interface of the second programming language in a first programming language debugger, thereby obtaining call stack information and variable information of the second programming language, setting breakpoints, modifying variables and the like. In the method, the electronic equipment displays a debugging interface of a debugger adaptive to a first programming language, and loads a service program which is subjected to mixed programming by adopting the first programming language and a second programming language to test equipment. A runtime debugging interface is configured in the runtime matched with the second programming language. During debugging, when a service process runs to a first service code segment obtained by programming of a first programming language, a debugging breakpoint is entered, and the electronic equipment calls a runtime debugging interface through a debugger registered with the runtime debugging interface; and executing debugging processing operation on a second business code segment obtained by programming in the business program loaded by the test equipment by adopting the second programming language.

The application discloses an open source software supply chain security intelligent monitoring and risk assessment method, relates to the technical field of software supply chain security, and solves the problem that the prior art can only identify the existence of indirect dependence but cannot accurately determine whether a vulnerability code can be called on an actual execution path. The application realizes accurate tracing of a component version through time-dependent locking and hash fingerprint embedding, and completely eliminates version ambiguity; in combination with deep interception of a method call and class loading event by a runtime JVM probe, the loading source of each class in a real execution path and the call stack context are captured, dynamic behavior data and a static dependence tree are bidirectionally associated and mapped, and it is accurately determined whether a vulnerability component is located on an executable call chain. Compared with the defects of traditional tools that only perform coarse-grained alarm through version matching, the application avoids misjudging a large number of indirect dependence vulnerabilities that cannot be utilized as high risks through dynamic-static data fusion.

The application discloses a kind of reverse tracing methods based on V8 call stack, realize the real-time tracking and accurate attribution of the behavior of illegal write cookie in real webpage, can know each cookie field is by which script or function participated in illegal write, also know which third party or first party website should be responsible for this illegal behavior.The tracing framework can run on real website, through the innovative DFG construction logic, greatly improve the accuracy of data dependence tracking and the stability of reverse tracing.Make DFG can truly reflect dynamic data flow relationship, provide reliable data flow graph DFG for subsequent reverse tracking, avoid the incomplete or interruption of tracing result caused by DFG defect, further support the accurate extraction of illegal cookie data source.Through the attribute setter monitoring innovation of V8 engine layer, realize the comprehensive capture of illegal cookie assignment operation, provide complete initial data support for the tracing chain.

The invention discloses a low-interference taint path restoration system and method based on static instrumentation, and mainly solves the problems of stiff analysis strategy, high operation overhead and result semantic deficiency faced by existing vulnerability mining and security assessment. The system comprises a target data acquisition end and an analysis engine which run independently and are connected through a shared memory channel; lightweight static instrumentation is performed on a source code in a target program compiling stage, and a shared memory channel with an analysis engine is established; by constructing a "producer-consumer" asynchronous decoupling architecture, time-consuming taint rule management and path restoration logic are stripped from a service main thread; a lockless annular buffer area is utilized to efficiently capture a runtime data stream, and a source code level taint propagation path is restored in an independent analysis engine in combination with debugging information and a call stack Hash algorithm. According to the method, a high-precision source code level analysis result can be obtained while low performance loss is kept, and the efficiency and flexibility of vulnerability mining are greatly improved.

According to some embodiments, systems and methods are provided including receiving a crash dump file; extracting a call stack from the received crash dump file, wherein the call stack includes one or more functions, the functions having ordered positions in the call stack; converting the extracted call stack to natural language sentences; converting the natural languages sentences to a first call stack matrix; receiving the first call stack matrix and a second call stack matrix at a crash model, wherein the crash model is a Siamese neural network model; determining a similarity score for the first call stack matrix and the second call stack matrix; and determining whether the first call stack matrix and the second call stack matrix represent duplicate crashes based on the similarity score. Numerous other aspects are provided.

The invention relates to the technical field of operating system fault analysis, and provides an operating system fault detection method based on time sequence prediction and root cause analysis, which comprises the following steps: constructing a KPI tree based on system data and log data; traversing the KPI tree, executing the associated data acquisition command for each node, and updating an abnormal state identifier based on a real-time system performance index; in response to the abnormal state identifier, mapping the abnormal indexes in the KPI tree to a topological graph through a KPI-topological mapping dictionary, the topological graph representing an association relationship between physical components of the system; positioning an abnormal component in the topological graph based on mapping and outputting an abnormal dependency chain, using a BCC tool to hook a kernel function related to an abnormal index, collecting kernel call stack information, and performing root cause analysis based on the collected kernel call stack information; and a time sequence prediction model is used to predict system indexes, an early warning mechanism is triggered based on a prediction result, and the time sequence prediction model fuses dynamic characteristics based on a multi-scale recurrent neural network.

Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.

This application provides a thread identification method and related apparatus. The method includes: acquiring call stack information of each thread of a running application; if a thread can execute a task of the application through the function call chain indicated by its call stack information, then the thread is the key thread of the corresponding task of the application. A thread is the main body executing the application, and a key thread is the main body executing the application's task. A key thread can execute the application's task through the function call chain indicated by its call stack information. Each task of the application has a corresponding function call chain. This application determines the key thread of the application's task by using the function call chain indicated by the call stack information, thereby improving the accuracy and efficiency of identifying the key thread of the application's task.

The application relates to a processing method, device and medium for program errors under Linux, which comprises the following steps: collecting calling stack information of multiple program errors and extracting calling function names to form a calling function name sequence; clustering all the calling function name sequences based on the similarity between the calling function name sequences; when a program error occurs, generating a corresponding calling function name sequence according to the calling stack information generated by the error, calculating the similarity between the generated calling function name sequence and each clustering center obtained in the clustering, arranging the categories corresponding to the clustering centers in descending order of the similarity, and preferentially adopting the processing mode of the category corresponding to the maximum similarity to start processing the program. The application reduces the workload of problem positioning and program correction of program repair.

The invention provides an embedded device memory treading positioning method, device, equipment and system. In one example of the invention, the method comprises the following steps: in a memory allocation process, obtaining a function call stack of an allocation function and an allocated memory address; the function call stack and the allocated memory address are sent to an upper computer, so that the upper computer stores the function call stack and the mapping relation between the function call stack and the memory address; recording the address information of the abnormal memory block into a specified log under the condition that the abnormal memory block checking condition is satisfied and the abnormal memory block exists; the address information of the abnormal memory block in the specified log is used for being input into the upper computer, so that the upper computer carries out memory treading positioning according to the address information of the abnormal memory block, a function call stack and a mapping relation between the function call stack and a memory address. According to the method, memory treading positioning for the embedded equipment can be realized.

Embodiments of the application disclose a frame freezing processing method and device, computer equipment and a storage medium, and belong to the technical field of computers. The method comprises the following steps: acquiring frame freezing record information reported by an application program, wherein the frame freezing record information comprises a function call stack of a frame freezing frame; determining a core call stack corresponding to the function call stack, wherein the core call stack comprises a core function in the function call stack, a time consumption duration of the core function, and a call relationship between different core functions; clustering at least two determined core call stacks to obtain a clustering result, wherein the clustering result comprises a number of occurrences of each core call stack; and generating a frame freezing report of the application program based on the clustering result. The application reduces the complexity of the core call stack, reduces the processing amount, improves the processing efficiency, improves the accuracy of the frame freezing report, and saves the labor cost.

The application discloses a method for remotely capturing process information, related equipment and a storage medium, and the method comprises the following steps: receiving a stack capture instruction issued by a server for a target process, wherein the target process runs in a microkernel operating system; in response to the stack capture instruction, determining a target task object associated with the target process in the microkernel; determining the call stack corresponding to each thread and the thread attribute according to the thread list in the target task object, wherein the thread attribute comprises thread CPU occupancy; generating the stack capture information of the target process according to the call stack and the thread attribute of each thread; and uploading the stack capture information to a content distribution network, so that the server obtains the stack capture information from the content distribution network. The application realizes remote real-time acquisition of the CPU occupancy and the call stack of all threads of a process in a terminal, which is beneficial to developers to solve the problem of excessively high CPU occupancy of a front-end application program in a timely manner.

The embodiment of the invention provides a GPU call stack backtracking method and device, equipment, a storage medium and a product, and relates to the technical field of computers. The method comprises the following steps: acquiring a current program counter PC value of a graphics processing unit GPU, and acquiring debugging information of a function corresponding to the current PC value; wherein the debugging information comprises frame base information and return address information; in response to the fact that the function stack frame is determined to be a non-outermost layer stack frame through the frame base information, obtaining a return address of the caller function according to the return address information, taking the return address as a new PC value, and returning to execute the operation of obtaining the debugging information of the function corresponding to the current PC value; and in response to the fact that the function stack frame is determined to be the outermost layer stack frame through the frame base information, the GPU function call chain is determined based on the obtained function and return address information, and the scheme can realize GPU adjustment stack backtracking with low cost, high universality and high accuracy.

This invention discloses a Java code layout optimization method that does not interrupt application services. The method includes: acquiring front-end bottleneck data of the application; when it is determined that code layout optimization is needed based on the front-end bottleneck data, collecting the dynamic control flow graph of the application service; calculating a new code layout based on the dynamic control flow graph; generating new code according to the new code layout; correcting relocation information in all code, that is, redirecting function calls and data references pointing to the old code to the new code. During the correction process, memory barriers and cache maintenance instructions are used to ensure the atomicity and consistency of the modification operations, so as to achieve uninterrupted application services; only reclaiming the memory space used by the old code that is no longer executed to store the new code generated in the next optimization, retaining the function code still on the call stack, so that most of the memory space can be reclaimed without interrupting application services. This method effectively alleviates the processor front-end bottleneck of Java applications and improves application performance.

The application provides an attack detection method and device and electronic equipment, and relates to the technical field of computers. In the method, when it is detected that a target task is executed, the call stack of the target task is acquired first, then it is detected whether the call stack of the target task includes the characteristics of a stack confusion attack, and in the case where the call stack of the target task includes the characteristics of the stack confusion attack, it is determined that the target task is threatened. The technical scheme provided by the application can improve the accuracy of EDR and other security software when detecting attacks.

The invention provides a call monitoring method and device, equipment, a medium and a chip, and the method comprises the steps: responding to a target shadow stack, receiving data record empowerment information sent by a corresponding authority management end, and determining corresponding empowerment time; at least one target instruction address is read and recorded into a target shadow stack, and the at least one target instruction address is obtained based on at least one target call instruction received by the call stack after the empowerment time; and in response to data export empowerment information sent by the authority management end and received by the target shadow stack, stopping reading and recording the at least one target instruction address, and exporting the at least one target instruction address recorded in the target shadow stack to obtain a target call record of the call stack. The security of the target shadow stack recording data is improved, the possibility that the data is tampered is reduced, the possibility that the data stored in the call stack is tampered is reduced, and the requirement of the method for the compatibility of the system is reduced.

The application discloses a kind of based on kernel event-driven Linux system fault diagnosis method and system;Its operation steps: real-time capture hard exception, soft exception and resource exception event;Dynamic monitoring is carried out to CPU, memory, storage I / O and network resource use trend and mutation behavior;Complete call stack, execution parameter, lock contention state and connection metadata are formed structured fault context information when abnormal moment is comprehensively collected, CPU register state is urgently frozen to firmware reserved memory in interrupt context respectively, task structure body and kernel stack information are collected in software interrupt context, cross-CPU core state snapshot is completed in high-priority kernel thread coordination;According to system load, direct memory access transmission, atomic log addition or bare device block write mode is selected adaptively, and collected diagnostic data is written and saved;System recovery agent automatically reorganizes diagnostic data, and generates standardized diagnostic package.The application realizes the deep observability of Linux system while ensuring very low running overhead, and significantly improves fault positioning efficiency.