134 results about "Call stack" patented technology

The invention discloses an open source software supply chain security intelligent monitoring and risk assessment method, relates to the technical field of software supply chain security, and solves the problem that only existence of indirect dependence can be identified generally in the prior art, but whether a vulnerability code can be called on an actual execution path cannot be accurately judged. According to the method, through dependence locking and Hash fingerprint embedding during construction, cryptographic-level accurate traceability of a component version is realized, and version ambiguity is thoroughly eliminated; in combination with deep interception of a JVM probe for method calling and class loading events during operation, a loading source and a call stack context of each class in a real execution path can be captured, bidirectional association mapping is performed on dynamic behavior data and a static dependency tree, and whether a vulnerability component is located on an executable call chain or not is accurately identified. Compared with the defect that coarse-grained warning is carried out only through version matching in a traditional tool, the method has the advantage that by means of dynamic-static data fusion, it is avoided that a large number of unavailable indirect dependency vulnerabilities are misjudged to be high in risk.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention discloses a reverse traceability method based on a V8 call stack, which realizes real-time tracking and accurate attribution of illegal cookie writing behaviors in a real webpage, and can know which scripts or functions participate in illegal writing of each cookie field. In this way, the third-party website or the first-party website should be responsible for the violation behavior. The traceability framework can run on a real website, and the accuracy of data dependence tracking and the stability of reverse traceability are greatly improved through innovative DFG construction logic. According to the method, the dynamic data flow relation can be truly reflected by the DFG, a reliable data flow diagram DFG is provided for subsequent reverse tracking, the situation that the traceability result is incomplete or interrupted due to DFG defects is avoided, and accurate extraction of data sources of illegal cookies is further supported. Through attribute setter monitoring innovation of a V8 engine layer, comprehensive capture of violation cookie assignment operation is realized, and complete initial data support is provided for a traceability chain.

The invention discloses a data acquisition method and device, electronic equipment and a storage medium. The data acquisition method comprises the following steps: injecting a data acquisition code into a runtime environment of a target application program; determining data acquisition demand information in a runtime environment of the target application program; calling the data acquisition code according to the data acquisition demand information; when the data collection code is called, stack tracking data are obtained from original calling stack data of the target application program according to the data collection requirement information, and the stack tracking data are output. By adopting the method, the performance loss of call stack acquisition can be reduced.

A verified stack trace can be generated by utilizing information contained in a shadow stack, such as a hardware protected duplicate stack implemented for malware prevention and computer security. The shadow stack contains return addresses which are obtainable without requiring an unwinding of the traditional call stack. As such, triaging based on return address information can be performed more quickly and more efficiently, and with a reduced utilization of processing resources. Additionally, the generation of a verified stack trace can be performed, with such a verified stack trace containing return addresses that are known to be correct and not corrupted. The return addresses can either be read from the traditional call stack, or derived therefrom, and then verified by comparison to corresponding return addresses from the shadow stack, or they can be read directly from the shadow stack.

The invention discloses a PHP application vulnerability verification sample automatic generation method based on a large language model and RAG, and the method comprises the following steps: 1, recognizing a frame, configuration and routing of a target application, and generating an entry candidate set; 2, extracting a reachable path from an entrance to a sensitive operation by utilizing static analysis, and generating a structured path constraint list; 3, integrating the entry set and the constraint list into a prompt, retrieving an enhanced fragment from a knowledge base based on the constraint list, and driving a large language model to generate a candidate request sequence; 4, executing the sequence, verifying vulnerability triggering through a typed rule, and analyzing and confirming that a request is triggered by a legal entry in combination with a call stack; and 5, when verification fails, extracting diagnosis information as an increment constraint and feeding back the increment constraint to the generation step for iterative optimization until an effective sample is generated. According to the method, misjudgment is reduced through retrieval enhancement, entry constraint and call stack proofreading, feedback iterative optimization is utilized, and the automation efficiency and accuracy of PHP application vulnerability verification sample generation are improved.

The present disclosure relates to a method, and apparatus for detecting an application freezing problem, and a device and a storage medium. The method comprises: detecting time consumed for a Runloop in a first thread of an application executing a task; when it is detected that the consumed time reaches a preset threshold value, at least acquiring a call stack of the first thread and the current first execution state of the Runloop, and writing the call stack into a preset file; detecting an execution state of the Runloop after the time consumed for the task reaches the preset threshold value; and if the Runloop does not enter a second execution state after the first execution state before the application is closed, sending the preset file to a remote server. By means of the solution provided in the embodiments of the present disclosure, an application freezing problem can be identified and detected.

The invention provides a visual gateway debugging system and a visual gateway debugging method based on a swan mongolian operating system, and relates to the technical field of IoT (Internet of Things) debugging. The system comprises the following steps: constructing a domain name forest structure based on DNS, TLS and HTTP traffic, and identifying an equipment identity; a debugging activation instruction is generated, and cross-device command transmission with the DSoftBus is carried out through the WebSocket and the DSoftBus; collecting program counters, stacks and variable states with microsecond-level precision; constructing a state tetrad atlas and executing compression processing; migrating a breakpoint context among multiple devices and reconstructing an execution environment; and graphically presenting a state graph, a variable track and a call stack, and supporting linkage of path playback and debugging control. According to the method, a full-process closed loop from equipment identification to debugging control and from state modeling to path playback is realized, the debugging efficiency, the automation level and the system visualization capability are improved, and the method is suitable for debugging and abnormity diagnosis scenes of the distributed intelligent terminal.

A program is executed using a call stack and a shadow stack. The call stack includes frames with respective return addresses. The frames can also store variables and / or parameters. The shadow stack stores copies of the return addresses in the call stack. The call stack and the shadow stack are maintained by (i) adding a respective stack frame to the call stack and a respective return address to the shadow stack each time a function is called, and (ii) removing a respective frame from the call stack and a respective return address from the shadow stack each time a function is exited. A backtrace of the current call chain of the program is generated by accessing the return addresses in the shadow stack. The output backtrace includes return addresses from the shadow stack and / or information about traced functions derived from the return addresses of the shadow stack.

The invention discloses a Web security auditing method and device based on browser operation, and relates to the technical field of network security. Comprising the following steps: forcibly activating a credible type mechanism in a browser environment of a to-be-audited page, and constructing a hybrid monitoring environment with the assistance of API instrumentation; javaScript code data of a page are obtained, and a path control function is injected into a control flow branch of the JavaScript code data through abstract syntax tree analysis; executing the converted code in a monitoring environment, guiding to traverse different logic branches by utilizing a path control function, and capturing a call stack containing a vulnerability trigger point and a code snippet when triggering monitoring is executed; and based on call stack information, extracting precise code slices, combining with cue words, inputting the cue words into a large language model to perform safety semantic reasoning, and generating an audit report according to a structured result output by the model. High-coverage and low-false-alarm automatic detection of deep DOM XSS vulnerabilities is realized, and the problems that a path is difficult to reach and intelligent analysis is insufficient in a traditional security audit technology are solved.

The invention provides an attack detection method and device, electronic equipment and a storage medium, and the attack detection method comprises the steps: detecting whether there is an intersection between a memory region corresponding to a modified memory attribute and a function address range of a target event tracking function if the modification of the memory attribute of the target event tracking function is detected; if the intersection exists, obtaining function call stack information triggering the modification; and carrying out attack detection based on the function call stack information. Through the technical scheme provided by the invention, the modification monitoring of the memory area of the target event tracking function is combined with the function call stack information for triggering the modification, so that the ETW bypassing attack based on the memory patch mode is accurately detected.

The application provides a dead loop processing method and device, electronic equipment and storage medium, a preset script function is run, and the number of instructions executed when the preset script function is run is monitored; if the number of instructions is greater than a preset number threshold, a function call stack when the preset script function executes instructions is acquired and recorded; the number of times that the function call stack is recorded within a preset time period is determined, if the number of times recorded satisfies a preset condition, the function call stack is determined as a dead loop stack; the dead loop stack is interrupted to remove the current dead loop. Through monitoring the number of instruction executions and the number of times that the function call stack is recorded, the method can realize fault positioning to the function point level, greatly shortening the dead loop positioning time; meanwhile, after the existence of a dead loop problem is found, the method automatically removes the dead loop, improving the server dead loop troubleshooting efficiency.

The invention belongs to the field of machine learning, and discloses a deep learning framework vulnerability test method and related device.The method comprises the steps that a vulnerability report of a to-be-recognized deep learning framework is obtained, and a vulnerability API of the to-be-recognized deep learning framework and a vulnerability test case of the vulnerability API are obtained according to the vulnerability report; based on call stack similarity analysis, obtaining an API associated with the vulnerability API in the to-be-identified deep learning framework and taking the API as a to-be-identified API; generating a vulnerability test case of the to-be-identified API according to the vulnerability test case of the vulnerability API, and testing the to-be-identified API according to the vulnerability test case of the to-be-identified API to obtain a vulnerability test result of the to-be-identified API. By reusing the verified test basis, the test case is generated in a targeted manner, so that the test efficiency and accuracy are remarkably improved, and the problem of low efficiency of randomly generating the test case in the prior art is avoided. And meanwhile, by focusing on the high-similarity associated API, the test range is narrowed, and the resource overhead is reduced, so that the overall efficiency of the test process is improved.

This invention discloses a method, system, and medium for monitoring Linux file system metadata. The method includes: a user-space program responding to an execution request from a user carrying one or more specified block devices; the user-space program parsing and obtaining the WWID of the actual backend storage device corresponding to the given block device, as well as the location and file system type of the metadata to be monitored on the actual backend storage device; the user-space program passing the obtained information to a kernel-space program; the kernel-space program obtaining the WWID of the actual backend storage device corresponding to the target block device, the location of the written range on the actual backend storage device, the call stack, and the write time, matching it with the information passed from the user-space program, filtering out suspicious events and passing them to the user-space program, and recording the received suspicious event information to a designated location. This invention can promptly detect and record suspicious events, facilitating the investigation of the causes of file system metadata corruption.

The embodiment of the invention provides a connection leakage analysis method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: acquiring respective connection data of each potential leakage connection; generating a call stack signature of each potential leakage connection based on the call stack information of each potential leakage connection, and determining a suspicious call stack signature from the obtained call stack signatures; extracting a plurality of classes of call stack information corresponding to the suspicious call stack signature, and decompiling byte codes corresponding to the plurality of classes to obtain source codes of the plurality of classes; and determining a source code analysis result based on the suspicious call stack signature, the plurality of classes of source codes and the connection data corresponding to the suspicious call stack signature, the source code analysis result being used for indicating whether a code causing connection leakage exists or not and the position of the code. Therefore, the source of the connection leakage problem can be accurately positioned, so that the stability and the performance of the system are improved.

An algorithm having a combination of processing by a quantum computer and processing by a classical computer may take a long time to be completed. An information processing program causes a computer to execute a process of: acquiring a call stack of plural first programs for utilizing a quantum computer; determining a section of a loop process in the first programs on the basis of the call stack; measuring a first execution time of the section determined and a first utilization time of the quantum computer in the section determined; and estimating, on the basis of the first execution time and the first utilization time, a second execution time of the section determined and a second utilization time of the quantum computer in the section determined. The execution time of an algorithm having a combination of processing by a quantum computer and processing by a classical computer is thereby able to be shortened.

Provided in the embodiments of the present disclosure are a function processing method and apparatus, and an electronic device and a storage medium. The function processing method comprises: acquiring a first function from a first stack and executing same; during the process of executing the first function, determining a second function that is called by the first function and is to be executed, wherein the first function and the second function are respectively functions corresponding to different nodes in a node graph, and the node graph is a graph that is obtained by performing programming by means of visual programming and consists of a plurality of nodes; writing the second function into the first stack; after the first function is executed, acquiring the second function from the first stack; and using the second function as the first function, and returning to continue executing the first function until the first stack is empty. Functions in a first stack are cyclically read and executed, a function called by a read function is pushed into the first stack and is then executed after being read from the first stack, and stack push and pop operations are continuously performed until the first stack is empty, such that the problem of a function call stack overflow during the execution of a node graph in a visual programming environment can be solved.

The invention relates to the technical field of network security, provides an interactive attack mitigation method and system based on runtime application self-protection, and solves the technical problems that complex interactive attacks cannot be effectively identified and defended and the false alarm rate is relatively high. The method comprises the steps of collecting call stack information and a thread identifier of an application thread when a target application runs, and session context information associated with the application thread; carrying out vectorization coding on the call stack information to generate a context snapshot; taking external input data from an external request in the context snapshot as a taint source, and constructing a dynamic attribute graph; performing structural similarity analysis and path abnormal value calculation with a preset reference map to obtain a topology deviation value; the attribute flow direction relation between the starting node and the termination node in the transmission path is identified, the monitoring probe triggers the security blocking abnormity to terminate the application thread, self-protection interactive attack mitigation is achieved, and the context awareness defense capability of the application during operation is improved.

The invention provides an exception handling method and device, equipment and a storage medium, and aims to solve the problems that the exception of embedded equipment is difficult to locate and the operation and maintenance operation is complicated, and the method comprises the steps: obtaining an exception interrupt signal generated in the operation process of the embedded equipment; in response to the exception interrupt signal, extracting call stack information when an exception occurs, and executing self-defined exception handling function analysis on the call stack information to obtain a current exception function address; according to an instruction pointer register value in the current abnormal function address and a base address pointer register value in a stack pointer position in the call stack information, backtracking traversal is carried out, a function call chain relation is constructed, and structured abnormal information is generated; performing priority grading processing on the structured exception information, and writing the structured exception information into a corresponding partition of the storage device according to a priority grading result; and in response to a maintainable command input by a user, reading the structured exception information stored in the corresponding partition from the storage device.

The invention provides a method for obtaining a call stack and computer equipment. According to the method, a stack return statement is added in a code file during running of a Rust programming language, so that control during running is increased. The asynchronous task (or coroutine) is expanded on the thread, and when the execution is in order to obtain the call stack, the task on the thread is returned to the stack, so that the call stack is obtained and recorded. In the execution process, the data and the state of the stack-free coroutine cannot be changed, and the task logic cannot be influenced. According to the method for obtaining the call stack and the computer equipment provided by the invention, the code file cannot be modified in a large range, a large amount of operation overhead cannot be occupied for obtaining the call stack, so that function call or task logic cannot be influenced, the call stack can be conveniently and efficiently obtained, and the user experience is improved. Therefore, the operation condition of the coroutine in the Rust programming language can be accurately judged.

The embodiment of the invention provides an Android cross-thread message tracking method, which belongs to the technical field of data processing, and specifically comprises the following steps: intercepting a native method related to message processing in an Android system; when a client thread delivers a Message object to the message queue, a recording process is triggered by an enqueueMessage method of Hook, and call stack information of the client thread is acquired and stored and is subjected to associated storage; when the server thread takes out the Message object from the message queue and processes the Message object, an application process is triggered through a DispatchMessage method of Hook, and the current server thread is associated with the Message object; in response to a request for obtaining the stack information, judging whether the current thread is associated with a message object which is being processed or not; through the scheme of the invention, efficient, stable and low-intrusion message tracking is realized.

Methods and apparatus for a runahead process are provided to prevent frontend stalls when executing a computer program. Methods and apparatus profile and analyze the computer program when it is compiled to extract meta-data defining hyperblocks for the computer program. The hyperblocks each encompass a respective series of basic blocks having transitions that meet a specified threshold. When the computer program is executed, the runahead process is performed for program branches. In this process, a future path of hyperblocks is predicted from each branch and the instructions corresponding to those hyperblocks are prefetched to a memory cache so that they can be readily fetched. Cycles or large call stacks are removed to enable deep runaheads, which may span about a thousand instructions.

A debugging method and an electronic device relate to the technical field of computers, and dynamically call a debugging interface of a second programming language by registering the debugging interface of the second programming language in a first programming language debugger, thereby obtaining call stack information and variable information of the second programming language, setting breakpoints, modifying variables and the like. In the method, the electronic equipment displays a debugging interface of a debugger adaptive to a first programming language, and loads a service program which is subjected to mixed programming by adopting the first programming language and a second programming language to test equipment. A runtime debugging interface is configured in the runtime matched with the second programming language. During debugging, when a service process runs to a first service code segment obtained by programming of a first programming language, a debugging breakpoint is entered, and the electronic equipment calls a runtime debugging interface through a debugger registered with the runtime debugging interface; and executing debugging processing operation on a second business code segment obtained by programming in the business program loaded by the test equipment by adopting the second programming language.

Aspects of the disclosure relate to computing and maintaining stack call signatures with support for fast online stack unwinding. Instead of sampling and unwinding stack frames, a system maintains and updates a separate call path signature for each sampled frame. The call path signature encodes the contents of each frame of a stack of frames forming a call path. A call path “summary” stack is maintained and processed from the bottom-up to recreate the full stack corresponding to a sampled frame.

The application discloses an open source software supply chain security intelligent monitoring and risk assessment method, relates to the technical field of software supply chain security, and solves the problem that the prior art can only identify the existence of indirect dependence but cannot accurately determine whether a vulnerability code can be called on an actual execution path. The application realizes accurate tracing of a component version through time-dependent locking and hash fingerprint embedding, and completely eliminates version ambiguity; in combination with deep interception of a method call and class loading event by a runtime JVM probe, the loading source of each class in a real execution path and the call stack context are captured, dynamic behavior data and a static dependence tree are bidirectionally associated and mapped, and it is accurately determined whether a vulnerability component is located on an executable call chain. Compared with the defects of traditional tools that only perform coarse-grained alarm through version matching, the application avoids misjudging a large number of indirect dependence vulnerabilities that cannot be utilized as high risks through dynamic-static data fusion.

The application discloses a kind of reverse tracing methods based on V8 call stack, realize the real-time tracking and accurate attribution of the behavior of illegal write cookie in real webpage, can know each cookie field is by which script or function participated in illegal write, also know which third party or first party website should be responsible for this illegal behavior.The tracing framework can run on real website, through the innovative DFG construction logic, greatly improve the accuracy of data dependence tracking and the stability of reverse tracing.Make DFG can truly reflect dynamic data flow relationship, provide reliable data flow graph DFG for subsequent reverse tracking, avoid the incomplete or interruption of tracing result caused by DFG defect, further support the accurate extraction of illegal cookie data source.Through the attribute setter monitoring innovation of V8 engine layer, realize the comprehensive capture of illegal cookie assignment operation, provide complete initial data support for the tracing chain.

The application discloses a method for obtaining a call stack when simulating running an application program and a computing device. The computing device comprises a first architecture processor and runs a first operating system. A second application program running a second operating system is simulated and run through a simulator. The method comprises the following steps: converting second architecture instructions of the compatibility layer and the second application program into first architecture instructions through the simulator and executing the first architecture instructions; in response to an interruption of the first architecture processor, debugging the simulator and obtaining an input extended command; executing the extended command to obtain current second architecture registers of a second architecture site from an interruption site of the first architecture processor; and obtaining a call stack of the second architecture instructions of the compatibility layer or the second application program based on the current second architecture registers. According to the technical scheme of the application, in the debugging process of the simulator, an error site of the second architecture instructions can be intuitively observed in the interruption site.

Provided are a device and method for detecting a variable vulnerability in software using a machine learning (ML) model. The method performed by an analysis device includes receiving a source code of a program to be analyzed, replacing call functions, variable names, and call stack functions in an execution log generated during execution of the source code with certain identifiers (IDs) to preprocess the execution log, analyzing the preprocessed execution log through a pretrained first learning model to classify whether each pair of a global variable and a call function is at an initialization location, analyzing the preprocessed execution log through a pretrained second learning model to estimate a maximum value and a minimum value of the global variable, and determining whether the global variable is vulnerable on the basis of information output by the first learning model and information output by the second learning model.

A system and method for efficiently tracking unwound call stacks with reduced cardinality is presented. The method includes retrieving an unwinding table based on a first address of a current context received from a system event, wherein the first address indicates a source binary file; identifying a lower limit address and an upper limit address from the retrieved unwinding table, wherein the first address is bound between the lower limit address and the upper limit address; constructing an unwound call stack from a top stack frame including the lower limit address; and storing the constructed unwound call stack with the top stack frame in a memory.

The invention discloses a low-interference taint path restoration system and method based on static instrumentation, and mainly solves the problems of stiff analysis strategy, high operation overhead and result semantic deficiency faced by existing vulnerability mining and security assessment. The system comprises a target data acquisition end and an analysis engine which run independently and are connected through a shared memory channel; lightweight static instrumentation is performed on a source code in a target program compiling stage, and a shared memory channel with an analysis engine is established; by constructing a "producer-consumer" asynchronous decoupling architecture, time-consuming taint rule management and path restoration logic are stripped from a service main thread; a lockless annular buffer area is utilized to efficiently capture a runtime data stream, and a source code level taint propagation path is restored in an independent analysis engine in combination with debugging information and a call stack Hash algorithm. According to the method, a high-precision source code level analysis result can be obtained while low performance loss is kept, and the efficiency and flexibility of vulnerability mining are greatly improved.