54 results about "Event tracing" patented technology

The invention relates to the technical field of transaction processing systems, and particularly discloses a trusted monitoring auditing system fusing TEE and a block chain, which comprises the following steps: generating a transaction instantaneous state abstract containing a key information field at a key node of a business process through a trusted execution environment, signing, anchoring a hash value of the transaction instantaneous state abstract to a block chain network, and storing the signature abstract under the chain; and during auditing, by comparing integrity verification of on-chain hash and under-chain abstract and TEE signature verification, dual authentication of transaction authenticity and environment reliability is realized. Through the collaborative architecture of the TEE and the block chain, the transaction core data state and the credible environment proof are deeply fused, so that the audit verification can be independently completed without depending on a centralized database, the problem that post-event tracing depends on the credibility of the log in the traditional audit is fundamentally avoided, and the audit verification efficiency is improved. And a lightweight credible verification basis is provided for a cross-mechanism cooperation scene.

The invention relates to the field of network security, and provides a security event tracing and response method and system based on an LLM intelligent agent, and the method comprises the steps: collecting log information from network equipment, and extracting a security event with a high threat degree in the log information; identifying an attack mode of the security event based on LLM, and generating a response strategy including atomization operation steps according to the identified attack mode; the natural language instruction in the response strategy is converted into a tool calling instruction through the intelligent agent, and related tools are called to execute specific operation. By constructing an LLM-driven intelligent decision-making body, full-process automation from event analysis to response execution is achieved, the LLM deep reasoning ability and a safety tool chain are innovatively and deeply fused, an unstructured log is converted into an executable disposal scheme through the semantic understanding ability of the LLM deep reasoning ability, and the processing efficiency is improved. And designing a multi-stage reasoning framework of attack mode analysis-target decomposition-tool matching, and supporting dynamic generation of a customized response scheme conforming to an enterprise strategy.

The present invention belongs to the fields of network security, distributed systems, zero trust, and micro-services, and disclosed are a method for a micro-service dynamic access control policy under a zero trust architecture, and an apparatus. The method specifically comprises: obtaining context information in a micro-service runtime context event by means of an event tracker of a node; a context manager collecting and aggregating the context information and reporting same to a micro-service control plane global manager; the global manager determining whether a new micro-service instance is present according to a global context mapping table value, and if yes, updating a global and local tag mapping table; when a message is received by a node, a message validator obtaining a tag value carried by the message, and micro-service context information corresponding to the message being obtained by means of the local tag mapping table; after a local policy table and a global policy table are queried, running a decision algorithm, and executing a corresponding access control policy. The present invention uses context to identify a communication endpoint, and has the advantages of being dynamic, precise, and extensible.

The invention discloses a security event traceability system and method based on attack chain analysis, relates to the technical field of data security protection, and is used for realizing multi-level perception of attack activities by building a multi-modal killing chain probe matrix as a structured data basis. Modeling analysis is carried out on attack behaviors of different levels through a deep heterogeneous feature extraction architecture, multi-dimensional features are fused into a cross-layer joint feature vector, a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector, the propagation path and probability of APT attack are simulated, a high-dimensional attack curved surface is drawn, and a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector. And key path nodes and potential transverse diffusion directions are identified, and a defense strategy knowledge graph is constructed according to a modeling result. The traceability system breaks through barriers among threat detection, attack understanding and defense response through a stage linkage mode of'probe sensing-intention recognition-path modeling-defense deduction ', and realizes accurate traceability and efficient disposal of security events.

The invention provides a cross-domain collaborative information tracking and positioning auxiliary method and system, and the method comprises the steps: firstly collecting an original data set generated by a target event in a plurality of associated domains, carrying out the cross-domain identifier matching processing to obtain a standardized event data set, and then carrying out the information association processing of the standardized event data set, according to the method, context semantic features and cross-domain time sequence behavior features of a target event are generated, then collaborative analysis is performed on the features based on a preset collaborative analysis model, a cross-domain collaborative tracking index set is generated, and a dynamic tracking path topology is constructed according to the cross-domain collaborative tracking index set. According to the method and the device, the target event is tracked and positioned, the positioning auxiliary strategy matched with the target event is generated, and finally the positioning auxiliary strategy is synchronized to the cross-domain tracking system to activate the cooperative positioning operation, so that the cooperative processing of multi-domain information is realized, and the target event tracking and positioning accuracy and efficiency are improved.

The invention provides a PCIE (Peripheral Component Interface Express) power consumption testing device, relates to the field of power consumption testing, and can break a barrier between hardware power consumption data and a software system log and innovatively utilize an operating system kernel event tracking system as a unified data fusion platform. A power consumption sampling point collected by external hardware in real time serves as a self-defined event and is injected into a kernel event tracking session in real time, so that the power consumption sampling point and a kernel state change event captured by a system coexist under the same high-precision timestamp, and a unified tracking event stream which is perfectly aligned in time is generated. On the basis, the PCIE abnormal mode is further automatically identified from mass tracking data. Through the deep learning model, the local time sequence characteristics of the power consumption sequence are coded, then the mode evolution rule of the full time domain is further captured, finally, the abnormal state of the PCIE link is accurately and automatically judged, and then the diagnosis efficiency and accuracy of the power consumption problem are improved.

The invention discloses a track retrieval method and device, computer equipment and a storage medium, and belongs to the technical field of artificial intelligence. By introducing multi-source data fusion, space-time knowledge graph construction, graph neural network feature propagation and attention mechanism semantic fusion in the track retrieval process, the problems of data dispersion, low retrieval efficiency, difficulty in unified modeling of cross-modal information and the like in traditional security retrieval are effectively solved. According to the method, cross-modal fusion and efficient retrieval of the trajectory are realized, and the intelligent level of event tracing and real-time analysis in a security scene is remarkably improved.

The invention relates to an abnormal event tracing method and device of a power system, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring an operation state data set of a power system under the condition of receiving abnormal alarm information sent by a power monitoring system; performing anomaly detection on the operation state data set by adopting an isolated forest algorithm to obtain a candidate abnormal operation state data set; inputting the candidate abnormal operation state data set into a Gaussian mixture model to determine target abnormal operation state data in the candidate abnormal operation state data set; performing association mapping on the target abnormal operation state data and the topological structure of the power system, determining abnormal power equipment corresponding to the target abnormal operation state data, and obtaining time sequence data of the abnormal power equipment; and tracing the abnormal event based on the time sequence data of each abnormal power device, and generating an abnormal event tracing result. By adopting the method, the abnormity of the power grid system can be efficiently processed.

The invention relates to a transaction event interpretation system based on information traceability. The transaction event interpretation system comprises an architecture management module, a vector deployment module and a transaction recognition module, the architecture management module comprises an association construction unit and a type calibration unit; the vector deployment module comprises a transaction construction unit, a transaction evaluation unit, a vector generation unit and a vector deployment unit, and the transaction identification module comprises an information acquisition unit and a transaction index unit. According to the method, two dimensions of static configuration and dynamic retrieval are combined, firstly, static configuration of retrieval vectors is carried out on each monitoring point according to basic information, so that each monitoring point has target performance during transaction event tracing, on the other hand, the incidence relation between the monitoring points is taken into account, information isolation is avoided, and in addition, through dynamic configuration of the probe, the accuracy of transaction event tracing is improved. And according to the actual condition of each monitoring point, external data is rapidly obtained to complement the external event basis required by transaction event tracing.

The invention discloses a real-time traffic flow abnormal event tracing method and system based on edge calculation, and the method comprises the steps: obtaining traffic flow data of edge nodes, analyzing the dynamic impedance of a road segment according to the traffic flow data, calculating the path selection probability of each path through employing an abnormal event wave proportion, extracting a traffic flow abnormal road segment, and carrying out the tracing of the traffic flow abnormal event. And performing spatial overlapping analysis on the abnormal road sections according to the path selection probability, matching the traffic event announcement root cause and the meteorological early warning root cause based on the association strength of each abnormal road section, generating an optimal matching root cause through a maximum weight bisection matching algorithm, and tracing the upstream traffic flow by using the optimal matching root cause and the path selection probability. According to the method, dynamic impedance analysis, SIR propagation simulation and Shapley value are utilized to quantify the contribution degree of the root cause to the abnormal road section, full-link traceability of the root cause, the path and the upstream node is formed, relatively complete data support is provided for traffic abnormity diffusion caused by traffic abnormity and meteorological abnormity, and the practicability and decision value of a traceability result are improved.

The present invention discloses a method and system for identifying and warning computer information anomalies, specifically related to the field of anomaly identification and warning; by monitoring the cross-layer event timestamp data generated on the host and container sides, the consistency of time records on both sides is evaluated; at the same time, the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer is analyzed to evaluate the visibility consistency of the multi-layer resource occupancy status. And determine the degree of cross-layer visibility misalignment risk. When the risk reaches a high-risk level, the multi-layer lock competition anomaly risk is evaluated by analyzing the kernel event trace sequence. Finally, the time record consistency between the host and container sides, the visibility consistency of the multi-layer resource occupancy status, and the multi-layer lock competition anomaly risk are comprehensively analyzed to evaluate the cross-layer visibility misalignment warning level, so as to achieve accurate identification and warning of computer information anomalies and effectively ensure the operation safety and stability of the computer system.

The application discloses a Java-based distributed transaction management system and relates to the technical field of distributed systems. In view of the contradiction between transaction consistency and high concurrency and high availability in a distributed system, the scheme comprises the following: a transaction coordination module, which is used for constructing a cluster based on a Raft protocol to guarantee continuous availability of a service, realizing transaction full-life cycle management by relying on an extended state machine engine, and dynamically selecting an optimal communication path of a transaction according to scheduling decisions and a real-time network topology state; a local transaction management module, which is embedded in each microservice and is used for realizing local execution and state reporting of a transaction; a multi-level log module, which is used for realizing traceability of a transaction state and recovery of a fault through multi-level storage and event tracing; an intelligent scheduling module, which is used for realizing dynamic optimization of transaction processing based on an LSTM model and QoS indicators; and a monitoring and alarming module, which is used for collecting transaction full-link logs and performance indicators in real time and realizing full-link observability. The application is suitable for high-reliability and high-concurrency scenarios.

An embodiment of the present application provides a method for tracking a process created by the Windows Task Scheduler, which relates to the field of information security technology. The method includes: injecting a dynamic link library containing a context marshaling module into the task scheduler service process, and hooking the event tracing API in Windows Event Tracing with a hook function in the context marshaling module through the dynamic link library; obtaining parameter information in the event tracing API called by the unified background process manager of the system through the hook function, and constructing a task context of a thread based on the parameter information; when the security proxy module receives a callback for process creation, perform the following operations: determine whether the task context of the thread exists, and when the thread has a task context, operate on the created process according to the task context. The implementation manner provided by the present application realizes accurate capture of the task creation process.

The invention relates to the field of constructional engineering informatization and intelligent safety management, discloses a construction safety dynamic management system and method based on BIM and RFID fusion, and aims to solve the technical problems of fuzzy identity recognition, inaccurate space positioning, delayed early warning response and difficult event tracing in traditional construction safety monitoring. Comprising an RFID sensing subsystem, a BIM data management subsystem, a space mapping and conflict detection subsystem, a grading early warning subsystem and an event tracing analysis subsystem, and realizes closed-loop management from sensing, mapping, early warning to tracing: centimeter-level real-time positioning of personnel and machinery is realized by deploying a multi-band RFID reader-writer array and an active tag; and when a space conflict is detected, a three-level early warning mechanism is triggered, and synchronous intervention is performed through three channels of sound and light, a mobile terminal and a large screen. By means of the technical scheme, the safety situation sensing precision and response speed of the construction site are remarkably improved, the early warning accuracy rate exceeds 98%, the accident rate is reduced by 70% or above, and whole-process data-driven decision making is supported.

The invention relates to a lightweight network flow storage and management method and system based on flow clustering, and belongs to the field of computer network security, and the method comprises the steps: deploying a Zeek monitoring component and P4 equipment at a network boundary and a core node, and carrying out the structural analysis of a multi-source weblog; based on data source and flow feature clustering and grading processing, dividing into a key flow, a common flow and a secondary flow; hierarchical forwarding and priority scheduling of the logs are realized through Filebeat and Kafka; a hierarchical storage architecture of a core flow layer, a main service flow layer and an archiving flow layer is constructed based on ClickHouse, and efficient retrieval and traceability analysis are realized through a materialized view and a multi-dimensional index. According to the invention, flexible scheduling and grading processing of traffic can be realized in a high-concurrency network environment, the overall throughput efficiency and security situation awareness capability of the system are improved, real-time performance and storage cost control are both considered, and the method is suitable for threat monitoring and event tracing scenes in a large-scale network environment.

The invention provides a door opening and closing event tracking system for safety management of a metal electric meter box, and relates to the technical field of safety management of electric meter boxes, and the system specifically comprises a sensor module, an identity recognition module, a main control module, a communication module, a power module and a data storage module. The door magnetic sensor transmits an opening and closing state signal to the main control module, if the electric meter box is subjected to abnormal vibration, the vibration sensor transmits a vibration signal to the main control module, information such as time and personnel of door opening and closing events can be recorded in detail through the identity recognition module, later tracing is facilitated, and if the main control module judges that the door is opened abnormally or vibrates abnormally, the electric meter box is opened abnormally. The communication module sends early warning information to a manager, abnormal door opening and vibration conditions can be found in time, potential safety hazards are reduced, and the manager can check the state of the electric meter box anytime and anywhere through the remote server and the client.

The invention provides an industrial personal computer data security backup method and system based on an encryption algorithm, and the method comprises the steps: obtaining operation parameters of a production process stored by an industrial personal computer, forming original backup data blocks, numbering the original backup data blocks, and obtaining the operation parameters according to a preset time interval; the original data block is encrypted, the time block with the time interval larger than a first preset threshold value is encrypted through a low-intensity encryption algorithm, and the time block with the time interval smaller than or equal to the first preset threshold value is encrypted through a high-intensity encryption algorithm; after encryption, an encrypted data block is formed, security integrity verification information is generated for the encrypted data block, and tampering detection and tracing are realized. Through the method and the corresponding system, an efficient, flexible and safe data backup and monitoring system is realized, data is effectively prevented from being illegally read and tampered, and event tracing and data management are facilitated.

An application-level determination of anomalies in response to issuance of an incident ticket / report. AI including NLP is implemented to decipher the unstructured freeform data in an incident ticket to positively identify the resource event that caused the incident. Once the resource event has been identified, a resource event tracing record associated with the resource event is analyzed to determine one or more anomalies. Analysis of the resource event tracing record may include comparison of the resource event tracing record to other resource event tracing records having one or more similar attributes to determine differences in recorded metrics, which may indicate anomalies. In response to determining the isolated and / or systemic anomalies, an anomaly report that indicates at least a portion of the determined anomalies is generated, and electronic communication is initiated.

This invention discloses a real-time control and management platform for intelligent well firing, relating to the field of well firing control technology. It solves the technical problems of traditional solutions lacking multi-hop communication control between nodes, failing to monitor relay node status in real time, and being unable to dynamically adjust strategies based on real-time data, thus affecting the control effect of the management platform on intelligent well firing. The platform divides the well firing distribution area into multiple zones, with each zone equipped with multi-hop relay nodes, forming a hierarchical transmission path. This solves the problem of limited single-hop communication distance, making it particularly suitable for complex terrains such as mountainous areas and underground environments, expanding coverage through relay hops. Simultaneously, a production mode configuration and full-dimensional status management module enables flexible configuration of production modes, status tracking and visualization of well firing equipment and the entire operation process, operation trajectory playback and event tracing, and quality control management of the firing process, providing comprehensive data support for intelligent firing decision-making and operation process control.

The embodiment of the application provides a kind of program performance bottleneck automatic analysis method and system, it is related to application research and development technical field.The method can respond to the program running instruction input by user, based on target program path, run target program, then according to monitoring parameter setting performance analysis tool data acquisition strategy, and in target program running process, according to data acquisition strategy, monitoring data is obtained from event tracking interface.After target program ends, based on analysis algorithm and monitoring data, calculate key performance parameters, then according to result output mode and key performance parameters, generate structured report.Data acquisition strategy includes the counting object of performance counter and process filtering rule.The method can automatically call event tracking interface to complete performance data acquisition and analysis by user specified analysis rule, and real-time output performance bottleneck analysis result, can reduce the complexity of program performance analysis operation, improve program performance analysis efficiency.

Systems and methods are described for implementing an event tracing system for an open radio access network (“RAN”). A RAN implementation may be distributed across multiple components, including both special-purpose components such as radio units and general purpose components such as local or cloud-based servers. A RAN event tracing system may thus be used to troubleshoot issues with the RAN implementation by collecting information from distributed components regarding events that occur on these components during the translation of data into radio signals and vice versa. The RAN event tracing system may be used to search for events associated with a particular identifier, such as a radio network temporary identifier, and to display representations of radio frames that were generated by the components and display information regarding the events that led to the placement of particular resource elements onto the radio frames.

The invention relates to the technical field of natural language processing and text mining, and discloses a dynamic granularity timeline abstract generation method based on multi-agent collaboration and application thereof.The dynamic granularity timeline abstract generation method comprises the steps that firstly, a high-quality text set related to a query theme is screened out from a multi-source heterogeneous text through cooperative work of three kinds of agents including generation, debate and decision; then dynamically dividing the text into a specified number of semantic clusters through cooperation of another group of agents based on granularity parameters specified by a user; generating an event abstract for each cluster; and finally, carrying out fact consistency verification. According to the method, the accuracy and interpretability of information screening and event grouping are improved through a multi-agent debate mechanism, flexible dynamic control over abstract granularity is achieved by introducing granularity parameters, the content reliability is guaranteed through authenticity verification, the capacity of automatically generating reliable and customizable timeline abstracts from complex text streams is improved, and the method is suitable for popularization and application. The method is suitable for multiple scenes such as public opinion analysis, event traceability and decision support.

A method and system for determining, based on event tracing associated with user devices connected to a cellular network, locations of the user devices in indoor environments (hereinafter, indoor locations), for example in order to determine quality of service maps of (e.g., urbanized) indoor environments of a geographic area covered by the cellular network.

The invention belongs to but not limited to the technical field of data processing, and discloses a target positioning and event tracking visualization system and method based on a large language model, and the system comprises a user input processing module which receives unstructured natural language input from a user, extracts the intention of the user, and completes the scheduling of a downstream module and the initialization of a processing flow; the big language model event extraction module based on the RAG is used for fusing the retrieval enhancement generation framework and the big language model and automatically identifying and extracting structured event information from a natural language; the geographical name analysis and space positioning module is used for standardizing geographic information entities in a natural language and accurately mapping the geographic information entities into a geographic coordinate system so as to provide support for space positioning and visualization of subsequent events; the map service and event visual display module consists of two independent services which are respectively responsible for static service of a map tile layer and visual rendering of an event track; the method is used for event position labeling, track visualization and interactive map display.

Mechanisms are provided for generating a holistic view of an event processing pipeline of an event driven architecture. Curation of runtime information from components of an event processing pipeline is performed, where the runtime information comprises real-time runtime metrics, aggregated logs, event tracing / recording data structures, and configuration information. The curated runtime information is correlated to generate correlated runtime data. Predictive models and predictive analytics process the correlated runtime data to predict anomalies in the components of the event processing pipeline. A fault circuit interrupt machine (FCIM) processes the predicted anomalies based on user resiliency configurations to determine recommended event resiliency remediation actions for addressing the predicted anomalies. A real-time holistic view of the components of the event processing pipeline is generated based on the correlated runtime data, the predicted anomalies, and the determined recommended event resiliency remediation actions.

Mechanisms are provided for generating a holistic view of an event processing pipeline of an event driven architecture. Curation of runtime information from components of an event processing pipeline is performed, where the runtime information comprises real-time runtime metrics, aggregated logs, event tracing / recording data structures, and configuration information. The curated runtime information is correlated to generate correlated runtime data. Predictive models and predictive analytics process the correlated runtime data to predict anomalies in the components of the event processing pipeline. A fault circuit interrupt machine (FCIM) processes the predicted anomalies based on user resiliency configurations to determine recommended event resiliency remediation actions for addressing the predicted anomalies. A real-time holistic view of the components of the event processing pipeline is generated based on the correlated runtime data, the predicted anomalies, and the determined recommended event resiliency remediation actions.

The application discloses a system and method for distributed attack process forensics, introduces a user-unaware, distributed active defense model into attack forensics, automatically constructs a high-fidelity and high-density camouflage environment in a network, constructs decoys and luring traps along the way in the network and terminal, actively spreads false messages and polluted data to an attacker, and when the attacker intrudes, issues a forensics strategy and a forensics component in an Agentless mode, realizes distributed and non-invasive dynamic forensics through system kernel event tracking, and makes up for the shortcomings of existing attack forensics.

The invention aims to provide an efficient network security event notification and early warning method and system, a security event subjected to condition screening is used as a data basis of notification and early warning, the event related information is pushed to a corresponding notified end by a notification end, and in the process, the notified event is subjected to double confirmation of the notification end and the notified end, so that the notification and early warning efficiency is improved. The consistency of an event responsibility party and an actual processing party can be ensured, and post-event tracing is facilitated; and meanwhile, a processing marking and state auditing mechanism is provided, so that the execution effect of event early warning notification can be ensured.

The invention discloses a data asset protection method suitable for a financial information platform, and the method comprises the steps: capturing an operation track, carrying out the dynamic control of frequency, carrying out the dynamic protection linkage, carrying out the hierarchical control of character reading, carrying out the data display, and carrying out the afterward tracing, and enabling the overall data safety and traceability of the financial data platform to be improved. A service related party is informed through a notification or mail method, response measures are prepared at the first time, and an access log is associated with a user identity and an encrypted fingerprint to generate an evidence obtaining report; the cross-modal cooperation of dynamic confusion and voiceprint encryption is combined with front-end page dynamic and biological feature encryption, the data acquisition difficulty is doubly improved, and the content and the identity of a leaked person can be synchronously traced when data is leaked by distinguishing manual and machine operations, dynamically adjusting a protection strategy and utilizing virtual identifier-voiceprint dual binding, so that the real-time security of the data is ensured. A dynamic anti-crawler strategy and a multi-mode content encryption technology are adopted, and active protection and afterward traceability tracking of financial text data and audio data are achieved.

The present invention relates to the field of data analysis, and in particular to an application system and method based on graph data analysis in event tracing. The system includes: a graph data storage layer: the bottom-level abstract event data repository, which generates a knowledge graph based on the event itself and the attributes between events; a graph data interface service layer: creating an interface service based on event attribute retrieval requirements, docking the graph data storage layer through an API, and establishing interaction with event standardized data; a system application interface service layer: conducting a comprehensive analysis and design of requirements in different fields, performing instantiation configuration management of things, and establishing personalized data interaction with the graph data interface service layer; a data visualization editing layer: docking the business operation display interface of the system application interface service layer through an API, including modeling creation of entity data, registration of graph events, event data editing, and link-based display of graph events. This solves the limitation problem of existing data storage services in data tracing.