43 results about "Event tracing" patented technology

The invention relates to the field of network security, and provides a security event tracing and response method and system based on an LLM intelligent agent, and the method comprises the steps: collecting log information from network equipment, and extracting a security event with a high threat degree in the log information; identifying an attack mode of the security event based on LLM, and generating a response strategy including atomization operation steps according to the identified attack mode; the natural language instruction in the response strategy is converted into a tool calling instruction through the intelligent agent, and related tools are called to execute specific operation. By constructing an LLM-driven intelligent decision-making body, full-process automation from event analysis to response execution is achieved, the LLM deep reasoning ability and a safety tool chain are innovatively and deeply fused, an unstructured log is converted into an executable disposal scheme through the semantic understanding ability of the LLM deep reasoning ability, and the processing efficiency is improved. And designing a multi-stage reasoning framework of attack mode analysis-target decomposition-tool matching, and supporting dynamic generation of a customized response scheme conforming to an enterprise strategy.

The invention discloses a security event traceability system and method based on attack chain analysis, relates to the technical field of data security protection, and is used for realizing multi-level perception of attack activities by building a multi-modal killing chain probe matrix as a structured data basis. Modeling analysis is carried out on attack behaviors of different levels through a deep heterogeneous feature extraction architecture, multi-dimensional features are fused into a cross-layer joint feature vector, a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector, the propagation path and probability of APT attack are simulated, a high-dimensional attack curved surface is drawn, and a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector. And key path nodes and potential transverse diffusion directions are identified, and a defense strategy knowledge graph is constructed according to a modeling result. The traceability system breaks through barriers among threat detection, attack understanding and defense response through a stage linkage mode of'probe sensing-intention recognition-path modeling-defense deduction ', and realizes accurate traceability and efficient disposal of security events.

The invention provides a cross-domain collaborative information tracking and positioning auxiliary method and system, and the method comprises the steps: firstly collecting an original data set generated by a target event in a plurality of associated domains, carrying out the cross-domain identifier matching processing to obtain a standardized event data set, and then carrying out the information association processing of the standardized event data set, according to the method, context semantic features and cross-domain time sequence behavior features of a target event are generated, then collaborative analysis is performed on the features based on a preset collaborative analysis model, a cross-domain collaborative tracking index set is generated, and a dynamic tracking path topology is constructed according to the cross-domain collaborative tracking index set. According to the method and the device, the target event is tracked and positioned, the positioning auxiliary strategy matched with the target event is generated, and finally the positioning auxiliary strategy is synchronized to the cross-domain tracking system to activate the cooperative positioning operation, so that the cooperative processing of multi-domain information is realized, and the target event tracking and positioning accuracy and efficiency are improved.

The invention discloses a track retrieval method and device, computer equipment and a storage medium, and belongs to the technical field of artificial intelligence. By introducing multi-source data fusion, space-time knowledge graph construction, graph neural network feature propagation and attention mechanism semantic fusion in the track retrieval process, the problems of data dispersion, low retrieval efficiency, difficulty in unified modeling of cross-modal information and the like in traditional security retrieval are effectively solved. According to the method, cross-modal fusion and efficient retrieval of the trajectory are realized, and the intelligent level of event tracing and real-time analysis in a security scene is remarkably improved.

The invention relates to an abnormal event tracing method and device of a power system, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring an operation state data set of a power system under the condition of receiving abnormal alarm information sent by a power monitoring system; performing anomaly detection on the operation state data set by adopting an isolated forest algorithm to obtain a candidate abnormal operation state data set; inputting the candidate abnormal operation state data set into a Gaussian mixture model to determine target abnormal operation state data in the candidate abnormal operation state data set; performing association mapping on the target abnormal operation state data and the topological structure of the power system, determining abnormal power equipment corresponding to the target abnormal operation state data, and obtaining time sequence data of the abnormal power equipment; and tracing the abnormal event based on the time sequence data of each abnormal power device, and generating an abnormal event tracing result. By adopting the method, the abnormity of the power grid system can be efficiently processed.

The invention relates to a transaction event interpretation system based on information traceability. The transaction event interpretation system comprises an architecture management module, a vector deployment module and a transaction recognition module, the architecture management module comprises an association construction unit and a type calibration unit; the vector deployment module comprises a transaction construction unit, a transaction evaluation unit, a vector generation unit and a vector deployment unit, and the transaction identification module comprises an information acquisition unit and a transaction index unit. According to the method, two dimensions of static configuration and dynamic retrieval are combined, firstly, static configuration of retrieval vectors is carried out on each monitoring point according to basic information, so that each monitoring point has target performance during transaction event tracing, on the other hand, the incidence relation between the monitoring points is taken into account, information isolation is avoided, and in addition, through dynamic configuration of the probe, the accuracy of transaction event tracing is improved. And according to the actual condition of each monitoring point, external data is rapidly obtained to complement the external event basis required by transaction event tracing.

The invention discloses a real-time traffic flow abnormal event tracing method and system based on edge calculation, and the method comprises the steps: obtaining traffic flow data of edge nodes, analyzing the dynamic impedance of a road segment according to the traffic flow data, calculating the path selection probability of each path through employing an abnormal event wave proportion, extracting a traffic flow abnormal road segment, and carrying out the tracing of the traffic flow abnormal event. And performing spatial overlapping analysis on the abnormal road sections according to the path selection probability, matching the traffic event announcement root cause and the meteorological early warning root cause based on the association strength of each abnormal road section, generating an optimal matching root cause through a maximum weight bisection matching algorithm, and tracing the upstream traffic flow by using the optimal matching root cause and the path selection probability. According to the method, dynamic impedance analysis, SIR propagation simulation and Shapley value are utilized to quantify the contribution degree of the root cause to the abnormal road section, full-link traceability of the root cause, the path and the upstream node is formed, relatively complete data support is provided for traffic abnormity diffusion caused by traffic abnormity and meteorological abnormity, and the practicability and decision value of a traceability result are improved.

The application discloses a Java-based distributed transaction management system and relates to the technical field of distributed systems. In view of the contradiction between transaction consistency and high concurrency and high availability in a distributed system, the scheme comprises the following: a transaction coordination module, which is used for constructing a cluster based on a Raft protocol to guarantee continuous availability of a service, realizing transaction full-life cycle management by relying on an extended state machine engine, and dynamically selecting an optimal communication path of a transaction according to scheduling decisions and a real-time network topology state; a local transaction management module, which is embedded in each microservice and is used for realizing local execution and state reporting of a transaction; a multi-level log module, which is used for realizing traceability of a transaction state and recovery of a fault through multi-level storage and event tracing; an intelligent scheduling module, which is used for realizing dynamic optimization of transaction processing based on an LSTM model and QoS indicators; and a monitoring and alarming module, which is used for collecting transaction full-link logs and performance indicators in real time and realizing full-link observability. The application is suitable for high-reliability and high-concurrency scenarios.

The invention relates to the field of constructional engineering informatization and intelligent safety management, discloses a construction safety dynamic management system and method based on BIM and RFID fusion, and aims to solve the technical problems of fuzzy identity recognition, inaccurate space positioning, delayed early warning response and difficult event tracing in traditional construction safety monitoring. Comprising an RFID sensing subsystem, a BIM data management subsystem, a space mapping and conflict detection subsystem, a grading early warning subsystem and an event tracing analysis subsystem, and realizes closed-loop management from sensing, mapping, early warning to tracing: centimeter-level real-time positioning of personnel and machinery is realized by deploying a multi-band RFID reader-writer array and an active tag; and when a space conflict is detected, a three-level early warning mechanism is triggered, and synchronous intervention is performed through three channels of sound and light, a mobile terminal and a large screen. By means of the technical scheme, the safety situation sensing precision and response speed of the construction site are remarkably improved, the early warning accuracy rate exceeds 98%, the accident rate is reduced by 70% or above, and whole-process data-driven decision making is supported.

The invention relates to a lightweight network flow storage and management method and system based on flow clustering, and belongs to the field of computer network security, and the method comprises the steps: deploying a Zeek monitoring component and P4 equipment at a network boundary and a core node, and carrying out the structural analysis of a multi-source weblog; based on data source and flow feature clustering and grading processing, dividing into a key flow, a common flow and a secondary flow; hierarchical forwarding and priority scheduling of the logs are realized through Filebeat and Kafka; a hierarchical storage architecture of a core flow layer, a main service flow layer and an archiving flow layer is constructed based on ClickHouse, and efficient retrieval and traceability analysis are realized through a materialized view and a multi-dimensional index. According to the invention, flexible scheduling and grading processing of traffic can be realized in a high-concurrency network environment, the overall throughput efficiency and security situation awareness capability of the system are improved, real-time performance and storage cost control are both considered, and the method is suitable for threat monitoring and event tracing scenes in a large-scale network environment.

The invention provides a door opening and closing event tracking system for safety management of a metal electric meter box, and relates to the technical field of safety management of electric meter boxes, and the system specifically comprises a sensor module, an identity recognition module, a main control module, a communication module, a power module and a data storage module. The door magnetic sensor transmits an opening and closing state signal to the main control module, if the electric meter box is subjected to abnormal vibration, the vibration sensor transmits a vibration signal to the main control module, information such as time and personnel of door opening and closing events can be recorded in detail through the identity recognition module, later tracing is facilitated, and if the main control module judges that the door is opened abnormally or vibrates abnormally, the electric meter box is opened abnormally. The communication module sends early warning information to a manager, abnormal door opening and vibration conditions can be found in time, potential safety hazards are reduced, and the manager can check the state of the electric meter box anytime and anywhere through the remote server and the client.

The invention provides an industrial personal computer data security backup method and system based on an encryption algorithm, and the method comprises the steps: obtaining operation parameters of a production process stored by an industrial personal computer, forming original backup data blocks, numbering the original backup data blocks, and obtaining the operation parameters according to a preset time interval; the original data block is encrypted, the time block with the time interval larger than a first preset threshold value is encrypted through a low-intensity encryption algorithm, and the time block with the time interval smaller than or equal to the first preset threshold value is encrypted through a high-intensity encryption algorithm; after encryption, an encrypted data block is formed, security integrity verification information is generated for the encrypted data block, and tampering detection and tracing are realized. Through the method and the corresponding system, an efficient, flexible and safe data backup and monitoring system is realized, data is effectively prevented from being illegally read and tampered, and event tracing and data management are facilitated.

An application-level determination of anomalies in response to issuance of an incident ticket / report. AI including NLP is implemented to decipher the unstructured freeform data in an incident ticket to positively identify the resource event that caused the incident. Once the resource event has been identified, a resource event tracing record associated with the resource event is analyzed to determine one or more anomalies. Analysis of the resource event tracing record may include comparison of the resource event tracing record to other resource event tracing records having one or more similar attributes to determine differences in recorded metrics, which may indicate anomalies. In response to determining the isolated and / or systemic anomalies, an anomaly report that indicates at least a portion of the determined anomalies is generated, and electronic communication is initiated.

This invention discloses a real-time control and management platform for intelligent well firing, relating to the field of well firing control technology. It solves the technical problems of traditional solutions lacking multi-hop communication control between nodes, failing to monitor relay node status in real time, and being unable to dynamically adjust strategies based on real-time data, thus affecting the control effect of the management platform on intelligent well firing. The platform divides the well firing distribution area into multiple zones, with each zone equipped with multi-hop relay nodes, forming a hierarchical transmission path. This solves the problem of limited single-hop communication distance, making it particularly suitable for complex terrains such as mountainous areas and underground environments, expanding coverage through relay hops. Simultaneously, a production mode configuration and full-dimensional status management module enables flexible configuration of production modes, status tracking and visualization of well firing equipment and the entire operation process, operation trajectory playback and event tracing, and quality control management of the firing process, providing comprehensive data support for intelligent firing decision-making and operation process control.

The embodiment of the application provides a kind of program performance bottleneck automatic analysis method and system, it is related to application research and development technical field.The method can respond to the program running instruction input by user, based on target program path, run target program, then according to monitoring parameter setting performance analysis tool data acquisition strategy, and in target program running process, according to data acquisition strategy, monitoring data is obtained from event tracking interface.After target program ends, based on analysis algorithm and monitoring data, calculate key performance parameters, then according to result output mode and key performance parameters, generate structured report.Data acquisition strategy includes the counting object of performance counter and process filtering rule.The method can automatically call event tracking interface to complete performance data acquisition and analysis by user specified analysis rule, and real-time output performance bottleneck analysis result, can reduce the complexity of program performance analysis operation, improve program performance analysis efficiency.

The invention relates to the technical field of natural language processing and text mining, and discloses a dynamic granularity timeline abstract generation method based on multi-agent collaboration and application thereof.The dynamic granularity timeline abstract generation method comprises the steps that firstly, a high-quality text set related to a query theme is screened out from a multi-source heterogeneous text through cooperative work of three kinds of agents including generation, debate and decision; then dynamically dividing the text into a specified number of semantic clusters through cooperation of another group of agents based on granularity parameters specified by a user; generating an event abstract for each cluster; and finally, carrying out fact consistency verification. According to the method, the accuracy and interpretability of information screening and event grouping are improved through a multi-agent debate mechanism, flexible dynamic control over abstract granularity is achieved by introducing granularity parameters, the content reliability is guaranteed through authenticity verification, the capacity of automatically generating reliable and customizable timeline abstracts from complex text streams is improved, and the method is suitable for popularization and application. The method is suitable for multiple scenes such as public opinion analysis, event traceability and decision support.

A method and system for determining, based on event tracing associated with user devices connected to a cellular network, locations of the user devices in indoor environments (hereinafter, indoor locations), for example in order to determine quality of service maps of (e.g., urbanized) indoor environments of a geographic area covered by the cellular network.

The invention belongs to but not limited to the technical field of data processing, and discloses a target positioning and event tracking visualization system and method based on a large language model, and the system comprises a user input processing module which receives unstructured natural language input from a user, extracts the intention of the user, and completes the scheduling of a downstream module and the initialization of a processing flow; the big language model event extraction module based on the RAG is used for fusing the retrieval enhancement generation framework and the big language model and automatically identifying and extracting structured event information from a natural language; the geographical name analysis and space positioning module is used for standardizing geographic information entities in a natural language and accurately mapping the geographic information entities into a geographic coordinate system so as to provide support for space positioning and visualization of subsequent events; the map service and event visual display module consists of two independent services which are respectively responsible for static service of a map tile layer and visual rendering of an event track; the method is used for event position labeling, track visualization and interactive map display.

Mechanisms are provided for generating a holistic view of an event processing pipeline of an event driven architecture. Curation of runtime information from components of an event processing pipeline is performed, where the runtime information comprises real-time runtime metrics, aggregated logs, event tracing / recording data structures, and configuration information. The curated runtime information is correlated to generate correlated runtime data. Predictive models and predictive analytics process the correlated runtime data to predict anomalies in the components of the event processing pipeline. A fault circuit interrupt machine (FCIM) processes the predicted anomalies based on user resiliency configurations to determine recommended event resiliency remediation actions for addressing the predicted anomalies. A real-time holistic view of the components of the event processing pipeline is generated based on the correlated runtime data, the predicted anomalies, and the determined recommended event resiliency remediation actions.

Mechanisms are provided for generating a holistic view of an event processing pipeline of an event driven architecture. Curation of runtime information from components of an event processing pipeline is performed, where the runtime information comprises real-time runtime metrics, aggregated logs, event tracing / recording data structures, and configuration information. The curated runtime information is correlated to generate correlated runtime data. Predictive models and predictive analytics process the correlated runtime data to predict anomalies in the components of the event processing pipeline. A fault circuit interrupt machine (FCIM) processes the predicted anomalies based on user resiliency configurations to determine recommended event resiliency remediation actions for addressing the predicted anomalies. A real-time holistic view of the components of the event processing pipeline is generated based on the correlated runtime data, the predicted anomalies, and the determined recommended event resiliency remediation actions.

The application discloses a system and method for distributed attack process forensics, introduces a user-unaware, distributed active defense model into attack forensics, automatically constructs a high-fidelity and high-density camouflage environment in a network, constructs decoys and luring traps along the way in the network and terminal, actively spreads false messages and polluted data to an attacker, and when the attacker intrudes, issues a forensics strategy and a forensics component in an Agentless mode, realizes distributed and non-invasive dynamic forensics through system kernel event tracking, and makes up for the shortcomings of existing attack forensics.

The invention aims to provide an efficient network security event notification and early warning method and system, a security event subjected to condition screening is used as a data basis of notification and early warning, the event related information is pushed to a corresponding notified end by a notification end, and in the process, the notified event is subjected to double confirmation of the notification end and the notified end, so that the notification and early warning efficiency is improved. The consistency of an event responsibility party and an actual processing party can be ensured, and post-event tracing is facilitated; and meanwhile, a processing marking and state auditing mechanism is provided, so that the execution effect of event early warning notification can be ensured.

The invention discloses a data asset protection method suitable for a financial information platform, and the method comprises the steps: capturing an operation track, carrying out the dynamic control of frequency, carrying out the dynamic protection linkage, carrying out the hierarchical control of character reading, carrying out the data display, and carrying out the afterward tracing, and enabling the overall data safety and traceability of the financial data platform to be improved. A service related party is informed through a notification or mail method, response measures are prepared at the first time, and an access log is associated with a user identity and an encrypted fingerprint to generate an evidence obtaining report; the cross-modal cooperation of dynamic confusion and voiceprint encryption is combined with front-end page dynamic and biological feature encryption, the data acquisition difficulty is doubly improved, and the content and the identity of a leaked person can be synchronously traced when data is leaked by distinguishing manual and machine operations, dynamically adjusting a protection strategy and utilizing virtual identifier-voiceprint dual binding, so that the real-time security of the data is ensured. A dynamic anti-crawler strategy and a multi-mode content encryption technology are adopted, and active protection and afterward traceability tracking of financial text data and audio data are achieved.

The invention provides a risk-driven industrial event credible traceability intelligent method, and relates to the technical field of intelligent event traceability, and the method comprises the steps: carrying out the event preliminary screening through risk perception, and obtaining the risk level of an event; an event identifier is obtained for the event, a deterministic index is established for the event through a layered weighted bloom filter, the layered weighted bloom filter comprises M sub-weighted bloom filters, M is the total number of the risk levels, and the jth sub-weighted bloom filter is endowed with a target false positive rate; obtaining a Hash abstract of an original data snapshot of the event, and obtaining a final root Hash corresponding to the event and a Hash value of an index state snapshot through a Merkel-Parene tree; and the layered weighted Bloom filter is optimized periodically. According to the invention, real-time indexing, risk perception and credible tracing of massive industrial events are realized.

This invention provides an AI-powered emotion monitoring, multi-member access control, and security incident tracing system and method, belonging to the fields of AI emotion recognition and multi-user home security management. The system includes: an AI emotion risk recognition module, which, with user authorization, collects only voice tone and text semantic features, uses local inference to identify high-risk emotions, and sets limits on collection duration and reporting frequency; a multi-scenario heartwarming intervention module, which desensitizes and reports high-risk emotions and automatically matches rescue entities, forming an intervention closed loop; a multi-member access control module, which automatically identifies roles in multiple scenarios, achieving hierarchical access control and self-adaptive differentiated security strategies; a full-scenario security incident collection module; and a desensitized tracing and evidence storage module. Under the premise of privacy compliance, this invention achieves accurate emotion recognition across all scenarios, fine-grained access control, rapid cross-entity rescue, and reliable incident tracing, forming a complete security closed loop of pre-event prevention, in-event intervention, and post-event tracing, applicable to various scenarios.

A computer system includes memory hardware configured to store structured microservice configuration data having multiple microservice entries each associated with one of multiple microservice applications of a request processing architecture. The system includes processor hardware configured to access structured microservice configuration data to identify the microservice applications of the request processing architecture, subscribing to messages transmitted by the identified microservice applications for event monitoring, and receiving multiple messages transmitted by the identified microservice applications. For each of the multiple received messages, the instructions include analyzing one or more fields of the received message to determine a correlation identifier associated with the received message, identifying one of the multiple request data structures, storing an event message entry in the identified request data structure, and transforming a user interface of a user device to display at least a portion of the multiple event message entries.

The invention relates to a security event tracing method and device based on a block chain, equipment, a storage medium and a computer program product. The method comprises the following steps: encrypting log data and storing the encrypted log data in a decentralized block chain network; integrating log data of a plurality of devices and / or a plurality of systems in the block chain network to generate a data view; according to the data view and the log data, safety inspection is executed for a safety event, and whether a safety problem exists or not is judged; in response to the detected security issues, determining a causal relationship between the patrolled security issues, and determining an attack source corresponding to the security issues; and log data in different block chain networks are integrated through a cross-chain technology, and tracing and response are performed on security events of different block chain networks in combination with a preset security event early warning mechanism of a block chain and a preset security event knowledge base based on the block chain. By adopting the method, the safety event patrol and processing efficiency can be improved.

This invention relates to a replay and control method based on event tracing, applicable to event analysis and replay control during simulation. The method includes the following steps: recording key events; event data analysis; dynamic display of key events; replay of simulation status; replay control; key event subscription and push; evaluation result tracing; and simulation data correlation analysis. This invention enhances the user's replay experience. Users can subscribe to specific key events, and the system pushes event results in real time during the simulation. Multi-path analysis is performed under different conditions, and the evaluation results are visualized and traced, helping users comprehensively analyze the impact of key events on the simulation.

The invention discloses a real scene mobile device storage performance self-adaptive evaluation method and device and a medium, and relates to the technical field of storage performance evaluation, and the method comprises the steps: connecting a mobile device through an ADB, and configuring an ftrace subsystem to start block layer I / O event tracking; performing I / O event collection for multiple times when real user operation of the target application is executed; after collection, pulling and analyzing the trace file to extract a plurality of performance indexes; performing quality diagnosis on the trace file and outputting rating; when the rating is qualified, historical baseline data matched with the current test scene information is obtained from a baseline database, and the matching is performed based on a scene identifier and a wildcard character mode; and on the basis of the extracted indexes and the matched base line, single scores of the indexes are calculated by adopting a piecewise linear scoring algorithm, a comprehensive health degree score is obtained after weighted fusion, and a performance grade is determined. The invention provides a mobile equipment storage performance evaluation scheme capable of realizing automation and multi-dimension and supporting cross-version performance comparative analysis based on a real application scene.

The invention discloses a data grid risk analysis system for event tracing. The system comprises a Web content acquisition module used for acquiring Web content from the World Wide Web; the analysis module is used for converting the Web content into a structured information unit containing a source content identifier and calculating an inherent information risk value of the structured information unit; the graph construction module is used for dynamically constructing an information traceability graph according to the structured information unit; and the infection risk analysis module is used for executing reverse tracing of the information spreading path on the information tracing graph. According to the method for extracting the source relation from the unstructured Web content and quantifying the risk, the technical problems of data foundation missing and logic chain breakage during tracing of infection risk information in the Web environment are solved, and reliable and efficient risk judgment tracing is achieved.