3968 results about "Host (network)" patented technology

The invention relates to the technical field of network security, in particular to a network security big data state evaluation method based on pattern recognition, which comprises the following steps of: extracting multi-modal features from a network flow log, a system event log, a host behavior log and threat intelligence data, generating a feature matrix, performing feature dimensionality reduction by adopting an auto-encoding network, and obtaining a network security big data state evaluation result; carrying out attack behavior classification and abnormal mode identification in combination with unsupervised clustering and a graph neural network; constructing an attack transition probability matrix based on a Markov model; forming a time sequence attack chain; predicting an attack development trend; and a dynamic protection instruction is issued to the safety equipment. According to the method, the unknown attack detection capability can be improved, the time sequence attack traceability is enhanced, the security situation assessment is optimized, and the method is suitable for security situation awareness in cloud computing, industrial internet and large-scale network environments.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

The invention relates to the technical field of data processing, can be applied to business scenes such as financial science and technology and medical health, and discloses a self-adaptive data processing optimization method, device and equipment and a medium, and the method comprises the steps: collecting operation data, host performance data, network state data and historical task data of a target data source, and constructing an analysis model in combination with recovery parameters and strategy preference, predicting a task load state, resource consumption and execution duration, generating a task execution strategy, completing task scheduling and execution monitoring, and collecting execution feedback data for iterative optimization of the analysis model. According to the method, an analysis model is constructed by fusing multi-source system data and historical task information, a task execution strategy is generated in combination with a dynamic prediction result and a strategy weight, intelligent task scheduling and process monitoring are realized, and feedback data is used for model iterative optimization. The task execution efficiency is improved, the resource use rationalization is realized, and the model adaptive capability is enhanced.

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

The present disclosure provides technologies and techniques related to enabling access to localized services. The present disclosure provides mechanisms for authentication and authorization for enabling a non-public network (NPN) to act as a hosting network for providing access to localized services. Additionally, the present disclosure provides mechanisms for enabling user equipment (UE) to discover, select and access an NPN acting as a hosting network to receive localized services. Furthermore, the present disclosure provides mechanisms for enabling access to localized services via a specific hosting network.

Disclosed are various embodiments for rate proportional scheduling to reduce packet loss in virtualized network function chains. A congestion monitor executed by a first virtual machine executed by a host computing device can detect congestion in a receive queue associated with a first virtualized network function implemented by a first virtual machine. The congestion monitor can send a pause signal to a rate controller executed by a second virtual machine executed by the host computing device. The rate controller can receive the pause signal. In response, the rate controller can pause the processing of packets by a second virtualized network function implemented by the second virtual machine to reduce congestion in the receive queue of the first virtualized network function.

A method includes scanning a network having a first and second host, obtaining, via the scanning, a first and second type information of the first and second host, respectively, the first or second type information including a device category, obtaining, via the scanning, a first and second scaling factor of the first and second host, respectively, calculating, a first criticality score of the first host based on the first type information and the first scaling factor, calculating a second criticality score of the second host based on the second type information and the second scaling factor, calculating a first host risk score (HRS) for the first host based on the first criticality score, calculating a second HRS for the second host based on the second criticality score, and applying a security patch on the first host prior to the second host first HRS is higher than the second HRS.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

A network environment comprises a plurality of host machines that are communicatively coupled to each other via a network fabric comprising a plurality of switches that in turn include a plurality of ports. Each host machine comprises one or more GPUs that execute customer workloads. Described herein are different approaches that provide for addressing the problem of handling network overlay encapsulation without causing adverse impact to the performance of workloads executed on the GPU clusters.

A computer networking device includes a plurality of ports, a memory, and a computing unit. The computing unit receives source information and destination information for a snapshot from the host; obtains a read-value of a memory area corresponding to the source information in a memory device through a port identified based on mapping information and the source information; and transmit, to a storage device, the read-value based on peer-to-peer communication for a write operation of writing in a memory area corresponding to the destination information in the storage device through a port identified based on the mapping information and the destination information.

Apparatus for data communication includes a network interface for connection to a packet data network and a host interface for connection to a host computer, which includes a central processing unit (CPU) and a host memory. Packet processing circuitry receives, via the host interface, from a kernel running on the CPU, associations between multiple remote direct memory access (RDMA) sessions and multiple different User Datagram Protocol (UDP) 5-tuple, which are assigned respectively to the RDMA sessions, and receives from an application running on the CPU a request to send an RDMA message, using a selected group of one or more of the RDMA sessions, to a peer application over the packet data network, and in response to the request, transmits, via the network interface, one or more data packets using a UDP 5-tuple that is assigned to one of the RDMA sessions in the selected group.

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

The invention discloses a solid state disk management system and a data processing method, and relates to the technical field of solid state disk management. Flexible task scheduling and resource management are provided through a lightweight operating system module, and a computing task program defined by a user is supported to be dynamically loaded; edge computing or machine learning operators are efficiently executed in combination with a programmable hardware processing unit and a DMA channel of the computing acceleration engine module, the data preloading module is utilized to predict and preload data to DDR based on LBA access history, access delay is reduced, an NVMe protocol is expanded by means of the task unloading interface module, host task issuing and result returning are achieved, and the data processing efficiency is improved. And hardware-level memory protection is ensured through the security isolation module, so that the data calculation processing capacity of the solid state disk is remarkably improved, localized calculation tasks such as edge calculation and machine learning are supported, mass data transmission is effectively reduced, and bus and network loads are relieved.

Method and apparatus for protecting computer resources from malicious attack including baseline sentinels and warrior sentinels. Baseline sentinels are deployed on a network serving only as decoys and containing no company data. When any attempt to communicate with a baseline sentinel is detected, a host of warrior sentinels (also containing no company data) are deployed to act as additional decoys, diminishing the chance that a malicious attack will reach a valuable computer resource and collecting information on the malicious attacker. Once the malicious attack stops or is defeated, the warrior sentinels are retired and the system resets to baseline sentinels.

A method includes scanning a plurality of hosts in a network to obtain risk information of each instance of vulnerability associated with each host during a period, calculating a vulnerability risk score (VRS) for each instance of the vulnerability based on the associated risk information, determining a number of vulnerabilities associated with each of the plurality of hosts during the period, obtaining a criticality score of each of the plurality of hosts, obtaining for each host, a representative VRS based at least in part on the VRS for each instance of vulnerability associated with the host, calculating a host risk score (HRS) for each host based on the representative VRS, the number of vulnerabilities and the criticality score of the host, calculating a network risk score (NRS) for the network based on the HRSs, and facilitating a security action based on the HRS for each host and the NRS.

Techniques for managing cloud computing resources hosting burstable performance instances are described. A host computer system of a provider network executes burstable performance compute instances. Compute capacity usage data is obtained from the host computer system, the compute capacity usage data including a first indication of a first compute capacity used by a first burstable performance compute instance. A first weight for the first burstable performance compute instance is calculated, the first weight being inversely related to the first compute capacity. A scheduler of the host computer system is updated with process prioritization weights, the process prioritization weights including a first process prioritization weight that is based at least in part on the first weight. The scheduler allocates compute capacity based on the process prioritization weights.

The invention relates to a memory expansion system, method and device. The memory expansion system comprises a plurality of memory modules; the host module is used for accessing the memory module according to system operation requirements; the signal switching modules and the memory modules are arranged in a one-to-one correspondence manner, and the signal switching modules are used for establishing access links between the host module and the memory modules, so that the host module accesses the memory modules; the interconnection control module is connected with the host module and the signal switching module, and the interconnection control module is used for determining a current interconnection topology network between the host module and the signal switching module and a current bandwidth of the host module; and the memory module is used for monitoring the real-time required bandwidth of the host module in real time and gating the signal switching module connected with the host module based on the current bandwidth and the real-time required bandwidth so as to redistribute access to the host module. Compared with the prior art, the running memory distributed on each host module can be dynamically adjusted in real time.

The invention relates to the technical field of network security, in particular to a network security situation real-time monitoring method and system. The method comprises the following steps: acquiring virtual machine running state data and physical host deployment data, and performing distributed probe deployment in a cloud computing environment according to the virtual machine running state data and the physical host deployment data to obtain monitoring probe data, wherein the monitoring probe data comprises lightweight virtual machine probe data, physical host monitoring probe data and network flow probe data; according to the monitoring probe data, performing global identification mapping on the corresponding relationship between the virtual machine and the physical host so as to obtain identification mapping data; obtaining tenant security data; and performing streaming hierarchical processing on the tenant security data according to the identifier mapping data to obtain tenant isolation data. Through the design of the distributed probe, a virtual machine, a physical host and network flow are covered, comprehensive data can be collected in real time, and a monitoring blind area is eliminated.

The invention discloses a self-adaptive dynamic interface generation method and system based on a computing power host operation and maintenance platform, and relates to the technical field of operation and maintenance interface dynamic optimization. Aiming at the problem of static stiffness of an operation and maintenance interface in a complex scene, the scheme is adopted as follows: collecting user behaviors, a context environment and equipment data, and fusing into a multi-dimensional state vector; inputting the multi-dimensional state vector into a deep reinforcement learning model, and generating a dynamic interface strategy including layout component dynamic arrangement and function button priority ranking; designing a hierarchical multi-target reward function fusing operation efficiency reward, accuracy reward and cognitive load penalty, and performing strategy optimization; analyzing the optimized dynamic interface strategy through the cross-terminal rendering capability of the WebXR engine, and generating a front-end page adaptive to the current terminal; and continuously feeding back the collected data to the deep reinforcement learning model, and updating the network weight through a strategy gradient algorithm to realize user preference migration. According to the method and the device, cross-terminal self-adaptive dynamic interface generation can be realized.

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

Load aware routing is performed for requests to managed network endpoints for heterogeneous machine learning models. A request to generate an inference is received via a managed network endpoint that invokes a specified machine learning model. Workloads of the different hosts for respective replicas of the machine learning model are evaluated to select one of the hosts to perform the request.

The invention belongs to the technical field of artificial intelligence and high-performance computing, and particularly relates to a neural network large model efficient reasoning method based on multiple GPGPUs. The method aims to solve the problems of high communication overhead, non-uniform load, low resource utilization rate, high data transmission delay and the like among multiple processors. Dividing a calculation task into a plurality of sub-graphs through static analysis and mixed granularity partitioning of a model calculation graph; distributing the sub-graphs to the optimal GPGPU based on a weighted cost function in combination with heterogeneous resource perception and a dynamic mapping strategy; a global pipeline scheduling plan is constructed by using communication topology perception, and calculation and communication overlap are maximized; data are loaded in advance through a host side hierarchical caching and asynchronous prefetching mechanism, and transmission delay is hidden; multi-stream concurrent execution and event-based lightweight synchronization are adopted on each GPGPU, so that waiting overhead is reduced. According to the method, the reasoning delay can be remarkably reduced, the throughput and the hardware utilization rate are improved, and the method has good adaptivity and expandability.

The invention relates to a message uploading method, a data processing unit and a network processor, and the method comprises the steps: obtaining the number of messages currently cached in the data processing unit in a target queue, so as to determine the number of descriptors to be read, obtaining the descriptors in batches through one PCIe reading operation, and sending the descriptors to the target queue; the messages of the currently cached target queue are written into host side caches pointed by the descriptors, and every time one message is successfully uploaded, one is subtracted from the message count of the currently cached target queue; and if the currently read descriptor is used up, but the target queue has unprocessed messages, repeating the above steps, determining and reading the required descriptor according to the number of the remaining messages of the currently cached target queue again, continuing to write the messages, and repeating the above steps. And all the messages of the currently cached target queue are successfully carried to the host side for caching. According to the method and the device, the message uploading efficiency and the bandwidth utilization rate are improved by optimizing the descriptor reading mode.

The invention provides a multi-host system and a cross-domain access method. The system comprises a structure manager and at least two host domains, the structure manager is used for discovering and managing a topological structure of the multi-host system, distributing segment serial numbers for hosts and distributing port identification numbers for host edge switches, edge ports and downstream edge switches; the structure manager obtains equipment information of the terminal equipment and sends the equipment information to the host; the host sends a request message to the terminal equipment through the host edge switch via the port-based routing switching network; the downstream edge switch establishes an association relationship between a segment serial number and a port identification number carried in the request message, and maps a physical address of a host needing cross-domain to a physical address of a host subjected to cross-domain; and the downstream edge switch receives the completion message, determines a port identification number corresponding to the segment serial number carried in the completion message based on the association relationship, carries the port identification number in the completion message as a destination end identifier, and sends the port identification number to a corresponding host.

The invention discloses a test method of a storage link, electronic equipment, a storage medium and a program product, and relates to the technical field of storage networks, and the test method comprises the following steps: initializing a plurality of controller nodes in a storage server to form one or more controller groups, and networking the controller groups to a storage cluster; configuring a switch partition matched with the current state of the port virtualization function of the controller group; verifying a routing path between the host and the storage cluster according to a first mapping relationship between the physical port and the virtual port, the current state and the switch partition; the routing path comprises a second mapping relation between the host and the physical port and a third mapping relation between the host and the virtual port, namely, the storage link between the host and the storage cluster can be tested. The technical problems that virtual port management is complex and manual configuration is prone to errors are solved, and the technical effects that the test coverage rate and efficiency are improved, and the system reliability and flexibility are enhanced are achieved.

The present application relates to the technical field of chip verification, and relates to a software and hardware collaborative simulation verification platform for accelerating verification and positioning of a smart network interface card chip. The platform comprises: a host side QEMU virtual machine, which simulates a hardware device, sends an IO request, responds to the IO request, and calls a device driving program to implement driving execution of a host side hardware device; a host side thread adapter, which converts a multi-thread processing program of the host side QEMU virtual machine into a single-thread processing program; an UVM verification platform, which performs simulation reproduction of FPGA prototype verification of the smart network interface card chip to generate a simulation waveform and a simulation log; a network side data stream adapter, which performs data type conversion on an Ethernet message; and a network side data packet transceiver, which performs message legitimacy check on the Ethernet message returned by the network side data stream adapter. The platform of the present application can improve the problem positioning speed and the chip verification efficiency, shorten the overall chip development period, and improve the chip quality.

Mobile management method, system and client. The method includes receiving a DNS query for a host name from an application on a client; retrieving reputation data associated with the host name from a local cache on the client; determining a policy for the host name, which is associated with the host name and the reputation data associated with the host name; based on the determined policy for the host name, blocking attempted network flows to a host corresponding to the host name; sending at least attempted network flow metadata related to the blocked attempted network flows to a collector on the client; and transmitting the attempted network flow metadata in the collector to a VPN server pool via a VPN tunnel.

The invention provides a communication method, device and system, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: receiving an Ethernet data frame sent by a first host connected with a first network device, wherein the Ethernet data frame comprises a source MAC address and a destination MAC address; determining a virtual Ethernet identifier and a target site mapping prefix corresponding to the target MAC address according to a preset address mapping relationship; generating an IPv6 message header according to the virtual Ethernet identifier, the target site mapping prefix and the target MAC address, and packaging the Ethernet data frame according to the IPv6 message header to obtain an IPv6 message; and sending the IPv6 message to a second network device, decapsulating the IPv6 message by the second network device to obtain an Ethernet data frame, and sending the Ethernet data frame to a second host connected to the second network device. The present disclosure can reduce overhead and improve system security.

The invention provides a honey array defense resource allocation optimization method based on self-game reinforcement learning, and relates to the technical field of network security defense. The optimization method comprises the following steps: deploying defense resources based on network topology, and establishing a mapping relationship between a host and the defense resources; performing attack and defense confrontation simulation based on the mapping relation to obtain an initial attack strategy and an initial defense strategy; constructing a Markov game model based on the initial attack strategy and the initial defense strategy; performing self-game reinforcement learning on attack and defense training of the Markov game model based on a depth deterministic strategy gradient algorithm; and carrying out value evaluation on the attack and defense training based on an Actor-Critic algorithm to obtain an optimal defense resource allocation strategy. By implementing the optimization method provided by the invention, the defense party and the attack party can perform self-game reinforcement learning, the defense strategy is dynamically adjusted in confrontation, and the defense effect is improved.