3125 results about "Host (network)" patented technology

The invention relates to the technical field of network security, in particular to a network security big data state evaluation method based on pattern recognition, which comprises the following steps of: extracting multi-modal features from a network flow log, a system event log, a host behavior log and threat intelligence data, generating a feature matrix, performing feature dimensionality reduction by adopting an auto-encoding network, and obtaining a network security big data state evaluation result; carrying out attack behavior classification and abnormal mode identification in combination with unsupervised clustering and a graph neural network; constructing an attack transition probability matrix based on a Markov model; forming a time sequence attack chain; predicting an attack development trend; and a dynamic protection instruction is issued to the safety equipment. According to the method, the unknown attack detection capability can be improved, the time sequence attack traceability is enhanced, the security situation assessment is optimized, and the method is suitable for security situation awareness in cloud computing, industrial internet and large-scale network environments.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention relates to the technical field of data processing, can be applied to business scenes such as financial science and technology and medical health, and discloses a self-adaptive data processing optimization method, device and equipment and a medium, and the method comprises the steps: collecting operation data, host performance data, network state data and historical task data of a target data source, and constructing an analysis model in combination with recovery parameters and strategy preference, predicting a task load state, resource consumption and execution duration, generating a task execution strategy, completing task scheduling and execution monitoring, and collecting execution feedback data for iterative optimization of the analysis model. According to the method, an analysis model is constructed by fusing multi-source system data and historical task information, a task execution strategy is generated in combination with a dynamic prediction result and a strategy weight, intelligent task scheduling and process monitoring are realized, and feedback data is used for model iterative optimization. The task execution efficiency is improved, the resource use rationalization is realized, and the model adaptive capability is enhanced.

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

The invention discloses a solid state disk management system and a data processing method, and relates to the technical field of solid state disk management. Flexible task scheduling and resource management are provided through a lightweight operating system module, and a computing task program defined by a user is supported to be dynamically loaded; edge computing or machine learning operators are efficiently executed in combination with a programmable hardware processing unit and a DMA channel of the computing acceleration engine module, the data preloading module is utilized to predict and preload data to DDR based on LBA access history, access delay is reduced, an NVMe protocol is expanded by means of the task unloading interface module, host task issuing and result returning are achieved, and the data processing efficiency is improved. And hardware-level memory protection is ensured through the security isolation module, so that the data calculation processing capacity of the solid state disk is remarkably improved, localized calculation tasks such as edge calculation and machine learning are supported, mass data transmission is effectively reduced, and bus and network loads are relieved.

Method and apparatus for protecting computer resources from malicious attack including baseline sentinels and warrior sentinels. Baseline sentinels are deployed on a network serving only as decoys and containing no company data. When any attempt to communicate with a baseline sentinel is detected, a host of warrior sentinels (also containing no company data) are deployed to act as additional decoys, diminishing the chance that a malicious attack will reach a valuable computer resource and collecting information on the malicious attacker. Once the malicious attack stops or is defeated, the warrior sentinels are retired and the system resets to baseline sentinels.

Techniques for managing cloud computing resources hosting burstable performance instances are described. A host computer system of a provider network executes burstable performance compute instances. Compute capacity usage data is obtained from the host computer system, the compute capacity usage data including a first indication of a first compute capacity used by a first burstable performance compute instance. A first weight for the first burstable performance compute instance is calculated, the first weight being inversely related to the first compute capacity. A scheduler of the host computer system is updated with process prioritization weights, the process prioritization weights including a first process prioritization weight that is based at least in part on the first weight. The scheduler allocates compute capacity based on the process prioritization weights.

The invention relates to the technical field of network security, in particular to a network security situation real-time monitoring method and system. The method comprises the following steps: acquiring virtual machine running state data and physical host deployment data, and performing distributed probe deployment in a cloud computing environment according to the virtual machine running state data and the physical host deployment data to obtain monitoring probe data, wherein the monitoring probe data comprises lightweight virtual machine probe data, physical host monitoring probe data and network flow probe data; according to the monitoring probe data, performing global identification mapping on the corresponding relationship between the virtual machine and the physical host so as to obtain identification mapping data; obtaining tenant security data; and performing streaming hierarchical processing on the tenant security data according to the identifier mapping data to obtain tenant isolation data. Through the design of the distributed probe, a virtual machine, a physical host and network flow are covered, comprehensive data can be collected in real time, and a monitoring blind area is eliminated.

The invention discloses a self-adaptive dynamic interface generation method and system based on a computing power host operation and maintenance platform, and relates to the technical field of operation and maintenance interface dynamic optimization. Aiming at the problem of static stiffness of an operation and maintenance interface in a complex scene, the scheme is adopted as follows: collecting user behaviors, a context environment and equipment data, and fusing into a multi-dimensional state vector; inputting the multi-dimensional state vector into a deep reinforcement learning model, and generating a dynamic interface strategy including layout component dynamic arrangement and function button priority ranking; designing a hierarchical multi-target reward function fusing operation efficiency reward, accuracy reward and cognitive load penalty, and performing strategy optimization; analyzing the optimized dynamic interface strategy through the cross-terminal rendering capability of the WebXR engine, and generating a front-end page adaptive to the current terminal; and continuously feeding back the collected data to the deep reinforcement learning model, and updating the network weight through a strategy gradient algorithm to realize user preference migration. According to the method and the device, cross-terminal self-adaptive dynamic interface generation can be realized.

The invention belongs to the technical field of artificial intelligence and high-performance computing, and particularly relates to a neural network large model efficient reasoning method based on multiple GPGPUs. The method aims to solve the problems of high communication overhead, non-uniform load, low resource utilization rate, high data transmission delay and the like among multiple processors. Dividing a calculation task into a plurality of sub-graphs through static analysis and mixed granularity partitioning of a model calculation graph; distributing the sub-graphs to the optimal GPGPU based on a weighted cost function in combination with heterogeneous resource perception and a dynamic mapping strategy; a global pipeline scheduling plan is constructed by using communication topology perception, and calculation and communication overlap are maximized; data are loaded in advance through a host side hierarchical caching and asynchronous prefetching mechanism, and transmission delay is hidden; multi-stream concurrent execution and event-based lightweight synchronization are adopted on each GPGPU, so that waiting overhead is reduced. According to the method, the reasoning delay can be remarkably reduced, the throughput and the hardware utilization rate are improved, and the method has good adaptivity and expandability.

The invention relates to a message uploading method, a data processing unit and a network processor, and the method comprises the steps: obtaining the number of messages currently cached in the data processing unit in a target queue, so as to determine the number of descriptors to be read, obtaining the descriptors in batches through one PCIe reading operation, and sending the descriptors to the target queue; the messages of the currently cached target queue are written into host side caches pointed by the descriptors, and every time one message is successfully uploaded, one is subtracted from the message count of the currently cached target queue; and if the currently read descriptor is used up, but the target queue has unprocessed messages, repeating the above steps, determining and reading the required descriptor according to the number of the remaining messages of the currently cached target queue again, continuing to write the messages, and repeating the above steps. And all the messages of the currently cached target queue are successfully carried to the host side for caching. According to the method and the device, the message uploading efficiency and the bandwidth utilization rate are improved by optimizing the descriptor reading mode.

The present application relates to the technical field of chip verification, and relates to a software and hardware collaborative simulation verification platform for accelerating verification and positioning of a smart network interface card chip. The platform comprises: a host side QEMU virtual machine, which simulates a hardware device, sends an IO request, responds to the IO request, and calls a device driving program to implement driving execution of a host side hardware device; a host side thread adapter, which converts a multi-thread processing program of the host side QEMU virtual machine into a single-thread processing program; an UVM verification platform, which performs simulation reproduction of FPGA prototype verification of the smart network interface card chip to generate a simulation waveform and a simulation log; a network side data stream adapter, which performs data type conversion on an Ethernet message; and a network side data packet transceiver, which performs message legitimacy check on the Ethernet message returned by the network side data stream adapter. The platform of the present application can improve the problem positioning speed and the chip verification efficiency, shorten the overall chip development period, and improve the chip quality.

Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a static sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the static sidecar node. The static sidecar node can receive bootstrapping data from the host data center and store the bootstrapping data. The bootstrapping data can include software resources for provisioning services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Technologies for configuring multiple virtual bridges and interface mappings in a Service Function Chaining (SFC) architecture are described. A DPU can include memory to store a configuration file specifying the virtual bridges and interface mappings, and a processing device operatively coupled to the memory. The processing device, according to the configuration file, generates a first virtual bridge and a second virtual bridge. The first virtual bridge is controlled by a first network service hosted on the DPU, and the second virtual bridge is controlled by a user-defined logic. The processing device adds add one or more host interfaces to the second virtual bridge, a first service interface to the first virtual bridge to operatively couple to the first network service, and one or more virtual ports between the first virtual bridge and the second virtual bridge.

The invention discloses a cloud platform resource load prediction method based on a self-adaptive multi-scale patch network, and belongs to the technical field of cloud computing, and the method comprises the steps: collecting resource load condition data of each host in a cloud computing platform cluster, carrying out the normalization processing of the resource load condition data, converting the data into a supervised learning problem, and obtaining a time sequence sample; performing down-sampling on the time sequence sample to obtain a multi-scale sequence; extracting periodicity and tendency characteristics of each scale sequence of the multi-scale sequence by using fast Fourier transform, aggregating the periodicity characteristics from top to bottom and aggregating the tendency characteristics from bottom to top through a multi-layer perceptron to obtain a multi-scale characteristic sequence; modeling the multi-scale feature sequence by using a bidependency interactor, and fusing multi-scale features to obtain a multi-scale fused feature sequence; and performing scoring and adaptive weighted aggregation on the multi-scale fusion feature sequence by using an adaptive weighted prediction module to obtain a prediction result of the resource load.

The invention discloses an efficient data compression and transmission method based on a computing power host management operation platform, and relates to a large-scale data concurrent management technology. Comprising the steps of 1, integrating a lightweight data feature analyzer at a Kafka producer end, extracting feature indexes of data streams in real time through the data feature analyzer, and generating compression strategy parameters according to the feature indexes, and 2, performing feature recognition on structured data and unstructured data, extracting data features, and generating compression strategy parameters according to the compression strategy parameters. And step 3, based on data characteristics, CPU load of producers / consumers and network bandwidth prediction, constructing a multi-objective optimization model, dynamically selecting a compression algorithm and a compression level, selecting compression strategy parameters according to the compression algorithm, introducing a compression income ratio index, calculating a ratio of compression rate increase to compression time consumption, and performing compression strategy optimization. And preferentially selecting a compression algorithm with a high gain ratio to perform data compression and transmission.

Dynamic provisioning of resources in a datacenter improves the utilization efficiency of compute, memory, storage, and network resources, while maintaining flexibility to meet changing demands. Embodiments herein disclose protocol-aware provisioning of resources over Compute Express Link (CXL) fabrics, enabling multi-protocol pooling and disaggregation of resources, including memory and workload-specific accelerators such as GPUs and DSAs. In some embodiments, a Resource Provisioning Unit (RPU) facilitates intent-based protocol translations and mappings between address spaces, potentially enabling the creation of large-scale compute-memory fabrics that may utilize both coherent and non-coherent Non-Transparent Bridging (NTB) between multiple protocols in a single system, serving as the underlying infrastructure for executing workloads such as Large-Language Models (LLMs) and Deep Learning Recommendation Models (DLRMs). Some embodiments also optimize low-latency communication between processes running on different nodes by enabling host-to-host memory provisioning for libraries such as OpenMP, Pthreads, or CUDA, which can utilize shared memory.

According to one embodiment, host infrastructure analysis logic that attempts to detect a malicious host operating within a network prior to a cyber-attack being conducted by the malicious host is described. The host infrastructure analysis logic includes querying logic, profile confirmation logic, classification logic and reporting logic. The querying logic retrieves salient characteristics associated with a plurality of hosts operating within the network and determines whether any hosts are suspicious. The profile confirmation logic, if a suspicious host is detected, establishes communications with that suspicious host to retrieve additional context information. The classification logic, based on the retrieved information, determines whether the suspicious host is malicious, prior to and without reliance on information associated with a cyber-attack being conducted by that host. The reporting logic outputs analytic results identifying at least the suspicious host is operating as a malicious host.

Techniques for host fleet management in a cloud provider network are described. Forecast data including a forecasted demand for virtual machines in each capacity pool of a set of capacity pools is obtained. A mathematical optimizer application is executed to generate a first optimal fleet plan, the mathematical optimizer application having an objective function to minimize a number of new host computer systems to add to the set of host computer systems to satisfy the forecasted demand for each capacity pool, the first optimal fleet plan includes an identification of a set of hardware types and, for each hardware type in the set, a quantity of new host computer systems of the hardware type. A plurality of new host computer systems is deployed, based on the first optimal fleet plan, for a hardware type in the set of hardware types into the set of host computer systems.

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.

The invention provides an efficient multi-dimensional network penetration testing method based on RAG, which comprises the following steps: firstly, identifying sub-domain names possibly existing in a target website, and sequentially expanding attack surfaces of penetration testing to obtain vulnerability information pairs; secondly, a design model generated based on retrieval enhancement is adopted, vulnerability information pairs are extracted from the queue to be utilized, knowledge items related to local knowledge base retrieval and network intelligent search retrieval are utilized, and finally, a large model generates vulnerability utilization information according to the knowledge items; acquiring target machine permission for the previously acquired vulnerability information pair construction command injector, and further scanning other hosts of the intranet accessed by the target skipping machine; finally, combining vulnerability information obtained by penetration testing, utilizing a large model to sort vulnerabilities existing in different assets, and outputting penetration testing reports for different assets. According to the method and the system, comprehensive penetration testing of cross-network and cross-system is realized, security experts are helped to quickly identify, verify and repair vulnerabilities in a complex and changeable network environment, and high-efficiency and low-cost network security maintenance is realized.

Disclosed is a sharing system based on multiple device nodes. The sharing system comprises: a host and a storage system, and host and each device node each are configured with a shared network card; where each device node comprises: a storage network device, where storage network device is configured to control a local device node to broadcast interconnection information to another device node in storage system, and establish, based on response information received by local device node, preset connection between local device node and a target device node; a lossless network device, where lossless network device is configured to manage a network environment of storage system; and a management device, where management device is configured to synchronize node data of local device node from shared network card to a shared network card of target device node, and manage preset connection between local device node and target device node.

A network interface module for coupling a host device to a switched network as a network node is described. The network interface module comprises a single half-duplex port for communicatively coupling to a shared bus of the switched network, at least one frame queue sized to store one multicast read frame received via the shared bus, and logic circuitry. The logic circuitry is configured to decode a read command for the interface module included in a payload of the multicast read frame that includes multiple read commands for other network nodes of the switched network, and transmit a response frame including read data on the shared bus when detecting the shared bus is available for transmitting.

The invention belongs to the field of underwater acoustic networks, and relates to underwater Internet of Things, underwater environment monitoring, resource development and marine ecological protection. In order to provide an overall architecture of a simulation platform and an implementation technology of a core module of the overall architecture, and further enhance the simulation capability of an underlying protocol and a physical channel on the basis of being compatible with a standard network protocol stack and supporting seamless deployment of an existing application program, the invention provides an underwater Internet of Things semi-physical simulation system based on a container. Comprising a terminal host, a gateway node with underwater sound and wired network communication capabilities, and a plurality of real nodes which can be deployed underwater and have underwater sound communication capabilities, and an MAC simulation module and a channel simulation module are deployed on the terminal host and are used for constructing a simulation environment; and the semi-physical simulation interfaces are simultaneously deployed on the terminal host and the gateway node, so that traffic mapping in a simulation environment of the gateway node and the terminal host is realized. The method is mainly applied to design and manufacturing occasions of an underwater Internet of Things simulation system.

The invention relates to a data storage method, system and device, a chip, a network interface card, equipment, a medium and a program product. The method comprises the following steps: receiving a data packet write-in request, wherein the data packet write-in request is triggered by a storage management module on a host through a memory write operation driven by a virtual storage device; triggering PCIE multicast data packet processing based on the data packet write-in request; and under the condition that a PCIE multicast data packet processing result is multicast hit, the data packet is pushed to a plurality of target ports of the PCIE switch, each target port is connected with a virtual storage device located in a data processing unit, and the virtual storage device is used for writing the data packet into a corresponding memory. The method can improve the overall performance of the system.

The invention relates to the technical field of dynamic honey point evolution, in particular to a dynamic honey point evolution method and system based on behavior fingerprint fusion, and the method comprises the following steps: S1, deploying a plurality of honey point nodes and monitoring probes for collecting behavior information in a plurality of data sources, such as network traffic, host logs and user sessions, the behavior fingerprint acquisition module performs preprocessing and feature extraction on the data, and constructs a graph structure representing network entity and activity association; s2, then, a GNN fusion engine module carries out training and reasoning on the association graph based on a graph neural network, and potential threat feature values of network nodes or user behaviors are extracted; and the finally output fusion result can reflect an attack link and an attacker behavior mode which possibly exist in the current network environment. According to the method, network behavior fingerprints are extracted from multi-source data, association fusion analysis is performed by using a graph neural network, and honey spot deployment and dynamic function evolution are realized.

The invention provides a heterogeneous event association representation model construction method, system and device based on attack stage semantic alignment, and the method comprises the following steps: extracting six-tuple features from an obtained inter-host connection log, and obtaining inter-host alarm log data with unified representation; constructing an abnormal log fragment sequence between the hosts based on the alarm log data between the hosts; mapping the inter-host abnormal log fragment sequence to obtain an inter-host attack stage; eight-tuple features are extracted from the obtained operation logs in the hosts, and operation log data, represented in a unified mode, in the hosts are obtained; constructing a sensitive behavior log fragment sequence in the host based on the operation log data in the host; mapping the sensitive behavior log fragment mapping in the host to obtain an attack stage in the host; on the basis of semantic alignment of heterogeneous security events, associating an inter-host attack stage with an in-host attack stage according to topological features, and constructing a heterogeneous event association representation model; according to the method, an observation blind area existing in a single log source can be effectively overcome, network behaviors such as network scanning and vulnerability utilization and activities in a host such as script execution and permission promotion can be captured at the same time, and therefore more comprehensive and more complete restoration of the multi-step attack process is achieved.

The invention provides an external equipment security sharing system between internal and external network equipment. The external equipment security sharing system comprises a control signal processor used for securely transmitting a control instruction of external HID equipment between the equipment; the control signal processor is respectively connected with an external computer host connected to an external network and an internal computer host connected to an internal network and isolated from the external network, and a control instruction of external HID equipment received by the external computer host is safely transmitted to the internal computer host through the control signal processor; and hardware isolation, protocol conversion, data encryption and watermark addition are adopted, so that the data security of an internal computer host is ensured. The data security of the internal computer host can be effectively ensured while the internal computer host and the external computer host share the external equipment.

The invention is suitable for the technical field of inverters, and provides a parallel control method for inverters, which comprises the following steps: after a plurality of inverters are powered on and a parallel operation task is started, acquiring a time base counting register EPWM count value and a real-time clock RTC time value in the plurality of inverters; and then, based on the EPWM count value and the RTC time value, determining a controller area network (CAN) communication expansion frame of each inverter. And then, according to the CAN communication expansion frame of each inverter, determining a host inverter and a plurality of slave inverters from the plurality of inverters, and allocating CAN communication addresses to the plurality of slave inverters through the host inverter. According to the method, the master-slave relationship of the inverter is determined, and the CAN communication address is automatically allocated, so that the complexity of manually allocating the addresses of the master and the slave is avoided, and the conflict of the communication address is effectively reduced.

The invention relates to a data packet receiving method, a data processing unit, a host and a network card, and the method comprises the steps: when a data packet needs to be received, the host prepares an idle cache unit and generates a first cache descriptor, when the data processing unit receives the data packet (a small network packet), the data packet is written into a local cache unit according to a cache line alignment principle to form an aggregated data packet, and the aggregated data packet is sent to the host; the aggregated data packet is written into a host side cache unit according to the first cache descriptor, a completion descriptor is sent to a host, and the host can analyze the aggregated data packet according to the content of the completion descriptor to obtain each network packet. According to the method and the device, a plurality of small network packets are aggregated into a relatively large aggregated data packet, so that on the basis of being compatible with the existing Virtio protocol, PCIe write-in times are reduced, the bandwidth utilization rate is improved, occupation of a cache unit is reduced, and the resource utilization rate is improved.