5613 results about "Host (network)" patented technology

The invention relates to the technical field of network security, in particular to a network security big data state evaluation method based on pattern recognition, which comprises the following steps of: extracting multi-modal features from a network flow log, a system event log, a host behavior log and threat intelligence data, generating a feature matrix, performing feature dimensionality reduction by adopting an auto-encoding network, and obtaining a network security big data state evaluation result; carrying out attack behavior classification and abnormal mode identification in combination with unsupervised clustering and a graph neural network; constructing an attack transition probability matrix based on a Markov model; forming a time sequence attack chain; predicting an attack development trend; and a dynamic protection instruction is issued to the safety equipment. According to the method, the unknown attack detection capability can be improved, the time sequence attack traceability is enhanced, the security situation assessment is optimized, and the method is suitable for security situation awareness in cloud computing, industrial internet and large-scale network environments.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

An anomaly detection system is disclosed capable of reporting anomalous processes or hosts in a computer network using machine learning models trained using unsupervised training techniques. In embodiments, the system assigns observed processes to a set of process categories based on the file system path of the program executed by the process. The system extracts a feature vector for each process or host from the observation records and applies the machine learning models to the feature vectors to determine an outlier metric each process or host. The processes or hosts with the highest outlier metrics are reported as detected anomalies to be further examined by security analysts. In embodiments, the machine learnings models may be periodically retrained based on new observation records using unsupervised machine learning techniques. Accordingly, the system allows the models to learn from newly observed data without requiring the new data to be manually labeled by humans.

Systems for providing multi-access edge computing (MEC) and content delivery. At least one cloud platform and at least one server node are provided. Hypertext Transfer Protocol (HTTP) requests are operable to be send between the at least one cloud platform and at least one edge device. The at least one server node is registered in a cloud platform global registry using an HTTP POST request to a global service address, and the cloud platform global registry is associated with the at least one cloud platform. The at least one server node is operable to create at least one cellular network and provide cellular network services to the at least one edge device. The present invention is also operable to collect and analyze data from an IoT sensor network and take actions based on sensor data using the same node infrastructure and edge computing platform.

The invention relates to the technical field of data processing, can be applied to business scenes such as financial science and technology and medical health, and discloses a self-adaptive data processing optimization method, device and equipment and a medium, and the method comprises the steps: collecting operation data, host performance data, network state data and historical task data of a target data source, and constructing an analysis model in combination with recovery parameters and strategy preference, predicting a task load state, resource consumption and execution duration, generating a task execution strategy, completing task scheduling and execution monitoring, and collecting execution feedback data for iterative optimization of the analysis model. According to the method, an analysis model is constructed by fusing multi-source system data and historical task information, a task execution strategy is generated in combination with a dynamic prediction result and a strategy weight, intelligent task scheduling and process monitoring are realized, and feedback data is used for model iterative optimization. The task execution efficiency is improved, the resource use rationalization is realized, and the model adaptive capability is enhanced.

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

The present disclosure provides technologies and techniques related to enabling access to localized services. The present disclosure provides mechanisms for authentication and authorization for enabling a non-public network (NPN) to act as a hosting network for providing access to localized services. Additionally, the present disclosure provides mechanisms for enabling user equipment (UE) to discover, select and access an NPN acting as a hosting network to receive localized services. Furthermore, the present disclosure provides mechanisms for enabling access to localized services via a specific hosting network.

Disclosed are various embodiments for rate proportional scheduling to reduce packet loss in virtualized network function chains. A congestion monitor executed by a first virtual machine executed by a host computing device can detect congestion in a receive queue associated with a first virtualized network function implemented by a first virtual machine. The congestion monitor can send a pause signal to a rate controller executed by a second virtual machine executed by the host computing device. The rate controller can receive the pause signal. In response, the rate controller can pause the processing of packets by a second virtualized network function implemented by the second virtual machine to reduce congestion in the receive queue of the first virtualized network function.

A method includes scanning a network having a first and second host, obtaining, via the scanning, a first and second type information of the first and second host, respectively, the first or second type information including a device category, obtaining, via the scanning, a first and second scaling factor of the first and second host, respectively, calculating, a first criticality score of the first host based on the first type information and the first scaling factor, calculating a second criticality score of the second host based on the second type information and the second scaling factor, calculating a first host risk score (HRS) for the first host based on the first criticality score, calculating a second HRS for the second host based on the second criticality score, and applying a security patch on the first host prior to the second host first HRS is higher than the second HRS.

The invention belongs to the field of PCIe Switch interconnection, and relates to a GPU cross-host communication interconnection system based on PCIe NTB, which comprises two hosts, two GPUs and two PCIe Switch chips, the two GPUs are respectively connected with the PCIe Switch chips, the two PCIe Switch chips are connected through a Crosslink line, a connection port of each PCIe Switch chip is set to be in an NTB mode, and the two GPUs achieve interconnection communication through the NTB. By windowing in the NTB, the address of the remote equipment is mapped in the local address space, so that the purpose of accessing the remote equipment is achieved. The PCIe Switch is used for replacing high-end network equipment, so that the hardware cost can be remarkably reduced, and the complexity of system deployment is reduced. Communication between the devices can be directly accessed through a memory address, and complex network connection, IP addresses or special software protocols do not need to be set; and low-delay and high-bandwidth GPU cross-host interconnection communication is achieved. Through the GPU which carries out cross-host communication in a PCIe NTB mode, the effect of GPU Direct P2P can be achieved.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

A network environment comprises a plurality of host machines that are communicatively coupled to each other via a network fabric comprising a plurality of switches that in turn include a plurality of ports. Each host machine comprises one or more GPUs that execute customer workloads. Described herein are different approaches that provide for addressing the problem of handling network overlay encapsulation without causing adverse impact to the performance of workloads executed on the GPU clusters.

A computer networking device includes a plurality of ports, a memory, and a computing unit. The computing unit receives source information and destination information for a snapshot from the host; obtains a read-value of a memory area corresponding to the source information in a memory device through a port identified based on mapping information and the source information; and transmit, to a storage device, the read-value based on peer-to-peer communication for a write operation of writing in a memory area corresponding to the destination information in the storage device through a port identified based on the mapping information and the destination information.

Provided herein are techniques to facilitate conflict management in a shared Open Radio Access Network (O-RAN) architecture. In one instance, a method can be performed by a conflict manager of a near-real-time RAN intelligent controller of a shared RAN including radio unit (RU) nodes provided by a host operator. The method can include obtaining each of a requested radio unit (RU) configuration from each of a distributed unit (DU) node operated by each of a tenant operator and determining whether there are any conflicts among RU configuration parameters for each requested RU configuration. In one instance, upon determining one or more conflicts among the RU configuration parameters for each requested RU configuration, the method may include providing a response to each DU node indicating that each DU node is allowed to configure the plurality of RU nodes using each requested RU configuration in accordance with a modification.

A method training an artificial neural network (ANN) on a remote host computes, using a trusted process deployed in a trusted execution environment (TEE) on the remote host, a key-pair for a homomorphic encryption scheme and shares, by the trusted process, the public key (PK) of the key-pair with an untrusted process deployed on the remote host. The method splits the training procedure of the ANN between the untrusted process and the trusted process, wherein the untrusted process computes encrypted inputs to neurons of the ANN by means of the homomorphic encryption scheme, while the trusted process computes outputs of the neurons based on the respective encrypted inputs to the neurons as provided by the untrusted process.

Apparatus for data communication includes a network interface for connection to a packet data network and a host interface for connection to a host computer, which includes a central processing unit (CPU) and a host memory. Packet processing circuitry receives, via the host interface, from a kernel running on the CPU, associations between multiple remote direct memory access (RDMA) sessions and multiple different User Datagram Protocol (UDP) 5-tuple, which are assigned respectively to the RDMA sessions, and receives from an application running on the CPU a request to send an RDMA message, using a selected group of one or more of the RDMA sessions, to a peer application over the packet data network, and in response to the request, transmits, via the network interface, one or more data packets using a UDP 5-tuple that is assigned to one of the RDMA sessions in the selected group.

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

The present invention relates to the field of network security. Disclosed are a provenance graph-oriented host-based intrusion detection method and system, and a storage medium. The method comprises: S1, collecting provenance data of a host to be detected, so as to construct a provenance graph representing a user behavior; S2, mapping nodes in the provenance graph into roles, constructing a node feature matrix of which feature vectors are used for representing attribute features and structural features of the nodes in the provenance graph and an interaction relationship between the nodes, and mapping the nodes having similar feature vectors into the same role; S3, performing attention-based attributed and temporal random walk in comprehensive consideration of the attributes of the nodes in the provenance graph, a temporal relationship between edges of the nodes, and attention parameters between different roles; and S4, converting an obtained attributed and temporal random walk sequence into an embedded vector to extract a feature of the provenance graph, and performing intrusion anomaly detection. The present invention can implement deep representation learning on provenance data, reduce the workload of detection model training, and improve the accuracy and efficiency of intrusion detection.

Some embodiments of the invention provide a method for performing congestion control for multiple packet flows traversing a network that includes multiple machines executing on one or more host computers. The method is performed at a distributed bandwidth utilization manager (DBUM) that manages bandwidth utilization in the network. The method receives state data associated with the multiple packet flows from the multiple machines. The method determines (1) that state data associated with a subset of packet flows in the multiple packet flows indicate the subset of packet flows have run to completion and (2) that a particular packet flow in the multiple packet flows should receive more bandwidth. Based on said determining, the method directs a source machine of the particular packet flow to increase an amount bandwidth allocated to the particular packet flow.

The invention discloses a solid state disk management system and a data processing method, and relates to the technical field of solid state disk management. Flexible task scheduling and resource management are provided through a lightweight operating system module, and a computing task program defined by a user is supported to be dynamically loaded; edge computing or machine learning operators are efficiently executed in combination with a programmable hardware processing unit and a DMA channel of the computing acceleration engine module, the data preloading module is utilized to predict and preload data to DDR based on LBA access history, access delay is reduced, an NVMe protocol is expanded by means of the task unloading interface module, host task issuing and result returning are achieved, and the data processing efficiency is improved. And hardware-level memory protection is ensured through the security isolation module, so that the data calculation processing capacity of the solid state disk is remarkably improved, localized calculation tasks such as edge calculation and machine learning are supported, mass data transmission is effectively reduced, and bus and network loads are relieved.

Method and apparatus for protecting computer resources from malicious attack including baseline sentinels and warrior sentinels. Baseline sentinels are deployed on a network serving only as decoys and containing no company data. When any attempt to communicate with a baseline sentinel is detected, a host of warrior sentinels (also containing no company data) are deployed to act as additional decoys, diminishing the chance that a malicious attack will reach a valuable computer resource and collecting information on the malicious attacker. Once the malicious attack stops or is defeated, the warrior sentinels are retired and the system resets to baseline sentinels.

The present application relates to the technical field of servers. Disclosed are a server system and a communication method therefor. The server system comprises: at least one first processor board and a host server, wherein the at least one first processor board is in communication connection with the host server by means of a switching network; the first processor board comprises a first field programmable gate array chip and a first processor chip; the first field programmable gate array chip and the first processor chip are packaged and interconnected; the host server is configured to transmit host data to the first field programmable gate array chip by means of the switching network; and the first field programmable gate array chip is configured to process the host data, receive request data which is sent by means of the first processor chip, generate a communication protocol message on the basis of the processed host data and the request data, and transmit the communication protocol message to a destination processor board by means of the switching network. By means of the present application, pooling acceleration of a server system is realized, thereby realizing efficient layout of computing power resources.

A method includes scanning a plurality of hosts in a network to obtain risk information of each instance of vulnerability associated with each host during a period, calculating a vulnerability risk score (VRS) for each instance of the vulnerability based on the associated risk information, determining a number of vulnerabilities associated with each of the plurality of hosts during the period, obtaining a criticality score of each of the plurality of hosts, obtaining for each host, a representative VRS based at least in part on the VRS for each instance of vulnerability associated with the host, calculating a host risk score (HRS) for each host based on the representative VRS, the number of vulnerabilities and the criticality score of the host, calculating a network risk score (NRS) for the network based on the HRSs, and facilitating a security action based on the HRS for each host and the NRS.

Techniques for managing cloud computing resources hosting burstable performance instances are described. A host computer system of a provider network executes burstable performance compute instances. Compute capacity usage data is obtained from the host computer system, the compute capacity usage data including a first indication of a first compute capacity used by a first burstable performance compute instance. A first weight for the first burstable performance compute instance is calculated, the first weight being inversely related to the first compute capacity. A scheduler of the host computer system is updated with process prioritization weights, the process prioritization weights including a first process prioritization weight that is based at least in part on the first weight. The scheduler allocates compute capacity based on the process prioritization weights.

The invention relates to a memory expansion system, method and device. The memory expansion system comprises a plurality of memory modules; the host module is used for accessing the memory module according to system operation requirements; the signal switching modules and the memory modules are arranged in a one-to-one correspondence manner, and the signal switching modules are used for establishing access links between the host module and the memory modules, so that the host module accesses the memory modules; the interconnection control module is connected with the host module and the signal switching module, and the interconnection control module is used for determining a current interconnection topology network between the host module and the signal switching module and a current bandwidth of the host module; and the memory module is used for monitoring the real-time required bandwidth of the host module in real time and gating the signal switching module connected with the host module based on the current bandwidth and the real-time required bandwidth so as to redistribute access to the host module. Compared with the prior art, the running memory distributed on each host module can be dynamically adjusted in real time.

The invention relates to the technical field of network security, in particular to a network security situation real-time monitoring method and system. The method comprises the following steps: acquiring virtual machine running state data and physical host deployment data, and performing distributed probe deployment in a cloud computing environment according to the virtual machine running state data and the physical host deployment data to obtain monitoring probe data, wherein the monitoring probe data comprises lightweight virtual machine probe data, physical host monitoring probe data and network flow probe data; according to the monitoring probe data, performing global identification mapping on the corresponding relationship between the virtual machine and the physical host so as to obtain identification mapping data; obtaining tenant security data; and performing streaming hierarchical processing on the tenant security data according to the identifier mapping data to obtain tenant isolation data. Through the design of the distributed probe, a virtual machine, a physical host and network flow are covered, comprehensive data can be collected in real time, and a monitoring blind area is eliminated.

The invention discloses a self-adaptive dynamic interface generation method and system based on a computing power host operation and maintenance platform, and relates to the technical field of operation and maintenance interface dynamic optimization. Aiming at the problem of static stiffness of an operation and maintenance interface in a complex scene, the scheme is adopted as follows: collecting user behaviors, a context environment and equipment data, and fusing into a multi-dimensional state vector; inputting the multi-dimensional state vector into a deep reinforcement learning model, and generating a dynamic interface strategy including layout component dynamic arrangement and function button priority ranking; designing a hierarchical multi-target reward function fusing operation efficiency reward, accuracy reward and cognitive load penalty, and performing strategy optimization; analyzing the optimized dynamic interface strategy through the cross-terminal rendering capability of the WebXR engine, and generating a front-end page adaptive to the current terminal; and continuously feeding back the collected data to the deep reinforcement learning model, and updating the network weight through a strategy gradient algorithm to realize user preference migration. According to the method and the device, cross-terminal self-adaptive dynamic interface generation can be realized.

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

Systems, methods, and instrumentalities are disclosed for service provisioning and providing access to a PALS hosting network. In examples, a WTRU may send a first message to a first network node if a configuration failure event is detected, wherein the first network node is associated with a first network, wherein the configuration failure event is associated with a second network, and wherein the first message indicates an update request for a network configuration for a local service. The WTRU may receive a second message from the first network node, wherein the second message indicates a response to the update request, indicates an updated network configuration, and indicates a slice identifier associated with the second network The WTRU may receive a third message from the first network node, wherein the third message indicates policy information associated with the local service. The WTRU may send a fourth message to a second network node, wherein the second network node is associated with the second network, wherein the fourth message is based on the policy information and the updated network configuration, and wherein the fourth message indicates a registration request associated with the slice identifier.