513 results about "Network packet" patented technology

The invention discloses a big data auxiliary key generation method and system in communication data encryption transmission, and relates to the technical field of big data analysis and processing. The dynamic entropy source processing module is used for generating a high-randomness entropy pool by combining an information entropy quantification model and adopting a Shannon entropy and minimum entropy fusion algorithm; the anti-quantum key generation module is used for generating a dynamic variable-length key seed based on an entropy pool driven post-quantum cryptographic algorithm; the hierarchical key negotiation module adopts a clustering Diffie-Hellman protocol, dynamically divides negotiation according to network topology, and precomputes and reduces the load of a core network through edge nodes; and a lightweight verification and update module. According to the method, high-entropy sources such as environmental noise, user behaviors and equipment hardware fingerprints are fused with low-entropy sources such as network messages and sensor data, and an intelligent acquisition strategy and a nonlinear decorrelation technology are combined, so that the anti-quantum dynamic entropy pool is generated, and the randomness of a secret key and the reliability of the entropy sources are improved.

The invention discloses a network data intelligent tool system and method based on a model context protocol MCP, and relates to the technical field of computer networks. The system comprises an AI analysis main body, an MCP Pcap tool engine, context management, a Pcap data source, various MCP Pcap tools, a Pcap tool gateway interface, a Pcap tool interface and a data packet interface. The invention provides an interaction mechanism of direct embedding and bypass data forwarding in tool calling. According to the method, direct embedded transmission of small-size data in tool calling is supported, separation of data transmission and instruction calling is achieved, the technical bottleneck that large-size Pcap data cannot be efficiently exchanged through a text channel is effectively overcome, efficient processing of the AI model on network packet capture data is achieved, and the data transmission efficiency is improved. And the efficiency and the automation degree of large-scale network traffic analysis are improved.

The invention discloses a construction project whole-process management system and method with a BIM3D-6D technology as a base, and relates to the technical field of construction project management, and the method comprises the steps: loading a 3D building information model through a BIM lightweight calculation server, extracting the spatial topological relation and IFC semantic attributes of geometric components, and carrying out the calculation of the 3D building information model through a BIM lightweight calculation server; spatial topology analysis and semantic attribute mapping are carried out on the spatial topology relation of the geometric components and the IFC semantic attributes, and a three-dimensional data topology network packet based on a graph structure is generated; performing multi-dimensional deduction operation on the three-dimensional data topology network packet based on the graph structure to obtain a deviation compensation strategy containing an optimal cost control path; and carrying out dimension expansion and data fusion on the 3D building information model to generate a 5D cost dimension data set. Discrete decisions are converted into a continuous field model through mathematical transformation, so that a resource flow path has spatial relevance and time continuity, and the beneficial effect of dynamically optimizing a construction process is achieved.

The invention relates to the technical field of network flow analysis, in particular to a non-intrusive network flow real-time analysis method and system based on an eBPF, and the method comprises the steps: deploying an eBPF program in a kernel mode, and capturing a network data packet entering a kernel protocol stack in real time; identifying an application layer protocol type and analyzing a key field; the structured data is transmitted to the user mode through the annular buffer area; and the user state carries out TCP stream recombination and session-level aggregation statistics on the structured data. According to the invention, on the premise that application codes are not modified, real-time and structured protocol analysis can be carried out on various common application layer protocols in a kernel layer; end-to-end delay is accurately disassembled through a full-link delay disassembling mechanism, and a performance bottleneck link is positioned; the analysis result is output in the form of structured data, second-level performance statistics and abnormal behavior detection are supported, and the operation and maintenance analysis efficiency and the system observability are remarkably improved.

The present application belongs to the technical field of data processing and relates to a network message processing method and apparatus, and a computer device and a storage medium. The method comprises: on the basis of a received target network message, acquiring a target memory block from a pre-constructed shared memory pool, so as to generate a message memory; on the basis of a network-interface-card driver, performing first identification processing on the target network message, so as to obtain a target network message descriptor; on the basis of the target network message descriptor, performing second identification processing on the message memory, so as to obtain a first socket buffer; and performing parsing processing on the first socket buffer by means of a network protocol stack, and on the basis of a parsing processing result, reading network message data from a virtual memory corresponding to the message memory, so as to complete the processing of the network message. In the present application, on the basis of a constructed shared memory pool, zero-copy network packet reception can be realized during network message processing, thereby avoiding performance loss caused by the memory copy of messages.

The invention relates to the technical field of network security, and particularly discloses an edge device network threat detection method and system based on an electric power large model, and the method comprises the steps: capturing a network message sequence in real time, extracting a time sequence randomness feature and a semantic deviation feature from a time dimension and a protocol dimension, and carrying out the fusion to form a comprehensive threat feature vector; performing multi-dimensional feature analysis and time sequence modeling by adopting a lightweight electric power large model to realize millisecond-level threat assessment; establishing a multi-level response mechanism, dynamically triggering a differential protection strategy according to the threat level, and ensuring the reliability and consistency of response actions through digital signature and collaborative verification; according to the method, the complex network attack in the power edge equipment can be effectively identified, the threat detection accuracy and the system defense capability are improved, and the strict requirements of a power system on real-time performance and reliability are met.

The present invention extends to methods, systems, and computer program products for optimizing resource allocation in view of predicted network traffic patterns and predicted power consumption. Network packets defining a network traffic flow can be received at a platform over time. Metrics can be derived from one or more applications executing on resources of the platform and processing data contained in the network data packets. Model training data can be formulated from the metrics. A resource adjustment model can be trained using the model training data. Executing the model can be automated to adjust resource allocation at the platform. Additional network packets defining an additional network traffic flow can be received at a platform over time. Data contained in the additional network packets can be processed using the adjusted resource allocation.

In general, techniques are described for a SDN architecture system that implements an integrated gateway service. In an example, network controller comprises processing circuitry and memory and is configured to: configure a virtual network in a cluster of nodes of a compute infrastructure, the cluster of nodes managed in part by the network controller; receive a manifest for a gateway service instance that abstracts a transit gateway resource configurable in a plurality of different types of compute infrastructures, wherein the manifest specifies an intended state of a transit gateway object of the gateway service instance; and reconcile the intended state of the transit gateway object for the gateway service instance by sending configuration data, generated based on the transit gateway object, to an interface for the compute infrastructure to configure a transit gateway to forward network packets between a compute infrastructure node of the compute infrastructure and the virtual network.

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for securing data. One of the methods includes receiving one or more network data packets. The one or more network data packets include a token that identifies stored sensitive data. The one or more network data packets are desanitized, by: identifying and extracting, from the one or more network data packets, the token; requesting, from a distributed file system, the stored sensitive data, based upon the token; and receiving, in response to the request, the stored sensitive data as received stored sensitive data.

This disclosure describes methods, devices and systems for abnormal network data identification and policy enforcement. An example method includes obtaining incoming network data from a network device, the networking data including operating information for the network device and packet metadata. The method also includes classifying the incoming network data using one or more machine learning models, including identifying abnormal network data from the incoming network data. The method further includes causing a policy rule to be generated based on the abnormal network data.

Disclosed embodiments receive an event stream from a remote capture agent. The event stream includes timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent. A graphical user interface (GUI) is caused to be displayed for obtaining configuration information for configuring the generation of time-series event data from network packets captured by the remote capture agent. A set of statistics is generated from the time-series event data, and the configuration information is updated to trigger subsequent storage and processing of at least a portion of the event stream by one or more components on a network based on one or more of the statistics, a storage limit associated with the time-series event data, an index volume of the event stream, a historical trend associated with the statistics, or input through the GUI.

The invention discloses an AI agent data protection method and device based on a controlled execution environment, and the method comprises the steps: verifying the integrity of a safety decision monitoring module in each service node kernel of a cloud side through a remote authentication service in a trusted execution environment, and verifying whether the service nodes of the cloud side are all operated in the trusted execution environment or not; the starting environment is safe and credible; the cloud side receives the security configuration from the user side and distributes the security configuration to the security decision monitoring module of each service node; firstly, security check is executed on a service request to be sent by an AI agent, the service request is received by a cloud side service node after compliance, and a security decision monitoring module of a cloud side gateway service node intercepts a received network packet and judges whether the service request is normal traffic; when other service node services of the cloud need to be called, continuing to judge whether the traffic meets the security configuration configured by the user; and the security decision monitoring module is established based on an eBPF and is used for intercepting a received or sent network packet and realizing verification and auditing functions.

A service provider may deploy a security threat detection and mitigation platform in a multi-tenant virtualization environment that includes pluggable data collection, data analysis, and response components. The data analysis components may apply machine learning techniques to generate (based on training data sets) and refine (based on subsequently received data sets and feedback about the resulting classifications) predictors configured to detect particular types of security threats, such as denial of service attacks, botnets, scans, or remote desktop attacks. A data collection layer may collect, filter, organize, and curate network packet traffic data, network packet header data, or other information emitted by computing instances or applications executing on them, and provide the curated data as streams to the analysis layer. A response layer may automatically take action in response to threat detections (which may be overridden by an administrator) and may store classification data for subsequent analysis, feedback, and predictor refinement.

This disclosure describes methods, devices, and systems for network anomaly detection and policy enforcement. An example method includes obtaining metadata for a plurality of network packets. The method also includes detecting an anomaly in the plurality of network packets by analyzing the obtained metadata and the operating information. The method also includes generating, without user input, a policy rule based on the detected anomaly. The method further includes enforcing the policy rule at the one or more network devices.

Packets received at a routing intermediary and directed to a resource are transmitted to a data plane node of a partition of a traffic management service. The data plane node transmits an indication of a high-arrival-rate destination group, identified based on a metric of network packets received at the data plane node, to a control plane node of the service. A resource is identified at the control plane node as a rate limiting target based on high-arrival-rate group information from several data plane nodes. A limit is applied to the rate at which packets are received at the target. The control plane node changes the number of data plane nodes in the partition based on a triggering condition.

An embodiment establishes a network model based at least in part on network data received from a network, wherein the network data comprises device data and certificate data. The embodiment samples the network to receive a network data sample. The embodiment compares the network data sample to the network model to determine whether an anomalous amount of devices is present in the network. The embodiment compares the network data sample to the network model to determine whether an anomalous amount of certificates is present in the network. The embodiment identifies a device population anomaly upon a determination that an anomalous amount of devices and / or an anomalous amount of certificates is present in the network.

The invention provides a dynamic risk awareness cross-border data flow real-time monitoring method, and relates to the technical field of data security, and the method comprises the steps: deploying a monitoring agent on terminal equipment with a data collection function, capturing original data flow in real time, and obtaining related information; analyzing the network data packet to determine a cross-border flow condition; comparing the original data with a preset format library; identifying an encryption algorithm for unmatched data through static and dynamic analysis and decrypting the unmatched data; comparing the decrypted data with the sensitive data to judge whether the decrypted data is the sensitive data or not; the transmission condition is monitored in real time, an alarm is triggered when abnormity occurs, information is recorded, and a library and rules are updated. According to the cross-border data flow monitoring method and device, the monitoring agent is deployed on the terminal equipment, and cross-border data flow is effectively monitored by means of comparison of the preset format library, static and dynamic analysis and the like.

The present invention relates to a data packet indexing and retrieval method based on long-short characteristics of attribute values of a network data packet. The method comprises: acquiring a network data packet, and decoding the network data packet to obtain attribute values; classifying the attribute values according to length characteristics of parameters in the attribute values, constructing index data structures and storing the index data structures; and initiating a retrieval request to obtain a corresponding network data packet, so that retrieval is completed. Compared with the prior art, the present invention has the following remarkable advantage: by performing long-short classification processing on attribute values in a network traffic data packet, and selecting an appropriate index algorithm for indexing, efficient indexing and retrieval of the data packet are realized. According to the method, the accuracy and flexibility of indexing are considered while high efficiency is ensured, thereby better meeting the requirements in different scenarios, and improving practicability. Therefore, the present invention has an important practical application value, and has important significance in improving the processing efficiency of the network traffic data packet and ensuring the processing real-time performance of the network traffic data packet.

The invention relates to a network security situation awareness method and system based on big data analysis, and belongs to the technical field of network security. The method comprises the steps of collecting original network data which comprises original network data flow and original protocol data in broadband service, training a network security situation awareness model based on a preset network security situation awareness standard set, the network security situation awareness model comprises a network flow analysis model and a protocol analysis model, generating a network state label through the network security situation awareness model, and evaluating a network security level through a rating rule according to the network state label. And outputting a network security situation awareness instruction through an instruction control script according to the network security level, generating a network security situation report through an automatic reporting tool according to the original network data, the network state label and the network security level, and displaying the network security situation report through a data visualization tool.

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

The invention provides an air quality prediction method of a space-time diagram neural network based on trend information perception, and the method specifically comprises the steps: constructing network data which comprises an adjacent matrix between air monitoring stations and a feature information matrix of each air monitoring station; an air quality prediction model of a space-time diagram neural network based on trend information perception is constructed, the model comprises a trend perception attention mechanism and a double-channel attention module, and a trend sequence is introduced to improve an adaptive graph learning module; training an air quality prediction model; and predicting the air quality by using the trained air quality prediction model. The invention provides a novel air quality prediction method which can extract the time and space characteristics of a data set at the same time and aims to improve the accuracy and universality of air quality prediction.

The invention provides a data packet receiving and processing method, which comprises the following steps of: when a network data packet is received, caching the data packet in a cache unit of a data processing unit according to a queue; reading a notification from a host, analyzing the notification to obtain a receiving queue entry address, and obtaining address information of an empty cache region allocated by the host from the receiving queue entry; writing a plurality of data packets cached in the data processing unit into an empty cache region allocated by a host through a single PCIe write operation, and supplementing each packet of data according to a cache line alignment principle; generating a corresponding completion queue entry CQE for each data packet written into the host cache region; and uploading the plurality of CQEs to a host through a single PCIe write operation. The invention further discloses a corresponding data processing unit and system, a storage medium and a network card. By implementing the application, the efficiency of receiving the packet data can be improved, and the system performance is improved.

The invention relates to a network access control system, a network access control method and related equipment. In the system, a client agent module is used for acquiring process identification information and establishing a binding relationship between a process and a network message; the traffic acquisition and analysis module is used for acquiring network messages at a gateway side, analyzing and aggregating the network messages and generating a structured traffic record; the process association verification module is used for verifying the validity of the binding relationship and establishing and maintaining the association relationship between the process and the structured traffic record; the traffic aggregation and strategy generation module is used for executing traffic aggregation and network behavior analysis based on the structured traffic record and the association relationship, and dynamically generating an access control strategy based on a network behavior analysis result; and the dynamic access control execution module is used for controlling the network access request based on the access control strategy and generating an execution result containing the control result. The system realizes self-adaptive generation of process-level control and access control strategies.

The present invention extends to methods, systems, and computer program products for predictively addressing hardware component failures. Network packets can be received over time at a platform. Metrics derived from platform hardware components and derived from one or more workloads utilizing the platform hardware components can be monitored. Model training data can be formulated from the metrics. A health check model can be trained using the model training data. The health check model can be executed to compute a probability that a monitored platform hardware component is on a path to failure. It can be determined that the probability exceeds a threshold. A workload can be relocated from a pod containing the monitored platform hardware component to another pod. Additional network packets can be received over time at the platform. The workload can process data contained in the additional network packets at the other pod.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with mitigating DDoS attack using a hardware device includes determining when a received network packet in an established connection between a client and a destination server includes a connection identifier cookie. A connection validation cookie is generated based on at least data in the received network packet, when the determination indicates the received network packet includes the connection identifier cookie. The connection identifier cookie is compared against the generated connection validation cookie. The received network packet is dropped when the comparison indicates the connection validation cookie fails to match the connection identifier cookie.

The invention discloses an enterprise-level three-party dependency package security management and control system and method, and relates to the technical field of software supply chain security, and the enterprise-level three-party dependency package security management and control system comprises the following modules: a timed task scheduling module, an external network package pre-scanning module, a private service package monitoring module, a dependency graph construction module, a product management and control module and a notification display module. By establishing an external network packet pre-scanning mechanism, security scanning is performed and a blocking list is generated before a dependent packet enters an enterprise private server, and introduction of a packet containing high-risk vulnerabilities is blocked from the source; meanwhile, through the continuous monitoring of the private server package and the construction of the dependency relationship graph, the vulnerability discovery and the accurate positioning of the influence range of the stored dependency package are realized; and finally, performing hierarchical management and control on the affected products based on vulnerability levels, and realizing timely transmission and situation visualization of risk information through a notification display module. According to the invention, full-life-cycle safety protection from an external network source to internal products of an enterprise is realized, and the safety management level and risk response efficiency of the dependent package of the enterprise are effectively improved.

Neural coding techniques may be implemented for transmission of redundant audio data. An encoding technique is implemented that uses forward encoding along with an initial state to include multiple audio frames from audio data represented as latent vectors in a network packet transmitted to a recipient. The recipient can then use backward decoding and the initial state to obtain the multiple audio frames from the latent vectors. The multiple audio frames provided in the network packet are redundant audio data that can be used to generate missing audio data.

The present invention extends to methods, systems, and computer program products for optimizing processor core frequency in view of predicted network traffic patterns. Network packets defining a network traffic flow can be received at a platform over time. Metrics can be derived from one or more applications executing at one or more processing units of the platform and processing data contained in the network data packets. Model training data can be formulated from the metrics. A processor unit frequency adjustment model can be trained using the model training data. Executing the model can be automated to adjust the frequency of a processing unit from among the one or more processing units. Additional network packets defining an additional network traffic flow can be received at a platform over time. Data contained in the additional network packets can be processed at the processing unit at the adjusted frequency.

Systems and methods for multi-objective radio network optimization is provided. A system may collect multiple network data packets from network monitoring equipment connected to a communications network. The system may execute a model using the network data packets as input. The model may be an optimization model or a machine learning model. The model may generate network configuration parameters for the communication network. The model may be configured with predetermined weights for multiple performance metrics. The model may be trained to generate the network configuration parameters that optimize multiple performance metrics. The system may adjust the communications network according to the generated network configuration parameters.

The invention discloses a network packet capture and analysis method and device based on artificial intelligence. And constructing a dynamically updated normal traffic baseline by using a lightweight AI model, and extracting real-time traffic features to perform abnormal probability evaluation. And when the abnormal probability exceeds a risk threshold, triggering a precise packet capture strategy. Extracting multi-modal features from the captured abnormal traffic, and fusing the multi-modal features into a high-dimensional feature vector which retains behavior semantics through a deep neural network; and carrying out anomaly classification by using a special AI large model, and carrying out causal reasoning in combination with a knowledge graph to locate a root cause. And generating a disposal strategy based on the root cause, and performing risk grading according to the influence range and the service interruption probability to realize grading closed-loop disposal. According to the method, full-process automation from anomaly perception, intelligent analysis to adaptive disposal is realized, the traditional technical bottlenecks of encrypted traffic detection, unknown threat identification, root cause positioning and the like are effectively solved, and the efficiency and response speed of network security operation and maintenance are remarkably improved.