334 results about "Network packet" patented technology

The invention relates to the technical field of network flow analysis, in particular to a non-intrusive network flow real-time analysis method and system based on an eBPF, and the method comprises the steps: deploying an eBPF program in a kernel mode, and capturing a network data packet entering a kernel protocol stack in real time; identifying an application layer protocol type and analyzing a key field; the structured data is transmitted to the user mode through the annular buffer area; and the user state carries out TCP stream recombination and session-level aggregation statistics on the structured data. According to the invention, on the premise that application codes are not modified, real-time and structured protocol analysis can be carried out on various common application layer protocols in a kernel layer; end-to-end delay is accurately disassembled through a full-link delay disassembling mechanism, and a performance bottleneck link is positioned; the analysis result is output in the form of structured data, second-level performance statistics and abnormal behavior detection are supported, and the operation and maintenance analysis efficiency and the system observability are remarkably improved.

The invention relates to the technical field of network security, and particularly discloses an edge device network threat detection method and system based on an electric power large model, and the method comprises the steps: capturing a network message sequence in real time, extracting a time sequence randomness feature and a semantic deviation feature from a time dimension and a protocol dimension, and carrying out the fusion to form a comprehensive threat feature vector; performing multi-dimensional feature analysis and time sequence modeling by adopting a lightweight electric power large model to realize millisecond-level threat assessment; establishing a multi-level response mechanism, dynamically triggering a differential protection strategy according to the threat level, and ensuring the reliability and consistency of response actions through digital signature and collaborative verification; according to the method, the complex network attack in the power edge equipment can be effectively identified, the threat detection accuracy and the system defense capability are improved, and the strict requirements of a power system on real-time performance and reliability are met.

In general, techniques are described for a SDN architecture system that implements an integrated gateway service. In an example, network controller comprises processing circuitry and memory and is configured to: configure a virtual network in a cluster of nodes of a compute infrastructure, the cluster of nodes managed in part by the network controller; receive a manifest for a gateway service instance that abstracts a transit gateway resource configurable in a plurality of different types of compute infrastructures, wherein the manifest specifies an intended state of a transit gateway object of the gateway service instance; and reconcile the intended state of the transit gateway object for the gateway service instance by sending configuration data, generated based on the transit gateway object, to an interface for the compute infrastructure to configure a transit gateway to forward network packets between a compute infrastructure node of the compute infrastructure and the virtual network.

This disclosure describes methods, devices, and systems for network anomaly detection and policy enforcement. An example method includes obtaining metadata for a plurality of network packets. The method also includes detecting an anomaly in the plurality of network packets by analyzing the obtained metadata and the operating information. The method also includes generating, without user input, a policy rule based on the detected anomaly. The method further includes enforcing the policy rule at the one or more network devices.

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

The invention relates to a network access control system, a network access control method and related equipment. In the system, a client agent module is used for acquiring process identification information and establishing a binding relationship between a process and a network message; the traffic acquisition and analysis module is used for acquiring network messages at a gateway side, analyzing and aggregating the network messages and generating a structured traffic record; the process association verification module is used for verifying the validity of the binding relationship and establishing and maintaining the association relationship between the process and the structured traffic record; the traffic aggregation and strategy generation module is used for executing traffic aggregation and network behavior analysis based on the structured traffic record and the association relationship, and dynamically generating an access control strategy based on a network behavior analysis result; and the dynamic access control execution module is used for controlling the network access request based on the access control strategy and generating an execution result containing the control result. The system realizes self-adaptive generation of process-level control and access control strategies.

The invention discloses an enterprise-level three-party dependency package security management and control system and method, and relates to the technical field of software supply chain security, and the enterprise-level three-party dependency package security management and control system comprises the following modules: a timed task scheduling module, an external network package pre-scanning module, a private service package monitoring module, a dependency graph construction module, a product management and control module and a notification display module. By establishing an external network packet pre-scanning mechanism, security scanning is performed and a blocking list is generated before a dependent packet enters an enterprise private server, and introduction of a packet containing high-risk vulnerabilities is blocked from the source; meanwhile, through the continuous monitoring of the private server package and the construction of the dependency relationship graph, the vulnerability discovery and the accurate positioning of the influence range of the stored dependency package are realized; and finally, performing hierarchical management and control on the affected products based on vulnerability levels, and realizing timely transmission and situation visualization of risk information through a notification display module. According to the invention, full-life-cycle safety protection from an external network source to internal products of an enterprise is realized, and the safety management level and risk response efficiency of the dependent package of the enterprise are effectively improved.

The invention discloses a network packet capture and analysis method and device based on artificial intelligence. And constructing a dynamically updated normal traffic baseline by using a lightweight AI model, and extracting real-time traffic features to perform abnormal probability evaluation. And when the abnormal probability exceeds a risk threshold, triggering a precise packet capture strategy. Extracting multi-modal features from the captured abnormal traffic, and fusing the multi-modal features into a high-dimensional feature vector which retains behavior semantics through a deep neural network; and carrying out anomaly classification by using a special AI large model, and carrying out causal reasoning in combination with a knowledge graph to locate a root cause. And generating a disposal strategy based on the root cause, and performing risk grading according to the influence range and the service interruption probability to realize grading closed-loop disposal. According to the method, full-process automation from anomaly perception, intelligent analysis to adaptive disposal is realized, the traditional technical bottlenecks of encrypted traffic detection, unknown threat identification, root cause positioning and the like are effectively solved, and the efficiency and response speed of network security operation and maintenance are remarkably improved.

The invention discloses a network flow processing method, device and equipment and a storage medium, and relates to the technical field of system resource management, and the method comprises the steps: monitoring a current network load of a computer system, and determining a to-be-isolated processor core from the computer system when the current network load is judged to meet a preset high load condition; binding the network data packet buffer area and the network protocol stack data structure to a high-speed cache of the processor core to be isolated, and distributing a target buffer pool for the processor core to be isolated in a memory area of a computer system to obtain a target processor core; the network data packet buffer area is used for storing a data packet related to an interrupt request in the current network flow of the computer system, and the network protocol stack data structure is a data structure related to the data packet; and respectively processing the interrupt request and other network flows through the target processor core and other processor cores. Therefore, high-intensity load change can be coped with in a mode of isolating the processor cores.

The invention discloses a file transmission method and system for sensitive information identification and automatic blocking. The method comprises the steps that a network data packet in the file transmission process is captured, file content is analyzed, and related metadata is extracted; performing multi-level sensitive information detection on the extracted related metadata by fusing keyword matching, regular expression matching and semantic analysis methods; based on a multi-level sensitive information detection result, combining sensitive information severity, weight, file importance and information density to construct a weighted risk assessment model, calculating a risk value and dividing risk levels; when the risk level is judged to be high risk, file transmission connection is automatically interrupted, local cache data is cleared, and a complete audit log is recorded. According to the sensitive information identification method and device, through combination of various identification technologies such as keyword matching, regular expression matching and semantic analysis, the accuracy of sensitive information identification is greatly improved, sensitive information in various forms can be effectively identified, and the situations of misinformation and missing report are reduced.

Embodiments relate to a computer-implemented method for managing zero-trust network communications. The method includes validating the identity of a first remote endpoint using a cryptographic credential received from the first endpoint and determining the first endpoint's authorization to communicate with a second remote endpoint. Upon successful validation and authorization, the method initiates the establishment of a network packet route between the first and second remote endpoints. Later, the method further initiates the destruction of the network packet route between the two endpoints.

The invention relates to a command boundary judgment method and device based on mark command insertion and finite-state machine collaboration, and the method comprises the steps: obtaining a network data packet generated by the operation of a user in a terminal of a client; analyzing a corresponding command from the network data packet through a defined state set and a state transition condition set in the finite-state machine; when the command is submitted to a target server, inserting the corresponding mark character string into the command to obtain a mark command, and submitting the mark command and the command to the target server; and according to the mark character string returned by the target server, determining the boundary of the command so as to switch the state corresponding to the command in the defined state set. Through the method and the device, the problem of low accuracy of command boundary judgment in related technologies is solved, the command boundary is accurately judged, the insertion of the mark character string and the state transition of the finite-state machine are combined, the resource consumption is reduced, and the accuracy of the state transition is improved.

A processor may capture network packets from a communication channel between a user and an application, the network packets comprising a data structure package. A processor may identify a schema of a payload used in the data structure package of the network packets. A processor may dynamically generate payload schema processing code using a machine learning dynamic protocol parser by applying a machine learning model to the schema of the payload, the payload schema processing code including a description of each field of the data structure package and a parser function for extracting a prompt. A processor may iterate the dynamically generating of the payload schema processing code until the payload schema processing code meets a predefined accuracy and functionality criteria that successfully extracts the prompt.

The invention belongs to the technical field of network security, and discloses an Internet of Things network security supervision system based on edge computing, which realizes active defense through cooperation of multiple modules. Firstly, a data acquisition module collects a network data packet, and a behavior analysis module generates a communication sequence diagram based on the network data packet and generates an equipment behavior mode identification vector by using the communication sequence diagram; when the abnormity identification module judges that the behavior mode identification vector is abnormal, an equipment authentication request is generated; a main node of the equipment authentication module generates an authentication proposal and broadcasts the authentication proposal to an edge node trust anchor point pool, the identity of the equipment is verified through a distributed consensus mechanism, and a tamper-proof authentication result is generated; and finally, the risk isolation module dynamically isolates illegal equipment according to an authentication result. And the threat response speed and the protection accuracy are obviously improved.

Apparatuses, systems, and techniques for detecting distributed denial of service (DDoS) attacks are described. A system includes a plurality of switches in a monitored data center, each switch comprising network monitoring logic to sample network packets and generate flow records representing behavior of network traffic. A dataflow collector receives the flow records from the plurality of switches. A streaming pipeline coupled to the dataflow collector processes the flow records. A data store stores the flow records processed by the streaming pipeline. A trainer accesses the flow records in the data store and trains one or more machine learning (ML) models to detect DDoS attacks based on the flow records. At least one of the one or more ML models is deployable to at least one switch of the plurality of switches to determine whether a host device coupled to the at least one switch is subject to a DDoS attack.

The invention discloses an edge computing gateway platform architecture interaction method and device and a medium, and relates to the technical field of acoustic man-machine interaction, and the method comprises the steps: receiving an original sound wave signal, carrying out the human voice activation detection and wake-up word confirmation of the original sound wave signal through a hierarchical wake-up detection mechanism, and generating an effective sound wave segment; performing fast Fourier transform on the effective sound wave segments to generate frequency domain energy features; extracting energy distribution of the frequency domain energy features, and generating a dominant frequency set according to a preset energy threshold value; constructing a sound wave-instruction rule base, and inputting the dominant frequency set into the sound wave-instruction rule base to generate a primary acoustic instruction; converting the primary acoustic instruction into a text instruction, and generating an instruction data set through an Agent decision agent; and collecting space coordinates and network packet loss rate parameters of the edge equipment, and generating a transmission path scheme through a space field intensity gradient algorithm in combination with the instruction data set. According to the method, the instruction recognition accuracy in the noise environment is improved through anti-noise wave analysis.

The invention relates to a method and a system for capturing and analyzing industrial network protocol data packets, which solve the technical problem that the existing industrial protocol analysis technology is poor in adaptability to unknown, private or non-standard protocols, and the method comprises the following steps: capturing and screening network data packets for protocol identification. If the protocol is the known protocol, calling a preset analyzer for analysis; if the protocol is an unknown protocol, extracting a protocol feature vector of the protocol, obtaining a candidate protocol and confidence through reasoning of a neural mapping model, and dynamically judging whether to start interactive reasoning to obtain user feedback, calibrating a parameterized protocol template and instantiating to generate an executable analysis rule according to the structural matching degree of an existing analyzer; and finally, registering and using the new analyzer to realize adaptive learning and analysis. The method has the following effects: intelligent identification of an unknown protocol, dynamic construction of an analyzer and system self-expansion are autonomously realized through an adaptive learning mechanism, and normal form upgrading from manual reverse analysis to system autonomous evolution is completed.

Embodiments of the present application disclose a container network packet capturing processing method, device and equipment and a readable storage medium. The container network packet capturing processing method comprises the following steps: receiving attribute information of a source container group and a destination container group input by a user, the source container group being a container group that sends access data, the destination container group being a container group that receives the access data, the source container group and the destination container group each comprising at least one container; determining physical nodes where the source container group and the destination container group are located according to the attribute information; determining a target network card according to the physical nodes where the source container group and the destination container group are located, the target network card being a network card through which the access data passes; and sending a packet capturing command for the target network card to a physical node where the target network card is located. Through the present application, the technical problem of low troubleshooting efficiency of a container network in the related art is solved.

The present invention extends to methods, systems, and computer program products for optimizing resource allocation in view of predicted network traffic patterns and predicted power consumption. Network packets defining a network traffic flow can be received at a platform over time. Metrics can be derived from one or more applications executing on resources of the platform and processing data contained in the network data packets. Model training data can be formulated from the metrics. A resource adjustment model can be trained using the model training data. Executing the model can be automated to adjust resource allocation at the platform. Additional network packets defining an additional network traffic flow can be received at a platform over time. Data contained in the additional network packets can be processed using the adjusted resource allocation.

The present invention extends to methods, systems, and computer program products for optimizing resource allocation in view of predicted network traffic patterns and predicted power consumption. Network packets defining a network traffic flow can be received at a platform over time. Metrics can be derived from one or more applications executing on resources of the platform and processing data contained in the network data packets. Model training data can be formulated from the metrics. A resource adjustment model can be trained using the model training data. Executing the model can be automated to adjust resource allocation at the platform. Additional network packets defining an additional network traffic flow can be received at a platform over time. Data contained in the additional network packets can be processed using the adjusted resource allocation.

The invention discloses a network security reinforcement method fusing machine learning and dynamic strategy adjustment, an electronic device and a medium, the method comprises the following steps: preprocessing network data to obtain preprocessed data, the network data comprising system layer data, network layer data, application layer data and user and asset data; a machine learning and reasoning model is constructed based on GraphSAGE of the graph neural network and the preprocessed data, the machine learning and reasoning model outputs a prediction result, and the prediction result comprises a node anomaly probability and a threat propagation probability; generating a strategy instruction based on the prediction result; controlling the network to hierarchically execute a dynamic security policy based on the policy instruction so as to reinforce the network security and obtain a security-reinforced network; generating an evaluation result based on the network after security reinforcement; and closed-loop feedback is carried out on the network after security reinforcement based on an evaluation result. According to the method, the adaptability, response efficiency and intelligent level of security reinforcement to dynamic threats can be improved.

Systems and methods for service response analysis via out-of-band signaling is provided. A system may obtain, via a first network channel, a network data packet from a network service provider. The system may determine the network data packet comprises a response code indicating a status of the request. The system may extract the response code from the network data packet. The system may generate an out-of-band response message comprising the response code. The system may send, to an external device via a second network channel, the out-of-band response message comprising the response code.

The application discloses a cable-strut tension structure force finding method, device, equipment, medium and product, and relates to the field of computer-aided design. The method comprises the following steps: analyzing geometric topology information of a cable-strut structure from a CAD file, and constructing graph network data according to the geometric topology information, wherein the graph network data comprises an association matrix; wherein the nodes in the graph network data comprise strut nodes and boundary nodes, and the edges comprise strut units and cable units; inputting the association matrix into a pre-trained force distribution prediction model to obtain unit force prediction values corresponding to the strut units and the cable units; wherein a loss function for training the force distribution prediction model is constructed based on physical constraints, and comprises a force distribution constraint loss and a force balance residual loss. The above scheme adopts the concept of topological and physical double driving, greatly improves the force finding accuracy of high-dimensional complex topological structures, enhances the universality and general applicability, and improves the automation degree.

A network device includes a hardware pipeline to process a network packet to be encrypted for transmission, the hardware pipeline includes a steering engine to retrieve, from the network packet, information including a packet header, a parsed header structure, or steering metadata associated with processing the network packet. The steering engine generates, based on the information, steering action(s) to be taken using a match-action pipeline of the hardware pipeline. The steering engine generates command(s) based on the steering action(s). A set of hardware engines, of the hardware pipeline, are to be triggered, by the one the command(s), to parse and execute the command(s) to determine a set of inputs and facilitate performance of a cryptographic operation on a payload data of the network packet based on the set of inputs.

The invention provides an ATIS simulation implementation method and device of an aviation simulator, equipment and a medium, and relates to the technical field of aviation simulation, and the ATIS simulation implementation method of the aviation simulator comprises the steps: obtaining a universal ATIS message architecture; obtaining an ATIS message based on the general ATIS message architecture and the parameter information in the comprehensive environment simulation model; determining control information corresponding to the ATIS message based on a station matching control algorithm and a logic control algorithm; constructing an ATIS network data packet based on the ATIS message and the control information corresponding to the ATIS message; and the broadcasting module is driven based on the ATIS network data packet to simulate and broadcast the ATIS message in real time. According to the invention, the standardization, universality, integrity and flexibility of the ATIS message and the flexible control and real-time performance of the ATIS message broadcast attribute are improved, and the accuracy and real-time performance of the ATIS simulation of the aviation simulator are further improved.

The invention relates to the technical field of information security, in particular to an encrypted traffic identification method based on big data, which comprises the following steps of: acquiring a network data packet, extracting flow statistical characteristics and a TLS handshake protocol field, generating an original characteristic vector after numeralization processing; determining a traffic data type based on the type identification model, further calculating a network data feature coefficient, and determining an encrypted traffic identification model based on a comparison result with a historical coefficient; inputting the original feature vector into the model to obtain an initial recognition result and a flow confidence coefficient, classifying the recognition result based on the flow confidence coefficient, and executing corresponding regulation and control operation based on the recognition result; and re-collecting the regulated data packet, extracting the network state data to calculate a regulation efficiency index, and determining whether to regulate the historical network data feature coefficient based on the regulation efficiency index and the identification efficiency index. Through a closed-loop feedback optimization mechanism, adaptive adjustment of encrypted traffic identification is realized, and the identification accuracy and the regulation and control efficiency are improved.

Aspects discussed herein include a method and associated network device and computer program product. The method includes receiving a network packet and estimating a power profile corresponding to a plurality of subcarriers of a channel using a preamble of the network packet. The method also includes estimating a carrier frequency offset using the power profile and estimating a clock offset using the carrier frequency offset.

This invention discloses a multi-dimensional fusion network protocol identification method based on traffic features, belonging to the field of network security technology. It comprises four steps: probe-based traffic acquisition and session reassembly, multi-level fusion feature extraction and standardization, protocol classification and reasoning based on XGBoost ensemble learning, and multi-session aggregation recommendation output based on IP:PORT granularity. Addressing the application layer protocol identification problem, in a real-world network environment, a custom probe tool is deployed to acquire network packets. Multi-dimensional statistical feature extraction technology and ensemble learning algorithms are used to construct highly separable feature vectors based on the statistical characteristics of network traffic. Through a multi-session aggregation voting mechanism, the identification and classification of mainstream application layer protocols are achieved. This invention does not rely on port numbers or payload decryption and can effectively identify application layer protocols in non-standard ports and encrypted scenarios, achieving an accuracy of 99.56% and an average recall rate of 99.26%.

The invention relates to the technical field of power distribution automation, and provides a file transmission method suitable for a real-time system and a non-real-time system, which comprises the following steps that: the real-time system acquires a fault signal and triggers a UDP (User Datagram Protocol) to send a task; the real-time system assembles a frame of UDP message according to a UDP message format and information such as a wave recording starting moment, an interval number, a fault sequence number and a data channel number, and sends the frame of UDP message to the non-real-time system; the real-time system splits the recording data in the cache data area into multiple frames of network packets and sends the multiple frames of network packets to a non-real-time system; secondly, according to the timing condition, an ending frame is triggered by fault feature ending and the cycle number; a non-real-time system UDP client task thread receives a first-frame UDP network message, backs up recording related parameter information and stores the recording related parameter information as recording configuration information files such as CFG, HDR and INF; and a non-real-time system UDP client task thread receives the recording data and generates a DAT file. According to the method, real-time system fault triggering and continuous file generation are not influenced.

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a user equipment (UE) may communicate network traffic splitting information associated with the UE and a companion UE, the network traffic splitting information indicating splitting information of network traffic associated with a first modality corresponding to a multi-modal service identifier and a second modality corresponding to the multi-modal service identifier. The UE may communicate, based at least in part on the network traffic splitting information, one or more network packets of the network traffic. Numerous other aspects are described.