716 results about "Network packet" patented technology

The invention discloses a big data auxiliary key generation method and system in communication data encryption transmission, and relates to the technical field of big data analysis and processing. The dynamic entropy source processing module is used for generating a high-randomness entropy pool by combining an information entropy quantification model and adopting a Shannon entropy and minimum entropy fusion algorithm; the anti-quantum key generation module is used for generating a dynamic variable-length key seed based on an entropy pool driven post-quantum cryptographic algorithm; the hierarchical key negotiation module adopts a clustering Diffie-Hellman protocol, dynamically divides negotiation according to network topology, and precomputes and reduces the load of a core network through edge nodes; and a lightweight verification and update module. According to the method, high-entropy sources such as environmental noise, user behaviors and equipment hardware fingerprints are fused with low-entropy sources such as network messages and sensor data, and an intelligent acquisition strategy and a nonlinear decorrelation technology are combined, so that the anti-quantum dynamic entropy pool is generated, and the randomness of a secret key and the reliability of the entropy sources are improved.

A system and method for user-level network trace and tracking which leverages the uniqueness of verified authentication objects as metadata tags on captured network packets to gain insight at the user-level of how a network and various applications interact. The tagged network packets may be tracked, and the resulting data formed into a trace and track dataset to create one or more user-level dependency graphs alongside captured temporal dynamics. The trace and track dataset may be enriched with application trace information and runtime instruction data to improve the executable graph and provide deeper insight into application and user security on a given network.

A system and method for comprehensive data utilization and tracking comprising an ontological engine which in some embodiments is configured to create and curate various industry-specific ontologies which can be used to provide deeper context to an enterprise's network traffic and data transmission. The system and method further comprise a tagging and tracking engine configured to inspect network packets, apply a first tag associated with an authentication object, apply a second tag associated with an identified ontology, and track the tagged packets as they traverse the enterprise network, generating data utilization tracking information as the packets move through the network. A scoring engine may leverage the data utilization tracking information in combination with user entity and behavior data to compute a risk score associated with data utilization on the enterprise network.

A system and method for attacker interdiction using user-level network trace and tracking which leverages the uniqueness of verified authentication objects as metadata tags on captured network packets to gain insight at the user-level of how a network and various applications interact. The tagged network packets may be tracked, and the resulting data formed into a trace and track dataset to create one or more user-level dependency graphs alongside captured temporal dynamics. The trace and track dataset may be enriched with application trace information and runtime instruction data to improve the dependency graphs and provide deeper insight into application and user security on a given network. Attacks may be detected by analyzing the dependency graphs, and attacker interdiction may be implemented by actively orchestrating network security and IT devices using SOAR workflows.

The invention relates to the technical field of communication networks, and discloses a service channel time slot allocation method, which comprises the following steps of: 1, acquiring network data in real time from network equipment, the network data comprising bandwidth utilization rate, delay, packet loss rate and service flow type; 2, predicting future network flow fluctuation through a long-short-term memory network model based on historical flow data and real-time network data; and step 3, dynamically adjusting the allocation of time slot resources according to the network flow fluctuation prediction result, and preferentially allocating the time slot resources for high-priority services. According to the method, the dynamic adjustment of the time slot resources is realized by combining the flow prediction of the LSTM model and the Q-learning reinforcement learning algorithm, so that the system can flexibly allocate the resources according to the actual network load condition, the resource waste is reduced, the utilization efficiency of the bandwidth is improved, and the utilization rate of the overall network resources is remarkably improved especially under the condition of high network load.

The invention discloses a network data intelligent tool system and method based on a model context protocol MCP, and relates to the technical field of computer networks. The system comprises an AI analysis main body, an MCP Pcap tool engine, context management, a Pcap data source, various MCP Pcap tools, a Pcap tool gateway interface, a Pcap tool interface and a data packet interface. The invention provides an interaction mechanism of direct embedding and bypass data forwarding in tool calling. According to the method, direct embedded transmission of small-size data in tool calling is supported, separation of data transmission and instruction calling is achieved, the technical bottleneck that large-size Pcap data cannot be efficiently exchanged through a text channel is effectively overcome, efficient processing of the AI model on network packet capture data is achieved, and the data transmission efficiency is improved. And the efficiency and the automation degree of large-scale network traffic analysis are improved.

The invention discloses a network topology and equipment resource information display method and device, equipment, a medium and a product, and relates to the field of network topology monitoring, and the method comprises the steps: employing a data collection module to collect network data; the network data comprises network topology information and resource information; carrying out optimization processing on the network data by utilizing a data processing module, and determining optimized network data; dynamically generating a network topology view according to the optimized network data by using a generation module of a display screen interface on the basis of the equipment operation state and the site connection relationship; based on a user interaction module, the link information of each link, the basic information of each network node and the resource state information in the network topology are displayed in a graded mode according to the network topology view, the information display effect in a large-scale network environment is optimized, and the resource state can be displayed in real time.

The invention discloses a construction project whole-process management system and method with a BIM3D-6D technology as a base, and relates to the technical field of construction project management, and the method comprises the steps: loading a 3D building information model through a BIM lightweight calculation server, extracting the spatial topological relation and IFC semantic attributes of geometric components, and carrying out the calculation of the 3D building information model through a BIM lightweight calculation server; spatial topology analysis and semantic attribute mapping are carried out on the spatial topology relation of the geometric components and the IFC semantic attributes, and a three-dimensional data topology network packet based on a graph structure is generated; performing multi-dimensional deduction operation on the three-dimensional data topology network packet based on the graph structure to obtain a deviation compensation strategy containing an optimal cost control path; and carrying out dimension expansion and data fusion on the 3D building information model to generate a 5D cost dimension data set. Discrete decisions are converted into a continuous field model through mathematical transformation, so that a resource flow path has spatial relevance and time continuity, and the beneficial effect of dynamically optimizing a construction process is achieved.

The invention relates to the technical field of network flow analysis, in particular to a non-intrusive network flow real-time analysis method and system based on an eBPF, and the method comprises the steps: deploying an eBPF program in a kernel mode, and capturing a network data packet entering a kernel protocol stack in real time; identifying an application layer protocol type and analyzing a key field; the structured data is transmitted to the user mode through the annular buffer area; and the user state carries out TCP stream recombination and session-level aggregation statistics on the structured data. According to the invention, on the premise that application codes are not modified, real-time and structured protocol analysis can be carried out on various common application layer protocols in a kernel layer; end-to-end delay is accurately disassembled through a full-link delay disassembling mechanism, and a performance bottleneck link is positioned; the analysis result is output in the form of structured data, second-level performance statistics and abnormal behavior detection are supported, and the operation and maintenance analysis efficiency and the system observability are remarkably improved.

The present application belongs to the technical field of data processing and relates to a network message processing method and apparatus, and a computer device and a storage medium. The method comprises: on the basis of a received target network message, acquiring a target memory block from a pre-constructed shared memory pool, so as to generate a message memory; on the basis of a network-interface-card driver, performing first identification processing on the target network message, so as to obtain a target network message descriptor; on the basis of the target network message descriptor, performing second identification processing on the message memory, so as to obtain a first socket buffer; and performing parsing processing on the first socket buffer by means of a network protocol stack, and on the basis of a parsing processing result, reading network message data from a virtual memory corresponding to the message memory, so as to complete the processing of the network message. In the present application, on the basis of a constructed shared memory pool, zero-copy network packet reception can be realized during network message processing, thereby avoiding performance loss caused by the memory copy of messages.

The invention relates to the technical field of network routing, and provides a real-time traffic analysis method and system for network routing, and the method comprises the steps: obtaining a network data packet of the network routing, carrying out the data preprocessing, generating a traffic event atlas, generating a dynamic threat score, carrying out the feature extraction of the traffic event atlas, and generating a behavior abnormality matrix; analyzing the abnormal behavior matrix and the dynamic threat score, generating an initial network routing strategy, and analyzing the initial network routing strategy to obtain network performance and security evaluation indexes; and adjusting the network routing based on the evaluation index to obtain an adjustment strategy, carrying out iterative optimization on the adjustment strategy to obtain a target network routing strategy, and carrying out forwarding processing on the network data packet based on the target network routing strategy to obtain a real-time flow analysis result of the network routing. Through the above scheme, real-time, dynamic and accurate analysis of the network traffic is realized, and the problems of low detection precision, slow response speed and lack of real-time adjustment capability in a highly dynamic and complex network environment are improved.

In an aspect, a system for an optimally balanced networked system is disclosed. The system includes a fabric adapter communication system communicatively coupled to a plurality of network ports and a plurality of controlling hosts. The fabric adapter communication system is configured to receive a network packet from, or transmit a network packet to, a network port of the plurality of network ports. The fabric adapter communication system is configured to separate the network packet into different portions, each portion including a header or a payload. The fabric adapter communication system is configured to forward the headers of the different portions to one or more controlling hosts. The fabric adapter communication system is configured to forward multiple payloads of the different portions in parallel through a bundled interface to multiple memory buffers of a global memory pool based on one or more scatter gather lists (SGLs).

The invention relates to the technical field of network security, and particularly discloses an edge device network threat detection method and system based on an electric power large model, and the method comprises the steps: capturing a network message sequence in real time, extracting a time sequence randomness feature and a semantic deviation feature from a time dimension and a protocol dimension, and carrying out the fusion to form a comprehensive threat feature vector; performing multi-dimensional feature analysis and time sequence modeling by adopting a lightweight electric power large model to realize millisecond-level threat assessment; establishing a multi-level response mechanism, dynamically triggering a differential protection strategy according to the threat level, and ensuring the reliability and consistency of response actions through digital signature and collaborative verification; according to the method, the complex network attack in the power edge equipment can be effectively identified, the threat detection accuracy and the system defense capability are improved, and the strict requirements of a power system on real-time performance and reliability are met.

A networking device in a HA configuration processes network flows for a VNIC. Network configurations include networking policies that govern network packet processing by the networking device. Global epoch values are associated with each version of the network configuration. The networking device has a control plane, a data plane, and a flow table. The control plane uses the most recent network configuration to produce flow table entries to be stored in the flow table and the data plane uses the flow table entries to process network packets. Flow table entries include flow epoch values that match the global epoch value associated with the network configurations used to create the flow entries. A datapath epoch value, a VNIC peer epoch value, and a VNIC local epoch value are associated with each VNIC. The various epoch values are used to ensure consistent flow table entries among the peers in the HA configuration.

The present invention extends to methods, systems, and computer program products for optimizing resource allocation in view of predicted network traffic patterns and predicted power consumption. Network packets defining a network traffic flow can be received at a platform over time. Metrics can be derived from one or more applications executing on resources of the platform and processing data contained in the network data packets. Model training data can be formulated from the metrics. A resource adjustment model can be trained using the model training data. Executing the model can be automated to adjust resource allocation at the platform. Additional network packets defining an additional network traffic flow can be received at a platform over time. Data contained in the additional network packets can be processed using the adjusted resource allocation.

In general, techniques are described for a SDN architecture system that implements an integrated gateway service. In an example, network controller comprises processing circuitry and memory and is configured to: configure a virtual network in a cluster of nodes of a compute infrastructure, the cluster of nodes managed in part by the network controller; receive a manifest for a gateway service instance that abstracts a transit gateway resource configurable in a plurality of different types of compute infrastructures, wherein the manifest specifies an intended state of a transit gateway object of the gateway service instance; and reconcile the intended state of the transit gateway object for the gateway service instance by sending configuration data, generated based on the transit gateway object, to an interface for the compute infrastructure to configure a transit gateway to forward network packets between a compute infrastructure node of the compute infrastructure and the virtual network.

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for securing data. One of the methods includes receiving one or more network data packets. The one or more network data packets include a token that identifies stored sensitive data. The one or more network data packets are desanitized, by: identifying and extracting, from the one or more network data packets, the token; requesting, from a distributed file system, the stored sensitive data, based upon the token; and receiving, in response to the request, the stored sensitive data as received stored sensitive data.

Embodiments relate to analyzing network packets in a telecommunication networks using machine learning models. The network packets are correlated and then labeled to indicate successes or failures in a subtask of communication flow. Features are extracted based on the labels and correlated network packets. The extracted features are applied to a machine learning model to predict or infer success or failure of the entire communication flow. The result from the machine learning model may again be applied to subsequent machine learning models to predict root cause of a failure or to predict or infer the type of success. In this way, more accurate diagnosis of network issues in the telecommunication networks may be made in a more expedient manner.

This disclosure describes methods, devices and systems for abnormal network data identification and policy enforcement. An example method includes obtaining incoming network data from a network device, the networking data including operating information for the network device and packet metadata. The method also includes classifying the incoming network data using one or more machine learning models, including identifying abnormal network data from the incoming network data. The method further includes causing a policy rule to be generated based on the abnormal network data.

Disclosed embodiments receive an event stream from a remote capture agent. The event stream includes timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent. A graphical user interface (GUI) is caused to be displayed for obtaining configuration information for configuring the generation of time-series event data from network packets captured by the remote capture agent. A set of statistics is generated from the time-series event data, and the configuration information is updated to trigger subsequent storage and processing of at least a portion of the event stream by one or more components on a network based on one or more of the statistics, a storage limit associated with the time-series event data, an index volume of the event stream, a historical trend associated with the statistics, or input through the GUI.

The invention discloses an AI agent data protection method and device based on a controlled execution environment, and the method comprises the steps: verifying the integrity of a safety decision monitoring module in each service node kernel of a cloud side through a remote authentication service in a trusted execution environment, and verifying whether the service nodes of the cloud side are all operated in the trusted execution environment or not; the starting environment is safe and credible; the cloud side receives the security configuration from the user side and distributes the security configuration to the security decision monitoring module of each service node; firstly, security check is executed on a service request to be sent by an AI agent, the service request is received by a cloud side service node after compliance, and a security decision monitoring module of a cloud side gateway service node intercepts a received network packet and judges whether the service request is normal traffic; when other service node services of the cloud need to be called, continuing to judge whether the traffic meets the security configuration configured by the user; and the security decision monitoring module is established based on an eBPF and is used for intercepting a received or sent network packet and realizing verification and auditing functions.

A network packet can be received at a host and it can be determined if such packet has a valid cryptographic public key for a destination host. If there is no known valid cryptographic public key, it is determined whether the network packet is a first network packet sent to the destination host, and if so, a queue is designated for network packets addressed to the destination host and a key management server is queried for a valid cryptographic public key associated with the destination host. Otherwise, the network packet is placed in a queue designated for the destination host until a valid cryptographic public key associated with the destination host becomes available. Upon a valid cryptographic public key associated with the destination host becoming available, the network packet is processed, encrypted and sent to the destination host.

An intrusion prevention system can be embedded in an industrial controller to detect possible attacks on the corresponding physical system of the industrial controller. The intrusion prevention system can analyze the payload of network packets received at the industrial controller and predict what harm the payload of the network packet could cause to the physical system if executed by the industrial controller. To predict how the payload of a network packet may affect the physical system, the intrusion prevention system can perform a simulation with the payload of the network packet. The simulation can incorporate a model of the physical system, a copy of the logic used by the industrial controller and information relating to the current state of the system. The result of the simulation can be new predicted states for the physical system that can be evaluated to determine if a safety violation has occurred.

A service provider may deploy a security threat detection and mitigation platform in a multi-tenant virtualization environment that includes pluggable data collection, data analysis, and response components. The data analysis components may apply machine learning techniques to generate (based on training data sets) and refine (based on subsequently received data sets and feedback about the resulting classifications) predictors configured to detect particular types of security threats, such as denial of service attacks, botnets, scans, or remote desktop attacks. A data collection layer may collect, filter, organize, and curate network packet traffic data, network packet header data, or other information emitted by computing instances or applications executing on them, and provide the curated data as streams to the analysis layer. A response layer may automatically take action in response to threat detections (which may be overridden by an administrator) and may store classification data for subsequent analysis, feedback, and predictor refinement.

The invention discloses a cluster network control method and device, and relates to the technical field of artificial intelligence, and the method comprises the steps: collecting the interaction time consumption of information interaction between a target GPU card in each GPU server and target GPU cards in other GPU servers in a process that each GPU server in a cluster network executes each round of large model training task; the target GPU cards in the different GPU servers are used for executing the same subtask of the large model training task; according to the collected interaction time consumption between the target GPU cards, determining the target GPU cards needing interaction optimization; and the transmission priority of the network packet of the target GPU card needing interaction optimization is improved, so that the interaction time consumption of the target GPU card needing interaction optimization is reduced.

The invention relates to the technical field of cloud computing, in particular to a method and a system for realizing ARP (Address Resolution Protocol) attack prevention of a credential operating system without occupying CPU (Central Processing Unit) resources, which comprises the following steps of: directly taking over an RX direction data packet of a network card by utilizing an XDP (Extensible Data Processing) technology of an operating system kernel so as to filter the network data packet before a network protocol stack of the operating system kernel; a control interface is added, is used for controlling opening and closing of an ARP protection function and is responsible for issuing and deleting rules, and meanwhile, a time parameter T and the maximum message number Max within T time are configured; compared with the traditional ARP anti-attack technology, the method and the system for realizing the ARP anti-attack of the credential operation system without occupying the CPU resource have the beneficial effects that the ARP message is directly filtered at a network card drive inlet, so that the impact of the ARP attack message on the CPU is reduced; the operating system has an ARP anti-attack function, does not depend on a third-party application, and is safe and reliable; the self-adaptive ARP filtering technology can intelligently adjust an ARP blacklist, and when an attack source returns to normal, ARP learning can be automatically recovered.

This disclosure describes methods, devices, and systems for network anomaly detection and policy enforcement. An example method includes obtaining metadata for a plurality of network packets. The method also includes detecting an anomaly in the plurality of network packets by analyzing the obtained metadata and the operating information. The method also includes generating, without user input, a policy rule based on the detected anomaly. The method further includes enforcing the policy rule at the one or more network devices.

Packets received at a routing intermediary and directed to a resource are transmitted to a data plane node of a partition of a traffic management service. The data plane node transmits an indication of a high-arrival-rate destination group, identified based on a metric of network packets received at the data plane node, to a control plane node of the service. A resource is identified at the control plane node as a rate limiting target based on high-arrival-rate group information from several data plane nodes. A limit is applied to the rate at which packets are received at the target. The control plane node changes the number of data plane nodes in the partition based on a triggering condition.

An embodiment establishes a network model based at least in part on network data received from a network, wherein the network data comprises device data and certificate data. The embodiment samples the network to receive a network data sample. The embodiment compares the network data sample to the network model to determine whether an anomalous amount of devices is present in the network. The embodiment compares the network data sample to the network model to determine whether an anomalous amount of certificates is present in the network. The embodiment identifies a device population anomaly upon a determination that an anomalous amount of devices and / or an anomalous amount of certificates is present in the network.

The invention provides a dynamic risk awareness cross-border data flow real-time monitoring method, and relates to the technical field of data security, and the method comprises the steps: deploying a monitoring agent on terminal equipment with a data collection function, capturing original data flow in real time, and obtaining related information; analyzing the network data packet to determine a cross-border flow condition; comparing the original data with a preset format library; identifying an encryption algorithm for unmatched data through static and dynamic analysis and decrypting the unmatched data; comparing the decrypted data with the sensitive data to judge whether the decrypted data is the sensitive data or not; the transmission condition is monitored in real time, an alarm is triggered when abnormity occurs, information is recorded, and a library and rules are updated. According to the cross-border data flow monitoring method and device, the monitoring agent is deployed on the terminal equipment, and cross-border data flow is effectively monitored by means of comparison of the preset format library, static and dynamic analysis and the like.