293 results about "Operating system kernel" patented technology

The invention discloses an intelligent resource scheduling method and system based on task characteristics and system state perception, and relates to an operating system kernel optimization technology. According to the method, resource demand types, importance labels and time sensitivity of tasks are captured in real time through an eBPF technology, system bottlenecks are recognized by combining / proc and sysfs file system data, a dynamic scheduling strategy is generated by adopting an improved Q-Learning model, and resource allocation is executed through a schemed * function and a cgroup v2 interface. The problems that a traditional scheduler is poor in self-adaptive capacity and resources are mismatched are solved, the actually-measured resource utilization rate is increased to 85%-92%, and the key task delay standard reaching rate gt is achieved; the method is suitable for edge computing, cloud servers and other high-concurrency scenes.

The invention provides an NPU instruction level context switching method and device, and relates to the technical field of data processing.The method comprises the steps that when a context switching instruction is received, a non-refresh instruction is forbidden, it is waited for completion of an instruction being executed, and context data is stored in a main storage module; after completion, recovering the context switching related instruction of the NPU module, and executing the target task; and after the target task is executed, recovering the context data to the NPU module, and recovering the execution of the non-refresh instruction. According to the method, optimization is carried out aiming at the problem that an existing NPU architecture generally can only support limited preemption at an algorithm boundary or a specific context switching point and even cannot preemption, so that a high-priority task must wait for a low-priority task to be completed, and remarkable priority inversion and / or key inversion are / is caused. A full-stack solution from a system on chip to an instruction set architecture and then to an operating system kernel is provided, and preemption of an NPU instruction level is achieved.

The invention discloses a data packet analysis method and device based on eBPF and electronic equipment. Relates to the field of cloud computing, and the method comprises the steps that a to-be-analyzed data packet captured by an eBPF kernel mode program from an operating system kernel is acquired based on an extended Berkley data packet filter eBPF user mode program, the eBPF user mode program is a program running in a user space of an operating system, and the eBPF kernel mode program is a program running in a kernel space of the operating system; determining a target analytic function; a target analytic function on a function calculation platform is called through the flow entry function, and the function calculation platform is a service system for operating the function according to needs; and based on the target analysis function, performing analysis processing on the to-be-analyzed data packet to obtain an analysis result of the to-be-analyzed data packet. According to the method and the device, the problem of limited processing capability of an eBPF flow analysis system on a single node in related technologies is solved.

The invention relates to the technical field of cloud computing, in particular to a method and a system for realizing ARP (Address Resolution Protocol) attack prevention of a credential operating system without occupying CPU (Central Processing Unit) resources, which comprises the following steps of: directly taking over an RX direction data packet of a network card by utilizing an XDP (Extensible Data Processing) technology of an operating system kernel so as to filter the network data packet before a network protocol stack of the operating system kernel; a control interface is added, is used for controlling opening and closing of an ARP protection function and is responsible for issuing and deleting rules, and meanwhile, a time parameter T and the maximum message number Max within T time are configured; compared with the traditional ARP anti-attack technology, the method and the system for realizing the ARP anti-attack of the credential operation system without occupying the CPU resource have the beneficial effects that the ARP message is directly filtered at a network card drive inlet, so that the impact of the ARP attack message on the CPU is reduced; the operating system has an ARP anti-attack function, does not depend on a third-party application, and is safe and reliable; the self-adaptive ARP filtering technology can intelligently adjust an ARP blacklist, and when an attack source returns to normal, ARP learning can be automatically recovered.

The invention relates to an operating system startup exception processing method and device, equipment, a medium and a program. The method comprises the steps that when an operating system is started, a loading program is guided to load an external initramfs file into a memory, and an initial address of the external initramfs file is transmitted to a kernel of the operating system; performing Hash verification on the external initramfs file by executing the Hash verification function to obtain a Hash value of the external initramfs file; the operating system kernel decompresses the external initramfs file into a root file system according to the initial address; and when it is determined that the external initramfs file cannot be normally decompressed, determining a decompression failure reason according to a comparison result of the hash value of the external initramfs file and an expected hash value. And reporting the decompression failure problem to the corresponding processing object according to the decompression failure reason. By adopting the method, the decompression failure reason can be quickly and accurately positioned, the decompression failure problem can be pointedly processed, and resource waste is avoided.

The invention relates to a multi-master election method and device based on an OpenHarmony soft bus, and the method comprises the steps: constructing six efficiency indexes according to the networking characteristics of the soft bus; operating system kernel state extraction: increasing a subsystem in an operating system layer, expanding system capability, obtaining index data of each device in a network in real time, storing the index data in a distributed database, and extracting required data from the distributed database by a multi-main election component to calculate and lift the device; performing analytic hierarchy process index weight construction and election formula derivation: establishing an efficiency index score system through an analytic hierarchy process, and calculating the weight of each index at the level to which the index belongs; and after the weights are determined, performing corresponding fuzzy judgment on each index by using a fuzzy comprehensive judgment method from the bottom-layer index, and finally obtaining a judgment score. According to the invention, the problem that the traditional open-source soft bus solves the problem that the single-center networking survivability of the traditional soft bus is insufficient is solved.

The invention relates to the technical field of cloud computing networks, and provides a traffic speed limiting system, a traffic speed limiting method and a traffic speed limiting device. The system comprises a network element agent unit, a monitoring unit, a speed limiting configuration unit, a program loading unit, a speed limiting execution tool and a filter agent unit. When the monitoring unit monitors that the life cycle or the bandwidth configuration strategy of the network element agent unit is changed, the speed-limiting configuration unit is triggered to obtain a bandwidth speed-limiting execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy; the program loading unit updates ip address bandwidth mapping data in the filter speed limiting program file through the speed limiting execution tool and the bandwidth information configuration file; and the program loading unit also acquires and loads a filter speed limiting program file to an operating system kernel, so that a speed limiting execution tool realizes flow speed limiting according to ip mapping data and bandwidth mapping data in the file and a bandwidth speed limiting execution mode. By adopting the system, the expandability can be improved.

The invention provides an automatic test generation platform and method for an operating system kernel derived function. The method comprises the following steps: (1) intelligent symbol extraction and analysis; (2) generating an LLM-driven test code; (3) performing automatic compiling and virtualization testing; and (4) intelligent error diagnosis and repair. According to the method, the test coverage degree is greatly improved, through the multi-level symbol context extraction technology, single function information is extracted, the dependency relationship of related functions in the same element is analyzed, a function call graph and data flow analysis are constructed, rich context information is provided for LLM, and the problem that traditional manual test case writing is incomplete in coverage is solved.

The invention discloses a trusted execution environment construction method, system, equipment and medium for electric power intelligent equipment, and relates to the technical field of electric power intelligent equipment monitoring, and the method comprises the following steps: carrying out Hash measurement on a to-be-detected area in an operating system kernel, carrying out comparison based on a preset reference value, and monitoring the consistency of kernel static data and codes; performing list management and integrity verification on the system kernel module, and identifying illegal loading, unloading or tampering behaviors; monitoring a kernel module event, sensing the change of the life cycle of the module and dynamically triggering a verification mechanism; performing Hash verification on an execution file of the specified user space process, and identifying process-level illegal replacement or injection behaviors; and updating the trusted measurement database based on a detection result, and executing log recording, alarming and blocking strategy response. The method does not depend on a chip, a virtualization platform or hardware extension, realizes security monitoring only through a software means, and is suitable for an embedded terminal with limited resources.

The embodiment of the invention discloses a multi-level safety protection system and method based on an electric power internet of things operating system. The system comprises a security module, a firmware integrity verification module, a kernel protection module and a file encryption module. The security module is used for performing security protection on security startup, isolation, intelligence and network in the electric power internet of things operation system; the firmware integrity verification module is used for performing integrity check on firmware of the electric power Internet of Things operating system and protecting a kernel, a memory, process management and files of the electric power Internet of Things operating system at the same time; and thus, protection in the starting and running processes of the electric power internet-of-things operation system is facilitated. The security protection system is established on the underlying security of the electric power Internet of Things operating system, is beneficial to the construction of an omnibearing protection mechanism of the electric power Internet of Things operating system, and prevents the electric power Internet of Things operating system from being attacked and data from being stolen.

The invention discloses a kernel probe generation method and device, computer equipment and a storage medium, and relates to the technical field of operating system kernel monitoring, and the kernel probe generation method comprises the steps of obtaining a target metadata file corresponding to a current operating system kernel in response to a kernel probe generation request; determining a target declarative strategy file; and determining a target program logic file corresponding to the target declarative strategy file, and generating a probe code according to the target program logic file and the target metadata file to obtain a kernel probe program. The probe program source code adaptive to the current kernel version can be dynamically generated in combination with the target metadata file and the target declarative strategy file, kernel probe development logic and underlying kernel knowledge can be decoupled through the source code generation function, and developers do not need to deeply understand kernel internal data structures and version differences; the development threshold is lower, a specific operating system or probe type is supported, and a universal Linux kernel and multiple probe types are also supported.

Methods and apparatus for real-time security monitoring on a computing device are presented. A system may define privileges to access hardware interfaces for each process of a plurality of processes executing on a computing device. The privileges may be defined in a privileged operating system level that controls root access to an operating system. In response to a determination that a process is attempting to access a hardware interface, the system may determine whether the process is privileged to access the hardware interface by checking the privileges. In response to determining that the process is not privileged to access the hardware interface, the intrusion detection agent may terminate the process.

The invention discloses a self-adaptive CPU (central processing unit) priority scheduling method based on near-end strategy optimization, which comprises the following steps of: firstly, establishing a task scheduling model in a simulation environment, performing matrix processing on a current task queue state and a task characteristic into an environment state for input, and extracting a task sequence time sequence characteristic by introducing a gating circulation unit; and respectively outputting task priority strategy distribution and state value estimation by using a dual-network architecture of PPO. In the training process, a course learning mechanism is adopted to gradually transit from a short task load scene to a complex mixed load. During operation, the trained scheduling agent is deployed to an operating system kernel scheduler, the priority of each task is output in real time according to the current state, and a rapid scheduling decision is realized by means of a priority heap. Through a multi-target reward function, the intelligent agent is guided to optimize the system throughput, the task average response time and the hunger prevention index at the same time, and extreme unfair scheduling is avoided. Experiments show that the method shows relatively high performance, stability and robustness in heterogeneous task, high concurrency and long-tail load scenes, and the system resource utilization rate and the user experience are effectively improved.

The invention discloses a trusted startup design method of a server, and belongs to the technical field of information security and trusted computing, after the server is powered up, a trusted root CPU core is started preferentially, a trusted startup program is operated, and a security environment is initialized; integrity measurement and verification are conducted on the BIOS, and after verification is passed, other CPU cores are released, and the BIOS is operated; the service CPU core loads a bootstrap program GRUB and submits the bootstrap program GRUB to the trusted root CPU core for verification; then loading an operating system kernel image and executing hash measurement, and calculating a path entropy value in combination with control flow information in a kernel initialization stage; performing segmentation comparison on the memory image and the disk mirror image, and calculating a mapping consistency coefficient; if the verification is passed, continuing to start the operating system; according to the method, the tampered component in the system startup chain can be effectively prevented from being loaded and operated, and the startup safety and the overall credibility of the server are enhanced.

The invention discloses an eBPF-based non-intrusive application runtime protection method and system, and the method comprises the steps: firstly collecting BTF information of a target operating system, generating an eBPF kernel program adaptive to a local kernel version according to the BTF information, and loading the eBPF kernel program to an LSM control point of an operating system kernel; generating legal behavior description configuration according to known operation information of the protected application, and distributing the legal behavior description configuration to a corresponding storage mechanism of an eBPF Map in a kernel; when a protected application initiates a system call, an eBPF kernel program mounted on a corresponding LSM control point intercepts and queries legal behavior description configuration in an eBPF Map, if the system call is matched with the legal behavior description configuration, execution is allowed, and if the system call is not matched with the legal behavior description configuration, the call is blocked, so that the application is effectively protected during running, and the method has the non-invasive characteristic. Application codes are prevented from being modified; the kernel is adapted based on BTF information, so that the program stability and compatibility are guaranteed; illegal calling is effectively prevented through a legal behavior description mechanism, and a reliable environment is provided for application running.

The invention discloses an operating system security control method and system, and the method comprises the steps: capturing all host behaviors in real time in an operating system kernel layer, carrying out the analysis and learning, and constructing a host behavior model through employing the analysis and learning result of the host behaviors; if a program is started or operated at the current moment, capturing a corresponding host behavior at a kernel layer of an operating system, verifying the host behavior at the current moment by using a host behavior model, if the verification is passed, allowing the host behavior at the current moment, and if the verification is not passed, stopping the host behavior at the current moment so as to realize mandatory access control on the host behavior; and if the blocked host behavior meets the preset judgment condition, updating the host behavior model by using the blocked host behavior. According to the method, the host behavior model is used as the security baseline of the host system, zero-trust mandatory access control is performed on all host behaviors in the kernel layer of the operating system, a zero-trust security kernel of the operating system is formed, and all-around protection is provided for the security of the host system.

The invention relates to the field of system optimization, and discloses a Linux-based domestic operating system kernel cutting optimization system, which comprises a hardware baseline identification module used for acquiring a processor architecture, peripheral and bus topology, storage and network resources and firmware capability of target equipment and generating hardware baseline description; the scene portrait construction module is used for statically and dynamically observing a target application and acquiring operation portrait data including system calling, driving access and interruption events to form a scene portrait; a dependency analysis module; a multi-target constraint solving module; configuring a synthesis and construction module; and a verification and difference feedback module. According to the method, portrait analysis is carried out on calling of a target application, driving access and interruption events, a trigger threshold value is set, dependency solving is executed in a high touch module range, scene-driven cutting decision is achieved, the dependency closure calculation range is made to be consistent with an actual operation behavior, redundancy and invalid dependency are reduced, and cutting precision and kernel construction efficiency are improved.

The invention relates to the field of operating systems, in particular to an AI server operating system fault detection and recovery method and device. The method mainly comprises the steps that a hard disk file system serves as a guiding mode when the operating system is started, a first heartbeat packet is interacted between a monitoring management module and a hard disk monitoring module in the hard disk file system, and the starting state of the operating system is obtained according to the first heartbeat packet; a second heartbeat packet interaction is established between the monitoring management module and the BIOS, the monitoring management module feeds back the starting state to the BIOS through the second heartbeat packet, when starting fails, the BIOS switches the guiding mode to the memory file system, and the operating system is started through a system root file pre-stored in the memory file system. According to the method, the influence of two fatal server operating system faults, namely incapability of normally starting an operating system kernel and incapability of normally loading a root file system, can be effectively reduced, and the loss caused by the starting fault of the server is avoided.

The invention discloses a heap ejection attack defense method and system based on eBPF and memory detection, and belongs to the technical field of system security. The method comprises the following steps: detecting space memory allocation of an operating system compiled with an eBPF program; establishing an abnormal distribution detection model based on the normal behavior; judging whether the memory allocation request is normal or not by using an abnormal allocation detection model; continuously monitoring a subsequent system calling condition of the abnormal memory allocation request, and judging whether a calling chain required by a malicious behavior is executed or not; and establishing service safeguard measures to ensure normal and stable operation of the operating system. According to the method, the non-invasive eBPF program is added on the operating system, and the dynamic programming characteristic of the eBPF kernel is utilized, so that the modification of kernel codes and user program codes is avoided, and the implementation is more flexible; the method is effective for operating system kernels of different versions, non-intrusive defense addition is achieved for firmware, the kernel does not need to be recompiled, and the system calling parameter monitoring and data obtaining capacity is provided.

The containerization system architecture comprises a privilege-level operating system kernel, a resource management mechanism, a security isolation mechanism, a container task real-time performance guarantee mechanism, an equipment management distribution mechanism and a communication mechanism between containers, wherein the resource management mechanism, the security isolation mechanism, the container task real-time performance guarantee mechanism and the equipment management distribution mechanism are required by containerization; the containers running at the non-privilege level comprise application containers and system service containers, and the application containers comprise real-time containers and non-real-time containers; and the container manager running at the non-privilege level provides the functions of container deployment, container arrangement, health monitoring and performance monitoring. The problem that the current domestic Quhua embedded real-time operating system lacks native containerization capability is solved, the lightweight embedded real-time operating system is used for expansion to realize security isolation between containers, the priority of task keys and the strong real-time performance of the key tasks are ensured, and the security isolation between the containers is realized. And the operation deployment requirements on the embedded containerized application in the security key field are met.

The embodiment of the invention relates to the technical field of terminal security management, and discloses a kernel management method and device based on Hypervisor, and the method comprises the steps: obtaining abnormal event information of an operating system kernel of terminal equipment; determining virtual address field information corresponding to the abnormal event according to the abnormal event information; performing virtual memory measurement on the operating system kernel according to the virtual address field information to obtain a memory measurement result; and determining whether data in the kernel of the operating system is tampered or not according to the memory measurement result. According to the embodiment of the invention, effective detection and protection of data tampering in the kernel of the operating system are realized, and the overall security and system integrity of the terminal equipment are improved.

The invention belongs to the technical field of computer man-machine interaction and automatic control, and particularly relates to an RPA mouse and keyboard control method and system for a Wayland desktop. The method comprises the following steps: S1, creating and registering a virtual input device supporting mouse and keyboard functions in a user space by accessing a virtual input device interface provided by an operating system kernel; s2, current activity display output is detected, and screen resolution information is obtained; s3, the server program monitors a preset local Unix domain socket path for receiving a control instruction from the client; s4, the client sends a control request to the local Unix domain socket path in a structured format, and the server receives and analyzes the control request; s5, the server side maps the analyzed control request into a corresponding kernel input event sequence according to the operation type; meanwhile, by writing event data into the virtual input device, an input event is injected into the system so as to simulate a control operation on the graphic desktop.

The invention provides an operating system kernel configuration method, a model training method and a related product, and relates to the technical field of computer networks. According to the method, the obtained hardware configuration information of the computing node and the operation characteristics of the computing node in the operation task state are input into the kernel parameter configuration model, and it can be ensured that the output parameter configuration value is matched with the hardware resource of the computing node and is the parameter configuration value for the specific operation task. Moreover, according to the method, the operating system kernel of the computing node is generated through the parameter configuration value output by the kernel parameter configuration model, and the generated operating system kernel is deployed on the computing node, so that automatic dynamic optimization of the operating kernel of the computing node can be realized, the workload caused by manual configuration and manual optimization is reduced, and the operating efficiency of the computing node is improved. The adaptive capacity of the operating system kernel to hardware resources and operation task requirements is improved, so that the configuration rate and accuracy of the operating system kernel are improved.

The present invention provides an operating system kernel fuzz testing method, device and equipment, which relate to the field of kernel fuzz testing technology. By obtaining the initial input and splitting the initial input to generate an input set; performing fuzz testing on the input set and obtaining the fuzz testing results; storing the fuzz testing results in a key component inference file to generate a key component inference table; generating a seed selection strategy in the seed library in combination with the key component inference table to guide seed mutation selection. By identifying and utilizing the key components in the system call sequence, the coverage of the fuzz test is improved. A correspondence between the key components in the system call sequence and the corresponding path basic blocks is established to better explore potential security vulnerabilities. According to the selection of mutation points, different mutation strategies are executed to effectively improve the existing fuzz testing method and improve the efficiency and quality of vulnerability mining.

The invention discloses a method for improving data acquisition / writing stability, and relates to the technical field of industrial control systems. The method comprises the following steps: firstly, deploying a real-time operating system kernel on general computing hardware, and carrying out real-time transformation on a hardware interface driving program of the real-time operating system kernel so as to lay a deterministic response foundation; secondly, real-time adaptation is carried out on an engine when the container runs, so that the engine has the capability of calling a kernel real-time interface; meanwhile, a non-real-time data acquisition / write-in program is packaged in a standard container mirror image. And finally, through the adapted container runtime engine, creating and running the container instances on the real-time kernel, thereby ensuring the deterministic execution of key real-time tasks on a unified hardware platform, and flexibly deploying non-real-time tasks through a containerization technology to achieve the comprehensive target of efficient utilization of resources and performance isolation.

The invention discloses a hybrid heterogeneous deployment method for improving the running efficiency of an embedded system, and relates to the field of computer embedded operating systems, a neural network is used for performing convolution calculation on a calculation task in a full connection layer to obtain a feature extract as a distribution basis, the task is distributed to Windows and Linux operating systems for the first time, and the operation efficiency of the Windows and Linux operating systems is improved. According to the scheme, real-time level models are established for a first computing task allocated to Windows and a second computing task allocated to Linux respectively, the tasks are allocated to kernel spaces of corresponding operating systems to complete classification operation after real-time evaluation, hybrid heterogeneous deployment is achieved, the advantages of different systems are brought into play, auxiliary allocation of the neural network is more accurate, and the operation efficiency is improved. The real-time level model ensures that high-real-time tasks are processed preferentially, and the requirements for efficiency and real-time performance of an embedded system in a complex scene are met.

According to the embedded BMC software construction method, an operating system kernel which is specially designed and passes verification is provided for a BMC chip, addition of various debugging tools and complex applications is supported, and operability of the transplantation process is improved. The operation steps of the kernel can be displayed by disassembling and various JTAG tools, and the modularization and systematization degree of software solution construction work is enhanced.

The invention relates to the technical field of computers, and belongs to a BIOS (Basic Input / Output System) and BMC (Baseboard Management Controller)-based GPU (Graphics Processing Unit) resource intelligent dynamic optimization method and system. A four-layer collaborative architecture of a firmware layer (BIOS), a management controller layer (BMC), a system layer (operating system kernel) and a hardware layer (GPU equipment) is adopted, and the architecture is a cross-layer closed-loop optimization architecture. An optimization decision function is decoupled from an operating system kernel and is deployed in an independent hardware management unit, namely a baseboard management controller (BMC). The system collects GPU operation data in real time through an operation system kernel space and sends the GPU operation data to a BMC; an intelligent optimization engine deployed in the BMC analyzes and calculates the data to generate an optimal GPU resource scheduling strategy; the strategy is returned to an operating system kernel and finally executed by a hardware layer, and intelligent dynamic optimization of GPU resources is achieved through cross-level interaction. Therefore, a continuous intelligent closed-loop optimization link of'deployment-data acquisition-intelligent decision-making-strategy execution 'is formed.

The invention provides a PCIE (Peripheral Component Interface Express) power consumption testing device, relates to the field of power consumption testing, and can break a barrier between hardware power consumption data and a software system log and innovatively utilize an operating system kernel event tracking system as a unified data fusion platform. A power consumption sampling point collected by external hardware in real time serves as a self-defined event and is injected into a kernel event tracking session in real time, so that the power consumption sampling point and a kernel state change event captured by a system coexist under the same high-precision timestamp, and a unified tracking event stream which is perfectly aligned in time is generated. On the basis, the PCIE abnormal mode is further automatically identified from mass tracking data. Through the deep learning model, the local time sequence characteristics of the power consumption sequence are coded, then the mode evolution rule of the full time domain is further captured, finally, the abnormal state of the PCIE link is accurately and automatically judged, and then the diagnosis efficiency and accuracy of the power consumption problem are improved.

The invention provides an improved scheme of a fuzzy testing system of a Linux operating system. According to the scheme, fuzzy testing is guided by integrating device attributes, driving attributes and topological relations among devices. Specifically, a new syzlang description is generated by deeply analyzing a Linux kernel source code, so that a test case can introduce modification operation of equipment and drive attributes. Meanwhile, according to the scheme, the depth and the breadth of the fuzzy test are improved based on the corresponding relation between the equipment attribute file and the equipment file, so that the behavior of the kernel driver is more effectively explored. In addition, according to the scheme, concurrent testing is guided through the topological relation between the devices, testing cases related to device attributes and drive attributes are increased, the testing efficiency is further improved, the coverage rate of fuzzy testing is increased, and finally the testing process can reveal vulnerabilities caused by memory errors of a kernel of the Linux operating system in different states.