221 results about "Packet filtering" patented technology

A system for real-time detection and mitigation of morphing malware in high-density edge networks, consisting of: a data acquisition unit configured to receive, normalize, and encode multimodal telemetry data streams originating from at least one of the following domains: network traffic, process behavior, system call sequences, binary instruction traces, and control flow graphs; the data acquisition unit is further configured to compute feature embeddings over sliding time windows and apply privacy-preserving redactions prior to storage; a generative neural processor that is operationally coupled to the data acquisition unit and configured to generate synthetic morphing malware variants by learning probabilistic transformations of previously observed malicious data representations, maintaining semantic functionality while varying structural and behavioral features; a discriminative neural processor trained adversarially with the generative neural processor, wherein the discriminative neural processor is configured to detect morphing malware by evaluating a probability distribution over multimodal telemetry embeddings and classifying anomalous process and flow behaviors in real time; a coordination processor that is communicatively connected to both the generative neural processor and the discriminative neural processor and is configured to orchestrate adversarial co-training, regulate detection thresholds, calculate reinforcement-based penalties for false negative results, and trigger countermeasures as soon as a detection confidence level exceeds a predefined adaptive threshold; a secure, system-integrated inference and enforcement unit configured to perform low-latency countermeasures at the network edge, including selective packet filtering, flow isolation, process interruption, or system microsegmentation, based on instructions from the coordinating processor; and a hardware-embedded security enclave that is embedded in the system and configured to store cryptographic keys, neural model parameters, and integrity affirmation data to ensure the confidentiality, authenticity, and immutability of model artifacts and policy configurations.

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and / or by reducing memory usage. Any of various types of data structures, such as flat hash maps and / or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and / or by reducing memory usage. Any of various types of data structures, such as flat hash maps and / or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

The invention provides a server-free dynamic management and control method based on an extended Burkley packet filter, and the method comprises the steps: mounting an eBPF program to a kernel cgroup subsystem, monitoring a function instance creation / destruction event in real time, extracting metadata, dynamically generating a fine-grained network strategy, compiling the fine-grained network strategy into an eBPF byte code, and injecting the eBPF byte code into a Map format strategy table, realizing data packet level allowing / discarding control by using a flow control hook; and when the instance is destroyed, the strategy table rule is automatically cleared through a cgroprease event. Through kernel-level dynamic management and control, precise security protection, zero-trust micro-isolation and kernel layer malicious behavior interception of the function instance in the full life cycle are realized, and the security efficiency and the resource utilization rate of the cloud native environment are remarkably improved.

The invention discloses a network communication dynamic encryption method, an encryption and decryption system, equipment, a medium and a product, and relates to the technical field of communication. The method comprises the steps that a dynamic factor is obtained through a Berkley packet filter function, a key is generated based on the dynamic factor, the key generated based on the dynamic factor has high randomness and unpredictability, and the problem that a fixed key is adopted in a traditional encryption mode, and consequently the key is prone to being cracked can be solved; moreover, by using the execution environment of the Berkley packet filter function in the kernel mode, the risk that the key is stolen in the transmission and storage process is reduced, the influence on the network communication performance is small, and the network communication encryption efficiency and the network communication security are improved. Moreover, the information of network communication is used as the basis of key generation, additional key distribution and storage management processes are not needed, complex key exchange and certificate management mechanisms are not needed, the key management process is simplified, and the operation and maintenance cost of the system is reduced.

The invention discloses an AI infrastructure performance detection method and device and a storage medium, and belongs to the technical field of data processing. The method comprises the steps that according to chip information of container nodes, dynamic instrumentation is conducted on a kernel layer and a calculation layer by expanding a Burkley packet filter, first performance indexes of the kernel layer and the calculation layer are collected, a hardware management library function is called, second performance indexes of a chip hardware layer are collected, and on the basis of a control group mechanism, the kernel layer and the calculation layer are subjected to dynamic instrumentation; and obtaining meta-information of the business process group in the container node, constructing an association relationship between the first performance index and the business process group and between the second performance index and the business process group through association marking according to the meta-information, and performing association analysis on the first performance index and the second performance index based on the association relationship to obtain a performance detection result of the business process group. According to the method, the performance parameters are collected through a non-intrusive scheme, the performance indexes of different service processes are determined through a service association mode, and the accuracy of AI performance problem positioning is improved.

The invention provides a management method of a packet filtering strategy and a data packet filtering method and device, and the management method comprises the steps: enabling the packet filtering strategy to be matched with a strategy template, and storing the matched packet filtering strategy to the strategy template of a corresponding type; each category of strategy template is configured with value ranges of parameters of at least two dimensions, and the combination modes of the dimensions of the parameters of different strategy templates are different; screening out candidate packet filtering strategies from the packet filtering strategies which are not matched with the strategy template, wherein the candidate packet filtering strategies are packet filtering strategies which coincide with the value range of the parameters of the strategy template; splitting a value range of a parameter coinciding with the strategy template from the candidate packet filtering strategy, generating a new packet filtering strategy, and storing the new packet filtering strategy in the corresponding strategy template; and taking the value range of the residual parameter which is not overlapped with the strategy template in the candidate packet filtering strategy as another new packet filtering strategy, and storing the new packet filtering strategy and other packet filtering strategies which are not matched with the strategy template in the strategy tree together.

A threat intelligence gateway (TIG) may protect TCP / IP networks from network (e.g., Internet) threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies may be composed of packet filtering rules with packet-matching criteria derived from cyber threat intelligence (CTI) associated with Internet threats. These CTI-derived packet-filtering rules may be created offline by policy creation and management servers, which may distribute the policies to subscribing TIGs that subsequently enforce the policies on in-transit packets. Each packet filtering rule may specify a disposition that may be applied to a matching in-transit packet, such as deny / block / drop the in-transit packet or pass / allow / forward the in-transit packet, and also may specify directives that may be applied to a matching in-transit packet, such as log, capture, spoof-tcp-rst, etc. Often, however, the selection of a rule's disposition and directives that best protect the associated network may not be optimally determined before a matching in-transit packet is observed by the associated TIG. In such cases, threat context information that may only be available (e.g., computable) at in-transit packet observation and / or filtering time, such as current time-of-day, current TIG / network location, current TIG / network administrator, the in-transit packet being determined to be part of an active attack on the network, etc., may be helpful to determine the disposition and directives that may best protect the network from the threat associated with the in-transit packet. The present disclosure describes examples of methods, systems, and apparatuses that may be used for efficiently determining (e.g., accessing and / or computing), in response to the in-transit packet, threat context information associated with an in-transit packet. The threat context information may be used to efficiently determine the disposition and / or one or more directives to apply to the in-transit packet. This may result in dispositions and / or directives being applied to in-transit packets that better protect the network as compared with solely using dispositions and directives that were predetermined prior to receiving the in-transit packet.

The embodiment of the invention discloses a network data flow relation graph generation method and device, electronic equipment and a readable medium. A specific embodiment of the method comprises the following steps: acquiring preset network data packet capturing information and network data packet filtering information; capturing each initial network data packet among the servers, and filtering each initial network data packet in parallel based on the network data packet filtering information; analyzing the target network data packet to obtain data packet analysis information corresponding to the target network data packet; based on the obtained analysis information of each data packet, generating information of each communication connection edge between the servers; based on the preset network data packet capture information, storing the information of each communication connection side to a preset database; and in response to the detected data flow query request information sent by the user side, generating a network data flow relation graph corresponding to the at least one piece of communication connection side information. According to the embodiment, waste of computing power resources of a computer is reduced.

A class of network packets can be labeled by inserting a token into a packet header field. Preferably the header field is available to intermediary devices in cleartext. A packet filter examines the packets, allowing packets with the token to pass while dropping others. For example, the token can indicate that the packet is part of a “trusted” class. The token can be calculated from a secret, shared between the sender and receiver, and a rotating value. In some embodiments, the token may be placed in all packets associated with a trusted sender or for some time before trust must be re-established. Alternatively, the token can be placed in an initial one or more packets of a particular flow, and the packet filter can look for such packet(s), deciding whether to allow or block them. The packet filter then treats subsequent packets in the same flow in the same way.

The invention provides a full-stack observability method for a unified platform, which comprises the following steps of: respectively acquiring logs, indexes and link tracking data by using an application performance monitoring agent, an extended Berkley packet filter agent and an index acquisition agent, and storing and distributing the logs, the indexes and the link tracking data, and performing data association processing by using the request tracking identifier and the timestamp to obtain an original data set which is stored uniformly and is in cross-data association, and performing format standardization and full-stack tracking integration processing respectively to obtain a standardized time sequence index and full-stack link tracking data respectively. By summarizing the data into the same observation system and associating the observation data by using the specific field, all observability data can be observed on the same platform, and the same user interface is used, so that switching among a plurality of system pages is not needed, the problem of data islands is solved, and a user-friendly observable platform is created.

The invention relates to the technical field of network security, in particular to an IPv6 fragment bypassing threat detection method and system based on eBPF and XDP, a data packet observation point is arranged on a network driver layer, and the data packet observation point is used for mounting an eBPF program on a data packet processing path by using a fast data path XDP technology; for data packets received on a network driver layer, an eBPF program on an XDP network hook is called by using a data packet observation point, and data packets with potential threats are identified and filtered by using a feature matching strategy through the eBPF program. The feature matching strategy is used for extracting key features of the data packet, matching the extracted key features of the data packet with target threat features and judging whether an upper header of the data packet is complete or not. According to the method, the specific threat efficient detection is realized by combining the eBPF dynamic programmability and the XDP high-performance data packet processing capability, the IPv6 network security threat high-performance solution task requirements are met, and the influence on the system stability is small even under serious threats.

Systems and methods for testing sandboxed in-kernel programs are provided. A method of testing a program includes: obtaining a Berkeley Packet Filter (BPF) program to test; obtaining a test to run on the BPF program; performing the test on the BPF program for a plurality of Linux kernels and reporting a result of performing the test on the BPF program for a plurality of Linux kernels. This enables a generic testing solution for black box testing of BPF programs. The embodiments can integrate with existing testing suites and frameworks and can integrate into CI / CD pipelines. Some embodiments allow testing using any kernel from user space. Host kernel testing of BPF programs is enabled by a developer using the developer's own workstation and version of the Linux kernel. Guest kernel testing of BPF programs is enabled using specific kernel versions by providing the framework a specification of the target kernel environment.

The invention discloses an edge computing and distributed zero-trust architecture system and a data processing method. The system comprises an edge computing device cluster, a distributed zero-trust control center, an edge security gateway and a block chain identity infrastructure. The edge computing node collects hardware state, vulnerability and behavior data through the terminal security agent module; the block chain identity infrastructure provides distributed identity identification and verifiable credential service; the edge security gateway executes data packet filtering and single packet authentication; and the distributed zero-trust control center calculates a real-time security coefficient and generates a differentiation strategy, and the log is synchronized to the alliance chain for evidence storage. According to the data processing method, security access is realized through access request initiation, single packet authentication, data acquisition, trust evaluation, strategy execution and log evidence storage. According to the method, the edge device state and distributed zero trust are deeply fused, the problems of incomplete identity authentication and static permission control in an edge scene are solved, and the security and traceability of an edge computing network are improved.

Automation solutions for event logging and debugging on KUBERNETES are disclosed. A system for event logging and debugging on a distributed application cluster includes a user interface and at least one processor for executing instructions. The instructions, when executed, instruct the at least one processor to provide an edge module configured to deploy a Berkeley Packet Filter (BPF) probe and a BPF program in a computing environment. The BPF probe is triggered based on an event associated with a distributed application running in a user space of the computing environment. Data associated with the event is collected in a kernel space of the computing environment via the BPF program and transferred from the BPF program to the edge module. A query request associated with the collected data is sent to the edge module. A response corresponding to the collected data is received at the user interface.

A traffic policy includes policy rules that specify branch actions in their action fields. A branch action specifies another policy rule in the traffic policy. Packet filters generated from the traffic policy represent the traffic policy rules and execution order semantics of the branch rules.

The invention relates to the technical field of Internet of Vehicles, and discloses a vehicle end data processing method, a monitoring system, a domain controller, a medium and a product. The method comprises the following steps: acquiring a data packet monitoring program corresponding to a vehicle end network and an original socket; loading the data packet monitoring program to a kernel mode space, and binding the data packet monitoring program with the original socket to obtain a target socket; and monitoring each network data packet passing through the target socket, filtering out the target data packet from each network data packet by using the data packet monitoring program, and reading data in the target data packet to the user mode space. By implementing the technical scheme of the invention, memory resources are saved, the performance overhead is saved, the flexibility of data packet filtering is improved, the running stability and running safety of the vehicle-side operating system are improved, and the running effect of the vehicle-side operating system is ensured.

A method for monitoring and enforcing security policies in a device, the device comprising a data store installed with an operating system, the operating system having a user space and a kernel space, the method comprising the steps of: providing at least one packet filter module; providing a data bus; providing a security policy; providing at least one strategy implementation module; collecting kernel data from a kernel space, and processing and converting the collected kernel data into corresponding one or more events through a packet filtering module; sending the event to a data bus, storing the event in the data bus, and sending the event to a policy enforcement module; monitoring the device by evaluating the event using an evaluation algorithm and identifying a threat event; if the threat event is identified, identifying, by a policy enforcement module, one or more security policies; and implementing the identified security policy through a policy implementation module.

The invention relates to a data packet filtering method and device. The method comprises the following steps: extracting dimension information of a data packet, wherein the dimension information comprises at least one of a source IP address, a destination IP address, a source port, a destination port and a protocol type; sending the data packet to a corresponding virtual system; the virtual system matches the dimension information of the data packet with a pre-configured strategy template; when the matching is successful, filtering the data packet according to a filtering rule corresponding to the strategy template; and when the matching is unsuccessful, filtering the data packet through a strategy tree. According to the data packet filtering method and device, the packet filtering strategy analysis and matching efficiency can be improved, and the network attack protection efficiency of packet filtering is improved.

A network-packet filtering system is provided. The system includes one or more end hosts and a network-packet filtering device communicable with the end hosts and an external network. Each end host obtains its host-performance vector by executing a first neural network model based on its system-performance information. The network-packet filtering device determines whether to drop a packet from the external network or to pass the packet by executing a second neural network model based on the host-performance vectors and the packet.

Automation solutions for event logging and debugging on KUBERNETES are disclosed. A method for navigating data associated with a distributed application cluster includes providing an edge module configured to deploy a Berkeley Packet Filter (BPF) probe and a corresponding BPF program in a computing environment. The BPF probe is triggered based on an event associated with a distributed application running in a user space of the computing environment, the distributed application being one entity of a plurality of entities on the distributed application cluster. Data associated with the event is collected in a kernel space of the computing environment via the BPF program. At least one relationship is identified between the distributed application and at least one entity of the plurality of entities based on the collected data. At least one recommended data set based on the at least one identified relationship is provided via a user interface.

The invention provides a data packet real-time filtering method and device for a vehicle-mounted host firewall, and relates to the technical field of vehicle-mounted host firewall application, and the method comprises the steps: receiving a preset rule set sent by an upper computer; monitoring the current vehicle state in real time, determining a first filtering rule of the current network traffic data packet from a preset rule set based on the first vehicle state of the current vehicle, and analyzing and filtering each protocol layer data of the current network traffic data packet; if the current vehicle is switched from the first vehicle state to a second vehicle state, determining an application layer data filtering rule and / or a transmission layer data filtering rule corresponding to the second vehicle state from a preset rule set, and updating the first filtering rule to generate a second filtering rule, and analyzing and filtering each protocol layer data of the current network flow data packet based on the second filtering rule. The technical problem that a vehicle-mounted host firewall in the prior art cannot enable the filtered data packet to accurately meet the requirements of a complex vehicle application scene is solved.

A hypercall method and apparatus for a kernel-mode program of an enhanced Berkeley packet filter are disclosed. The method is applied to a virtual machine monitor, comprises: acquiring, in response to a virtualization page fault triggered by the kernel-mode program, a memory address where the virtualization page fault is triggered; determining whether the memory address of the virtualization page fault is consistent with a memory address corresponding to a page fault key in a mapping table; reading, from the mapping table, a page fault value mapped by the page fault key if the memory address of the virtualization page fault is consistent with the memory address corresponding to the page fault key, wherein the page fault value comprises a function type of a hypercall written by the kernel-mode program; and executing, based on the function type indicated by the page fault value, the hypercall of the function type.

Novel tools and techniques for packet filtering in a network. A networking device might feature an access control list (ACL) with filter rules, each having a field to identify, for example, a possible state of a vehicle. Based on this field, rules inapplicable to that state can be disregarded when evaluating packets against the rules in the ACL.

The invention provides a test method and device based on traffic playback, electronic equipment and a storage medium, and the method comprises the following steps: capturing traffic data, adding a packet capturing tool, and improving the data packet capturing performance of the packet capturing tool by using a high-speed network library; data processing and storage: filtering the data packet and optimizing the data, and storing the processed data in an elasticSearch; encrypting sensitive data; a timestamp synchronization mechanism is introduced, and a flow playback system is established; by using the high-speed network library, efficient data capture can be realized in a high-speed network environment, data packet loss is reduced, and integrity and accuracy of test data are ensured. The method is particularly important for scenes such as performance testing and network monitoring, and through the time synchronization and high concurrency technology, a traffic playback system can accurately play back network traffic and simulate a real network environment, and an effective tool is provided for performance testing of network equipment and applications.

An example embodiment may involve obtaining a packet filter definition that specifies characteristics of packets; compiling the packet filter definition to instructions of low-level code; generating a hash template based on a subset of the instructions, wherein the hash template includes pairs of byte offsets and byte counts that define locations within the packets at which the characteristics are disposed; based on application of the hash template to a plurality of stored packets, creating hash table entries in a hash table, wherein the hash table entries are respectively associated with subsets of the stored packets, wherein the subsets of the stored packets have respectively unique patterns of values within their bytes at the locations defined by the pairs of byte offsets and byte counts; updating the hash table entries to refer to metadata relating to their respective subset of the stored packets; and storing the hash table and the metadata.

Examples are described for inferring results based on application data using code segments executing within an application with a machine learning (ML) model. Code segments may be dynamically loaded into an application during execution. The controller verifies that the code segment meets security requirements for execution within the application based on an extended Berkelike Packet Filter (eBPF) bytecode of the code segment. A computing device executing an application loads the validated code segment into a library of the application. The application executes the validated code segment to apply the application data to the machine learning model to infer a result. The ML machine learning model may be implemented by eBPF code of a code segment, or the code segment may include a call to the machine learning model, the type of which is supported by a controller of the application, and a mapping of serialized representations for the machine learning model. The computing device may reconstruct an ML model based on the serialized representation.

The invention discloses an electricity consumption information acquisition terminal transaction semantic monitoring and causal delimiting method, which comprises the following steps: acquiring an application protocol data unit by utilizing an eBPF probe, generating a cross-layer unique transaction fingerprint based on extracted sessions, objects, businesses and calling identifiers, and generating a transaction event record by utilizing a pairing state machine; constructing a transaction observation window containing front and back extensions by taking a transaction observation timestamp as a reference, and screening and aggregating kernel events associated with the transaction fingerprint to obtain a transaction evidence set; and constructing a directed evidence graph based on the set, and calculating the confidence coefficient of each root cause category by using a scoring rule and an index normalization algorithm. According to the invention, non-intrusive deep observation of power acquisition business affairs is realized, and the automation level and fault diagnosis precision of power terminal operation and maintenance are improved.

The present disclosure relates to: a flexible filter media pack arranged in a tubular manner about an axis; a first open end cap connected in a fluid-tight manner to the first axial end of the filter media pack; and a second open end cap connected in a fluid-tight manner to the second axial end of the filter media pack, characterized in that the first end cap is flexible and non-destructively deformable between a first shape and a second, different shape; and related filter packages and filter assemblies.

The application discloses a kind of combination packet classifier and method based on hash and TCAM, adopt the combination of imperfect hash classification module and TCAM classification module, the complement of imperfect hash classification and TCAM classification on input key value space is realized;Compared with the traditional TCAM packet classification solution based on, the application reduces hardware resource utilization, system power consumption;Compared with the packet classification solution based on perfect hash, the application reduces the design cost of hash function and the time complexity of generation process under the premise of guaranteeing the function of classifier.The application can consider low space resource consumption, low power consumption and low delay in the classification stage, saves design cost in the classifier generation stage, and reduces the time complexity of generation process;Meanwhile, the application can better balance different types of hardware resources on reconfigurable hardware platforms such as FPGA, and provides a new way of thinking for the design of classifier in network tasks such as firewall packet filtering and routing table lookup.