15 results about "Parent process" patented technology

The embodiment of the invention discloses a causal relationship tracking method, device and system and electronic equipment. The causal relationship tracking method comprises the steps that an eBPF probe mounted on a specified path of a kernel space detects a first event triggered by a first process, wherein the first event is used for creating a second process; determining whether the first process is a parent process of the second process; under the condition that the first process is not the parent process of the second process, generating a causal relationship identifier of the second process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier; and under the condition that the first process is the parent process of the second process, obtaining a causal relationship identifier of the first process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier.

A kernel of an operating system receives a request from a parent process (e.g., an exec or spawn system call) to launch a child process that executes a binary. The kernel identifies a process-specific launch constraint, which is a precondition for launching the child process. The kernel evaluates the constraint, which can match against any type of system state or variable, including the process's location on disk, protection on disk, and how the process is to be launched. The kernel can then determine whether to launch the child process, thus permitting the child process to be scheduled for execution by the operating system. Launch constraints can be used both for a child process to impose preconditions on the parent process, and vice versa. Launch constraints can be included in the launch request, embedded in the binary, or located elsewhere, such as in a trust cache in kernel memory.

This invention relates to the field of software detection technology, specifically disclosing a knowledge graph-based intelligent detection method and system for software backdoors. The method involves intercepting system kernel events and reading the object handle table to generate a time-series interaction log. Based on this log, a time-series knowledge graph is constructed, forming an interconnected network composed of process nodes, token nodes, and relationships such as handle holding, token replication, and memory writes. Newly added process nodes with process creation timestamps are further extracted as target process nodes, and the nominal parent process node is located based on its parent process identifier. Subsequently, a lineage consistency check is performed around the target process node, and cross-chain constraint analysis is conducted using the nominal parent process node, anonymous process nodes, token nodes, and memory write relationships. When contradictions arise in handle permissions, token inheritance, and write timing, and the lineage forgery index exceeds a preset threshold, the target process node is determined to be a parent process deceiving a backdoor process, and a threat interception command is output.

Embodiments of the present application provide a data persistence processing method and device, electronic equipment and computer readable storage medium, and relate to the technical field of computer servers. When a parent process creates a child process by executing a branch function operation, the central processing unit node where the child process is located is recorded, and a directly connected hard disk thereof is selected as a current persistent file data disk, and if not, it is stored by default. After generating a target persistent file in the snapshot mode, it is judged whether the target persistent file and the current persistent file are in the same hard disk, and if yes, the current persistent file is deleted, and the parent process updates statistical information. Otherwise, the current persistent file is first marked as an old file, and after updating the statistical information, the current persistent file is deleted, thereby solving the problem that when the data set is relatively large or the server needs to cross the road to write data, the time for stopping processing the client is too long, and the efficiency of server data persistence processing is improved.

The invention discloses a model service method and device, equipment and a storage medium, and relates to the technical field of data processing, and the model service method comprises the steps: obtaining a model service request, and determining the type of the model service request; based on the type, determining a target module for processing the request from a started Modelet model engine; the Modelet model engine is used for performing initial processing on a request based on a target module and performing other processing on the initially processed request based on an original model service externally provided by a started local through a reverse proxy mode, and the Modelet model engine is designed by adopting father and son processes and a reverse proxy architecture and is designed by adopting the father and son processes and the reverse proxy architecture based on the father and son processes and the reverse proxy architecture. After the engine is started, the engine serves as a parent process to start a child process of the original model, so that the Modelet model engine reversely agents the original model, and corresponding original model services are provided. The method guarantees stable operation of large model services.

The application provides a download progress monitoring method bypassing pipeline buffering and application thereof, and belongs to the technical field of embedded system software upgrading. The application solves the problem that the parent process cannot acquire the download progress of the child process in real time due to the full buffering mechanism of the pipeline, and causes UI lag. The technical scheme points are as follows: a first process starts a second process to execute downloading and specifies a local storage path, so that a data stream bypasses a standard output pipeline and is directly written into a file system; the first process acquires the real-time size of the corresponding file through polling a file system interface as the downloaded amount, and the process is independent of the communication pipeline between the two processes; and the real-time progress is calculated and output in combination with the expected total size acquired in advance. The application realizes millisecond-level real-time monitoring and smooth display of the progress, significantly improves the user experience during system updating, and is mainly used in the OTA upgrading scene of embedded devices.

Processes operating in a computing system are tracked. The tracking data includes or identified child processes, parent processes, and / or files associated with operation of the processes. When a process is determined to be a malware process, protective operations are performed. Protective operations may include removing or purging the malware process and all processes / files associated with the malware process in the tracking data. An infected snapshot may also be generated such that characteristics, operating procedures, and other aspects of the malware can be determined by recovering the infected snapshot to a sandbox environment and allowing the malware to execute therein.

The invention belongs to the technical field of network and information security, and discloses a method and system for dynamically updating flags in a network security attack and defense drilling range, and the method comprises the steps: capturing a reading operation on a preset flag file in a target host kernel layer through a file system monitoring mechanism, and triggering the collection of traceability information; the traceability information comprises an access process identifier, an executable file hash, a parent process chain, a call stack entry point and a memory page hash abstract, the flag generation unit combines the traceability information with a host unique identifier, an event timestamp and an incremental counter, and new flag content is generated through calculation of an HMAC or signature hash algorithm; embedding the hash value of the previous version to form a chained verification field; and the updating and auditing unit writes the new flag content into a temporary file, replaces the original file in an atomic mode after synchronous disk falling, generates an auditing record containing old version Hash, new version Hash, an event signature and a timestamp, and transmits the auditing record to the central platform through a TLS bidirectional authentication channel.

This application provides a NUMA-aware concurrent access control method and system for key cards, including: a parent process creating shared memory partitioned by NUMA nodes and pre-parsed the global lock symbol of the key card library, storing the virtual address of the global lock in the header of the shared memory, and the shared memory being used to store the contention rate, ticket allocator, and current service ticket corresponding to each NUMA node; a child process obtaining the virtual address of its own NUMA node and the global lock, obtaining the state of the global lock through read-only memory mapping, where read-only memory mapping is a mapping method that only reads and does not modify the original memory of the key card library; the child process performing layered avoidance operations according to the state of the NUMA node and the global lock to complete the key card initialization. This application does not modify the source code of the key card library, does not add proxy processes, avoids the thundering herd problem of global lock and inefficiency of cross-node access, reduces high-concurrency initialization latency and lock conflict rate, and ensures system stability.

Security events are reported to a threat management facility for an enterprise network as self-contained lineages that include data concerning related processes such as a parent or child process related to the source of the event. By transmitting these to a short term data store, threat timeline visualizations can be more quickly rendered for an analyst in a user interface, after which the visualization can be augmented with other data from other sources such as a data lake or other long term data repository for the enterprise network, third party reputation sources, and so forth.

The invention discloses a process processing method and a related device, and the method comprises the steps: obtaining a target container, and configuring a process starting tool matched with the target container; wherein the process starting tool has a function of managing all processes in the target container; obtaining a task instruction matched with the target container, and creating a target process group matched with the task instruction by utilizing the process starting tool; wherein the target process group comprises a target parent process and at least one target child process which are associated with each other; obtaining an execution state of the target process group by utilizing a target probe instruction matched with the target container; based on the execution state, obtaining a target execution result matched with the target process group; wherein the target execution result is used for representing that the task instruction is successfully executed or recovering all processes corresponding to the task instruction. In this way, the stability of the operation environment of the target container can be improved.

The application provides a fileless attack detection method and device, equipment and a storage medium, wherein the method comprises: obtaining a target unique identifier of a target process in a system when the target process reads an external script; the target unique identifier is associated with a parent process of the target process; obtaining target association information of the target process based on the target unique identifier; analyzing various behaviors of the parent process and the target process contained in the target association information to obtain a script source of the external script; and analyzing the script source of the external script to determine whether there is a fileless attack detection result in the system.

System and methods for restoring a state of a set of processes, for example, during live migration or restoration from checkpoint of processes or of virtual environments. Systems and methods can restore information and parameters related to the structure of the process tree and relationships between the processes. Processes can be migrated from a source environment to a destination environment. Processes can also be restored corresponding to a certain checkpoint. Systems and methods can restore processes based on information about a parent process and a closest alive born ancestor of each process from the set of processes, such as, for example, information pertaining to a process tree and CABA (closest alive born ancestor) tree from the certain checkpoint.

A cyber-security method includes selecting for analysis a software process running in a computing platform. The process is classified into a class among a set of classes, depending on (i) whether a security identifier of the process is unique, and (ii) whether a root parent process of the process is an operating-system executable process. One or more statistical tests are applied to the process, the statistical tests depending on the class. Based on a result of the statistical tests, a decision is made that the process is suspected of being a malicious process that has been set-up to persist following reboot of the computing platform, and a responsive action is initiated.

Disclosed method and systems that support dynamic business logic distribution features may be implemented within a software ecosystem that includes first and second processes, where, in at least some contexts, the first process may be referred to as the parent process and the second process may be referred to as the child process. The parent process may detect a request for common business logic (CBL) from the child process. The CBL may include executable code stored in a process memory of an information handling system associated with the parent process. The parent process may access and retrieve or otherwise obtain the CBL and transmit the CBL to the child process. In at least some embodiments, the child process includes a logic retriever configured to generate an exact or substantially exact replicate of the CBL, and store the replicate CBL in a process memory of an information handling system associated with the child process. The process memory of the information handling system associated with the child process may include a dynamic random access memory (DRAM) system memory or another type of volatile memory wherein the CBL does not persist in the information handling system associated with the child process beyond a power tenure of the information handling system.