53 results about "Parent process" patented technology

The embodiment of the invention discloses a causal relationship tracking method, device and system and electronic equipment. The causal relationship tracking method comprises the steps that an eBPF probe mounted on a specified path of a kernel space detects a first event triggered by a first process, wherein the first event is used for creating a second process; determining whether the first process is a parent process of the second process; under the condition that the first process is not the parent process of the second process, generating a causal relationship identifier of the second process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier; and under the condition that the first process is the parent process of the second process, obtaining a causal relationship identifier of the first process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier.

The invention discloses a container-oriented process fine-grained access control method and a container-oriented process fine-grained access control device. According to the method, the LSM kernel function of the Linux system is hooked based on the eBPF technology, and whether the process intercepted by the eBPF program mounted to the LSM is the original process or the non-original process in the container is distinguished by adopting a mode of backtracking the parent process; meanwhile, in the process of recursively backtracking the parent process, judging a process command name identifier to divide an unexpected original process into a range needing to accept access control rule matching, and allowing a user to set a white list for the expected non-original process in a container, so that the aim of not implementing access control rule matching on the unexpected non-original process is fulfilled; in this way, only the unexpected non-original process and the unexpected original process in the container are subjected to rule matching. According to the invention, the granularity of access control is further refined, so that the effect that the original business process in the container is not influenced when the access control rule is implemented is achieved.

The invention provides a method and a device for realizing service process recovery by accessing a shared memory, and belongs to the field of storage configuration. Comprising the following steps: dividing a system into a business layer, a memory pool layer, a shared memory connection layer and an operating system layer; initializing all objects needing to be recovered, and constructing the objects on a shared memory area; replacing all global new / deelete operators in the system with a shared memory version; executing a fork operation in the system, and managing the shared memory area for the generated child process inheriting the parent process through a pointer type object of the child process; and in a multi-process model in which a parent process or child process relationship is not shared, calculating the mapping offset during the current call and the last call, and correcting all the pointer objects according to the offset. According to the method, the stability, reliability and efficiency of the system are effectively improved, quick recovery of the shared memory is realized in a multi-process environment, and powerful support is provided for high-performance operation of the system.

A kernel of an operating system receives a request from a parent process (e.g., an exec or spawn system call) to launch a child process that executes a binary. The kernel identifies a process-specific launch constraint, which is a precondition for launching the child process. The kernel evaluates the constraint, which can match against any type of system state or variable, including the process's location on disk, protection on disk, and how the process is to be launched. The kernel can then determine whether to launch the child process, thus permitting the child process to be scheduled for execution by the operating system. Launch constraints can be used both for a child process to impose preconditions on the parent process, and vice versa. Launch constraints can be included in the launch request, embedded in the binary, or located elsewhere, such as in a trust cache in kernel memory.

Systems and methods are provided for improved analyte processing with data that was captured by analyte monitors. Analyte data entries are processed with multiple child processes and the child processes pass results to a parent process. The parent process aggregates the children results to result in faster processing times. The analyte data is processed in a backend system that is linked to user computing devices with graphical user interfaces.

This invention relates to the field of software detection technology, specifically disclosing a knowledge graph-based intelligent detection method and system for software backdoors. The method involves intercepting system kernel events and reading the object handle table to generate a time-series interaction log. Based on this log, a time-series knowledge graph is constructed, forming an interconnected network composed of process nodes, token nodes, and relationships such as handle holding, token replication, and memory writes. Newly added process nodes with process creation timestamps are further extracted as target process nodes, and the nominal parent process node is located based on its parent process identifier. Subsequently, a lineage consistency check is performed around the target process node, and cross-chain constraint analysis is conducted using the nominal parent process node, anonymous process nodes, token nodes, and memory write relationships. When contradictions arise in handle permissions, token inheritance, and write timing, and the lineage forgery index exceeds a preset threshold, the target process node is determined to be a parent process deceiving a backdoor process, and a threat interception command is output.

The invention relates to the technical field of operating systems, and discloses a process management method, device and equipment, a medium and a product, the method comprises the following steps: if an ended first process exists, changing a parent process of a child process under the first process before changing the parent process of the child process under the first process; obtaining an orphan process recovery process of the namespace where the first process is located, an end reason identifier of the first process and a first sub-process list under the orphan process recovery process; after the parent process of the child processes under the first process is changed, a child process second list under the orphan process recovery process is obtained, and a to-be-recognized orphan process list is determined based on the first list and the second list; and based on the ending reason identifier, judging whether the first process exits normally, and if the ending reason identifier represents that the first process exits abnormally, ending the processes in the orphan process list to be identified. According to the method, the orphan process can be quickly and accurately positioned, and compared with the related technology of identifying the orphan process through polling, the method can reduce the identification overhead and improve the identification efficiency.

The present application discloses a visual process management method and device, which relate to the technical field of server process management, and solves the problem of difficulty in process management caused by the fact that the running status of the server process in the prior art is invisible to the user. The method comprises: registering the process information to be managed into the process management module, monitoring the changes of the process configuration information and performing the control of the actual operating system process, monitoring the alarm events occurring during the running of the process to be managed in real time, visually displaying the whole life cycle of the process to be managed on a Web page, sending the alarm information to a designated channel through a preset sending channel, enabling the parent process set by the present application to start the child process that hopes to be controlled throughout its life cycle, and receiving the event information related to the child process life cycle, and supporting the configuration of event matching alarm rules to send the process abnormality alarm information to the relevant channel.

The present invention provides a process processing method, device, computer equipment and readable storage medium. The method includes: when it is detected that a first system process creates a child process, querying the real parent process of the child process in a pre-stored process record, wherein the process record includes the corresponding relationship between the source process and the target process, the source process is a non-system process that sends a process creation message to a second system process, and the target process is the process created by the process creation message. When the child process is the same as the target process, the source process corresponding to the target process is the real parent process of the child process, and the first system process and the second system process can be the same or different; and determining whether to intercept the creation of the child process according to the real parent process. Through the present invention, the flexibility and security defense capabilities of the process processing process can be improved.

The embodiment of the invention provides a method and equipment for executing tasks and a storage medium. The method comprises the steps that for a target task, a parent process of a parent system creates corresponding sub-processes for one or more subsystems, and the target task comprises a plurality of sub-tasks executed according to a preset sequence; in response to execution of a first sub-task of the plurality of sub-tasks by a parent process of the parent system, disabling a corresponding sub-process of the one or more subsystems; in response to completion of the first sub-task, starting a sub-process of a first target subsystem in the one or more subsystems to execute a second sub-task in the plurality of sub-tasks; and disabling the parent process and the child processes of the subsystems except the first target subsystem in the one or more subsystems. In this way, the resource utilization rate of the system can be improved, and the overhead of resource allocation and release is reduced.

The invention discloses a process tree creating method and device, a medium, equipment and a computer program product. The method comprises the steps that a template process tree of a template container is obtained, and the template process tree comprises a plurality of template processes; generating a child process based on the template process, wherein the template process is used as a parent process of the child process; resources of the sub-process and the template process are isolated, and the sub-process is added to a target container; and updating the relationship of each sub-process based on the relationship between each template process in the template process tree, and taking the process tree formed by each sub-process as a target process tree. Therefore, the parallel degree of process creation in the process tree in the process tree creation process can be improved, and the process creation efficiency is effectively improved.

Embodiments of the present application provide a data persistence processing method and device, electronic equipment and computer readable storage medium, and relate to the technical field of computer servers. When a parent process creates a child process by executing a branch function operation, the central processing unit node where the child process is located is recorded, and a directly connected hard disk thereof is selected as a current persistent file data disk, and if not, it is stored by default. After generating a target persistent file in the snapshot mode, it is judged whether the target persistent file and the current persistent file are in the same hard disk, and if yes, the current persistent file is deleted, and the parent process updates statistical information. Otherwise, the current persistent file is first marked as an old file, and after updating the statistical information, the current persistent file is deleted, thereby solving the problem that when the data set is relatively large or the server needs to cross the road to write data, the time for stopping processing the client is too long, and the efficiency of server data persistence processing is improved.

The embodiment of the invention discloses a data persistence method and device and electronic device.The data persistence method comprises the steps that in response to a persistence instruction, a child process corresponding to a parent process is created, memory metadata corresponding to the parent process is copied to the child process, and the data persistence instruction is obtained; and running the sub-process to copy an address mapping table corresponding to the parent process at the data persistence moment based on the memory metadata and the corresponding query table, and in response to completion of copying of the sub-process, obtaining memory data pointed by a multi-level address mapping table in the sub-process for persistence, the lookup table is used for recording original table item information of table items with table updating in the parent process address mapping table from the data persistence moment. Therefore, according to the embodiment of the invention, the child process completes the copying operation of each level of address mapping table, and the table item change caused by the data operation processed by the parent process is recorded through the lookup table, so that the persistent data integrity is ensured, the parent process data processing delay caused by data persistence is reduced, and the system performance is improved.

An anomaly detection method incorporated with an anomaly detection device running an operating system is disclosed and includes steps of: storing a parent-child relationship upon a process creation; retrieving every upper layer parent-child relationship relating to a parent process; creating a process chain according to the parent-child relationship and every upper layer parent-child relationship relating to the parent process; dividing the process chain into M N-gram subject tuples; and examining an odd of each of the N-gram subject tuples by inquiring a prevalence model and determining whether a creation of a process is an anomaly event according to the odd.

The invention discloses a model service method and device, equipment and a storage medium, and relates to the technical field of data processing, and the model service method comprises the steps: obtaining a model service request, and determining the type of the model service request; based on the type, determining a target module for processing the request from a started Modelet model engine; the Modelet model engine is used for performing initial processing on a request based on a target module and performing other processing on the initially processed request based on an original model service externally provided by a started local through a reverse proxy mode, and the Modelet model engine is designed by adopting father and son processes and a reverse proxy architecture and is designed by adopting the father and son processes and the reverse proxy architecture based on the father and son processes and the reverse proxy architecture. After the engine is started, the engine serves as a parent process to start a child process of the original model, so that the Modelet model engine reversely agents the original model, and corresponding original model services are provided. The method guarantees stable operation of large model services.

The invention provides a modeling method and device based on process construction, electronic equipment and a storage medium, in the method, definition and design of a process are separated, in a definition view of a parent process primitive, an external structure of the parent process primitive is defined, and in a design view of the parent process primitive, an external structure of the parent process primitive is defined; according to the method, internal logic and an execution path of a parent process primitive are designed, meanwhile, the internal logic and the execution path support layered structure design, the layered structure design reflects the idea that the process primitive can be refined layer by layer, the parent process primitive serves as a parent process and can be refined into sub-processes on the lower layer, and the execution sequence of the sub-processes is represented through dominant arrows. The sub-process can continue to refine the sub-process of the lower layer, namely modeling of the complex process can be achieved, logic expression is visual, in addition, design of process codes of the parent process primitives is supported, coexistence of code logic (namely the process codes) and internal logic design of the parent process primitives is achieved, and the method is more flexible and convenient to use.

The present invention provides a method and system for deploying compute-intensive applications based on Openresty. The system is implemented based on the Openresty system. In the initialization stage, the system creates a global Lua buffer for sharing resources among child processes. The system includes a child process management module for creating child processes, managing idle child processes, recycling abnormal child processes, and protecting against overload; LuaSocket is introduced in the child processes for bidirectional communication between the parent and child processes based on the TCP protocol; an Nginx worker process is configured to be responsible for the entry and exit of the system network and serve as the parent process of the child processes; TCP communication is established between the child processes and the parent process; in the content processing stage, the child processes are responsible for processing user requests, forwarding, and outputting responses. This solution can solve the problem that compute-intensive processes block the Openresty system. Static data is loaded by the global Lua virtual machine to avoid multiple compute processes from loading a large amount of static resource data multiple times; a standard C interface module is provided and can be directly loaded without additional encapsulation and development.

This invention discloses a method and system for detecting and blocking container escape in a Linux operating system. The method includes: inserting a probe into a kernel function via the perf_event function of a user-space module, the kernel function including the fork function and the sys_execve function; obtaining the execution behavior of the kernel function through the probe and obtaining the process ID of the current process; constructing a first namespace set for the current process and establishing a mapping relationship between the process ID and the first namespace; based on the execution status of the current process, obtaining a shell process that creates a bounce due to a namespace change through the probe, obtaining the shell process through the kernel function and obtaining a second namespace set and its corresponding parent process, as well as a namespace set with PID 1; sending the corresponding parent process namespace set, the second namespace set, and the namespace set with PID 1 to an observation module for comparison and judgment, determining whether container escape exists based on the comparison result, and killing the container escape program.

The invention relates to the technical field of computers, and discloses a high-availability method and device of a zero-trust authentication server and computer equipment. The method is applied to a parent process in a zero-trust authentication server, the zero-trust authentication server further comprises a plurality of sub-processes, and the method comprises the following steps: acquiring process data of a first sub-process; the process data comprises at least one of an exit identifier, performance data, log data and heartbeat data; the exit identifier is used for indicating an exit reason of the first sub-process; the first sub-process is one of a plurality of sub-processes; and monitoring the first sub-process based on the process data. According to the invention, high availability of the zero-trust authentication server is realized.

The invention provides a data acquisition method, electronic equipment, a storage medium and a program product, and relates to the technical field of cloud security, in the embodiment, a data packet filter is mounted in a pipeline writing function and a pipeline reading function in a kernel in advance, and if pipeline information corresponding to written data and pipeline information corresponding to read data are matched with parent process information, the data packet filter is loaded into the pipeline writing function and the pipeline reading function in advance; if it is possible that there is no file attack behavior, process information and write-in data related to the behavior are reported to a user space, so that recording of the no file attack behavior is achieved. Through a data packet filter mounting mode, data can be triggered and acquired in real time, an attack blind area caused by a detection window interval is avoided, moreover, key services cannot be delayed, and the performance and the stability are better. Besides, genetic relationship verification is achieved by judging whether parent process information corresponding to the write-in data and parent process information corresponding to the read data are matched or not, the association precision of the write-in data and the read data can be improved, and therefore the accuracy of no-file-attack-behavior recognition is improved.

The present disclosure discloses a gateway and a gateway hot upgrade method and system, related to the field of cloud computing. The method includes that: a connection between a parent process before a hot upgrade of a service request and a child process after the hot upgrade of the service request is cut off in response to receiving an exit signal, where the service request is used for establishing the connection between the child process after the hot upgrade and the parent process before the hot upgrade, and the child process is used for receiving port information and file descriptor information transferred by the parent process after the connection is established; and the parent process is exited, and the service request is processed based on the port information and the file descriptor information through the child process.

The present disclosure provides a method, apparatus, host, and medium for accessing a distributed file system. The method includes: receiving a user operation code; enabling a parent process and a child process, where the child process executes the user operation code and jumps to the parent process when an access instruction for the distributed file system is executed. The parent process executes the access instruction and returns to the child process after the access instruction is executed. The parent process is a security framework process within the platform to which the distributed file system belongs. Embodiments of the present disclosure improve the security, convenience, and universality of accessing the distributed file system.

The invention relates to the technical field of network security, and discloses a multi-stage trusted parent process chain simulation test and defense enhancement method, which comprises the following steps of: embedding a simulated malicious behavior into a child process of a legal interpreter process in simulation operation to generate a multi-stage process chain, the legal interpreter process comprises a parent process and a child process of each process; performing context behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph; identifying an abnormal process chain and a legal process chain of the multi-stage process chain based on the cross-level behavior map; and modifying the defense rule based on the behavior characteristics of the abnormal process chain, and modifying the defense white list based on the behavior characteristics of the legal process chain. According to the method, cross-level hidden attacks can be effectively identified, and the network security is ensured.

A computer-implemented method for determining container information associated with detected container mutation events is disclosed. The computer-implemented method includes: determining that a system call event to a host operating system includes a call to join a namespace and execute a parent process inside the namespace; determining that the namespace is associated with an existing container; responsive to determining that the namespace is associated with an existing container, determining that the system call event further includes a call to execute a child process inside the namespace; and responsive to determining that the system call event further includes a call to execute a child process inside the namespace: designating the child process as a mutation event to the existing container, and determining container information associated with the mutation event to the existing container. A corresponding computer system and computer program product are also disclosed.

The application provides a download progress monitoring method bypassing pipeline buffering and application thereof, and belongs to the technical field of embedded system software upgrading. The application solves the problem that the parent process cannot acquire the download progress of the child process in real time due to the full buffering mechanism of the pipeline, and causes UI lag. The technical scheme points are as follows: a first process starts a second process to execute downloading and specifies a local storage path, so that a data stream bypasses a standard output pipeline and is directly written into a file system; the first process acquires the real-time size of the corresponding file through polling a file system interface as the downloaded amount, and the process is independent of the communication pipeline between the two processes; and the real-time progress is calculated and output in combination with the expected total size acquired in advance. The application realizes millisecond-level real-time monitoring and smooth display of the progress, significantly improves the user experience during system updating, and is mainly used in the OTA upgrading scene of embedded devices.

Processes operating in a computing system are tracked. The tracking data includes or identified child processes, parent processes, and / or files associated with operation of the processes. When a process is determined to be a malware process, protective operations are performed. Protective operations may include removing or purging the malware process and all processes / files associated with the malware process in the tracking data. An infected snapshot may also be generated such that characteristics, operating procedures, and other aspects of the malware can be determined by recovering the infected snapshot to a sandbox environment and allowing the malware to execute therein.

The invention relates to the technical field of electric digital data processing, in particular to protection of distributed programs or contents. According to the technical scheme, the method comprises the following steps: scanning a file on a host, calculating a feature value of an executable file, and endowing a permission type; the trusted signature certificate is imported into a database, and a protection strategy is configured and protection is started according to actual protection requirements; obtaining the permission type of the parent process and calculating the target permission type every time a new target is started; and judging whether operation can be carried out according to the matched strategy. The problems of high cost, poor safety and low applicability in the prior art are solved, the protection method and system based on the authority model are provided, and the purposes of high automation level, good safety performance, dynamic authority management and flexible protection are achieved.

The invention belongs to the technical field of network and information security, and discloses a method and system for dynamically updating flags in a network security attack and defense drilling range, and the method comprises the steps: capturing a reading operation on a preset flag file in a target host kernel layer through a file system monitoring mechanism, and triggering the collection of traceability information; the traceability information comprises an access process identifier, an executable file hash, a parent process chain, a call stack entry point and a memory page hash abstract, the flag generation unit combines the traceability information with a host unique identifier, an event timestamp and an incremental counter, and new flag content is generated through calculation of an HMAC or signature hash algorithm; embedding the hash value of the previous version to form a chained verification field; and the updating and auditing unit writes the new flag content into a temporary file, replaces the original file in an atomic mode after synchronous disk falling, generates an auditing record containing old version Hash, new version Hash, an event signature and a timestamp, and transmits the auditing record to the central platform through a TLS bidirectional authentication channel.

An embodiment of the present application provides a debugging method, an electronic device, and a storage medium, wherein the above-mentioned test configuration method is applied to an electronic device, including: after the first user space init process of the operating system of the electronic device completes the log redirection configuration, it jumps to create a child process, wherein the init process stagnates as a parent process after creating the child process; a temporary system environment is established through the child process, and the temporary system environment can read and write the native system environment file of the electronic device; the child process uses the temporary system environment to view or modify the native system environment file; in response to the signal of the termination of the child process, the init process is notified to end the stagnation and continue execution. The present application realizes debugging by interacting with the debugging device as soon as possible during the initial stage of the startup of the init process of the electronic device, that is, after the Linux system completes the basic system environment configuration, thereby advancing the debugging timing and improving the debugging efficiency.

This application provides a NUMA-aware concurrent access control method and system for key cards, including: a parent process creating shared memory partitioned by NUMA nodes and pre-parsed the global lock symbol of the key card library, storing the virtual address of the global lock in the header of the shared memory, and the shared memory being used to store the contention rate, ticket allocator, and current service ticket corresponding to each NUMA node; a child process obtaining the virtual address of its own NUMA node and the global lock, obtaining the state of the global lock through read-only memory mapping, where read-only memory mapping is a mapping method that only reads and does not modify the original memory of the key card library; the child process performing layered avoidance operations according to the state of the NUMA node and the global lock to complete the key card initialization. This application does not modify the source code of the key card library, does not add proxy processes, avoids the thundering herd problem of global lock and inefficiency of cross-node access, reduces high-concurrency initialization latency and lock conflict rate, and ensures system stability.