25 results about "Parent process" patented technology

The embodiment of the invention discloses a causal relationship tracking method, device and system and electronic equipment. The causal relationship tracking method comprises the steps that an eBPF probe mounted on a specified path of a kernel space detects a first event triggered by a first process, wherein the first event is used for creating a second process; determining whether the first process is a parent process of the second process; under the condition that the first process is not the parent process of the second process, generating a causal relationship identifier of the second process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier; and under the condition that the first process is the parent process of the second process, obtaining a causal relationship identifier of the first process, and establishing a corresponding relationship between the process identifier of the second process and the causal relationship identifier.

A kernel of an operating system receives a request from a parent process (e.g., an exec or spawn system call) to launch a child process that executes a binary. The kernel identifies a process-specific launch constraint, which is a precondition for launching the child process. The kernel evaluates the constraint, which can match against any type of system state or variable, including the process's location on disk, protection on disk, and how the process is to be launched. The kernel can then determine whether to launch the child process, thus permitting the child process to be scheduled for execution by the operating system. Launch constraints can be used both for a child process to impose preconditions on the parent process, and vice versa. Launch constraints can be included in the launch request, embedded in the binary, or located elsewhere, such as in a trust cache in kernel memory.

This invention relates to the field of software detection technology, specifically disclosing a knowledge graph-based intelligent detection method and system for software backdoors. The method involves intercepting system kernel events and reading the object handle table to generate a time-series interaction log. Based on this log, a time-series knowledge graph is constructed, forming an interconnected network composed of process nodes, token nodes, and relationships such as handle holding, token replication, and memory writes. Newly added process nodes with process creation timestamps are further extracted as target process nodes, and the nominal parent process node is located based on its parent process identifier. Subsequently, a lineage consistency check is performed around the target process node, and cross-chain constraint analysis is conducted using the nominal parent process node, anonymous process nodes, token nodes, and memory write relationships. When contradictions arise in handle permissions, token inheritance, and write timing, and the lineage forgery index exceeds a preset threshold, the target process node is determined to be a parent process deceiving a backdoor process, and a threat interception command is output.

Embodiments of the present application provide a data persistence processing method and device, electronic equipment and computer readable storage medium, and relate to the technical field of computer servers. When a parent process creates a child process by executing a branch function operation, the central processing unit node where the child process is located is recorded, and a directly connected hard disk thereof is selected as a current persistent file data disk, and if not, it is stored by default. After generating a target persistent file in the snapshot mode, it is judged whether the target persistent file and the current persistent file are in the same hard disk, and if yes, the current persistent file is deleted, and the parent process updates statistical information. Otherwise, the current persistent file is first marked as an old file, and after updating the statistical information, the current persistent file is deleted, thereby solving the problem that when the data set is relatively large or the server needs to cross the road to write data, the time for stopping processing the client is too long, and the efficiency of server data persistence processing is improved.

An anomaly detection method incorporated with an anomaly detection device running an operating system is disclosed and includes steps of: storing a parent-child relationship upon a process creation; retrieving every upper layer parent-child relationship relating to a parent process; creating a process chain according to the parent-child relationship and every upper layer parent-child relationship relating to the parent process; dividing the process chain into M N-gram subject tuples; and examining an odd of each of the N-gram subject tuples by inquiring a prevalence model and determining whether a creation of a process is an anomaly event according to the odd.

The invention discloses a model service method and device, equipment and a storage medium, and relates to the technical field of data processing, and the model service method comprises the steps: obtaining a model service request, and determining the type of the model service request; based on the type, determining a target module for processing the request from a started Modelet model engine; the Modelet model engine is used for performing initial processing on a request based on a target module and performing other processing on the initially processed request based on an original model service externally provided by a started local through a reverse proxy mode, and the Modelet model engine is designed by adopting father and son processes and a reverse proxy architecture and is designed by adopting the father and son processes and the reverse proxy architecture based on the father and son processes and the reverse proxy architecture. After the engine is started, the engine serves as a parent process to start a child process of the original model, so that the Modelet model engine reversely agents the original model, and corresponding original model services are provided. The method guarantees stable operation of large model services.

This invention discloses a method and system for detecting and blocking container escape in a Linux operating system. The method includes: inserting a probe into a kernel function via the perf_event function of a user-space module, the kernel function including the fork function and the sys_execve function; obtaining the execution behavior of the kernel function through the probe and obtaining the process ID of the current process; constructing a first namespace set for the current process and establishing a mapping relationship between the process ID and the first namespace; based on the execution status of the current process, obtaining a shell process that creates a bounce due to a namespace change through the probe, obtaining the shell process through the kernel function and obtaining a second namespace set and its corresponding parent process, as well as a namespace set with PID 1; sending the corresponding parent process namespace set, the second namespace set, and the namespace set with PID 1 to an observation module for comparison and judgment, determining whether container escape exists based on the comparison result, and killing the container escape program.

The invention provides a data acquisition method, electronic equipment, a storage medium and a program product, and relates to the technical field of cloud security, in the embodiment, a data packet filter is mounted in a pipeline writing function and a pipeline reading function in a kernel in advance, and if pipeline information corresponding to written data and pipeline information corresponding to read data are matched with parent process information, the data packet filter is loaded into the pipeline writing function and the pipeline reading function in advance; if it is possible that there is no file attack behavior, process information and write-in data related to the behavior are reported to a user space, so that recording of the no file attack behavior is achieved. Through a data packet filter mounting mode, data can be triggered and acquired in real time, an attack blind area caused by a detection window interval is avoided, moreover, key services cannot be delayed, and the performance and the stability are better. Besides, genetic relationship verification is achieved by judging whether parent process information corresponding to the write-in data and parent process information corresponding to the read data are matched or not, the association precision of the write-in data and the read data can be improved, and therefore the accuracy of no-file-attack-behavior recognition is improved.

The present disclosure discloses a gateway and a gateway hot upgrade method and system, related to the field of cloud computing. The method includes that: a connection between a parent process before a hot upgrade of a service request and a child process after the hot upgrade of the service request is cut off in response to receiving an exit signal, where the service request is used for establishing the connection between the child process after the hot upgrade and the parent process before the hot upgrade, and the child process is used for receiving port information and file descriptor information transferred by the parent process after the connection is established; and the parent process is exited, and the service request is processed based on the port information and the file descriptor information through the child process.

The invention relates to the technical field of network security, and discloses a multi-stage trusted parent process chain simulation test and defense enhancement method, which comprises the following steps of: embedding a simulated malicious behavior into a child process of a legal interpreter process in simulation operation to generate a multi-stage process chain, the legal interpreter process comprises a parent process and a child process of each process; performing context behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph; identifying an abnormal process chain and a legal process chain of the multi-stage process chain based on the cross-level behavior map; and modifying the defense rule based on the behavior characteristics of the abnormal process chain, and modifying the defense white list based on the behavior characteristics of the legal process chain. According to the method, cross-level hidden attacks can be effectively identified, and the network security is ensured.

A computer-implemented method for determining container information associated with detected container mutation events is disclosed. The computer-implemented method includes: determining that a system call event to a host operating system includes a call to join a namespace and execute a parent process inside the namespace; determining that the namespace is associated with an existing container; responsive to determining that the namespace is associated with an existing container, determining that the system call event further includes a call to execute a child process inside the namespace; and responsive to determining that the system call event further includes a call to execute a child process inside the namespace: designating the child process as a mutation event to the existing container, and determining container information associated with the mutation event to the existing container. A corresponding computer system and computer program product are also disclosed.

The application provides a download progress monitoring method bypassing pipeline buffering and application thereof, and belongs to the technical field of embedded system software upgrading. The application solves the problem that the parent process cannot acquire the download progress of the child process in real time due to the full buffering mechanism of the pipeline, and causes UI lag. The technical scheme points are as follows: a first process starts a second process to execute downloading and specifies a local storage path, so that a data stream bypasses a standard output pipeline and is directly written into a file system; the first process acquires the real-time size of the corresponding file through polling a file system interface as the downloaded amount, and the process is independent of the communication pipeline between the two processes; and the real-time progress is calculated and output in combination with the expected total size acquired in advance. The application realizes millisecond-level real-time monitoring and smooth display of the progress, significantly improves the user experience during system updating, and is mainly used in the OTA upgrading scene of embedded devices.

Processes operating in a computing system are tracked. The tracking data includes or identified child processes, parent processes, and / or files associated with operation of the processes. When a process is determined to be a malware process, protective operations are performed. Protective operations may include removing or purging the malware process and all processes / files associated with the malware process in the tracking data. An infected snapshot may also be generated such that characteristics, operating procedures, and other aspects of the malware can be determined by recovering the infected snapshot to a sandbox environment and allowing the malware to execute therein.

The invention belongs to the technical field of network and information security, and discloses a method and system for dynamically updating flags in a network security attack and defense drilling range, and the method comprises the steps: capturing a reading operation on a preset flag file in a target host kernel layer through a file system monitoring mechanism, and triggering the collection of traceability information; the traceability information comprises an access process identifier, an executable file hash, a parent process chain, a call stack entry point and a memory page hash abstract, the flag generation unit combines the traceability information with a host unique identifier, an event timestamp and an incremental counter, and new flag content is generated through calculation of an HMAC or signature hash algorithm; embedding the hash value of the previous version to form a chained verification field; and the updating and auditing unit writes the new flag content into a temporary file, replaces the original file in an atomic mode after synchronous disk falling, generates an auditing record containing old version Hash, new version Hash, an event signature and a timestamp, and transmits the auditing record to the central platform through a TLS bidirectional authentication channel.

This application provides a NUMA-aware concurrent access control method and system for key cards, including: a parent process creating shared memory partitioned by NUMA nodes and pre-parsed the global lock symbol of the key card library, storing the virtual address of the global lock in the header of the shared memory, and the shared memory being used to store the contention rate, ticket allocator, and current service ticket corresponding to each NUMA node; a child process obtaining the virtual address of its own NUMA node and the global lock, obtaining the state of the global lock through read-only memory mapping, where read-only memory mapping is a mapping method that only reads and does not modify the original memory of the key card library; the child process performing layered avoidance operations according to the state of the NUMA node and the global lock to complete the key card initialization. This application does not modify the source code of the key card library, does not add proxy processes, avoids the thundering herd problem of global lock and inefficiency of cross-node access, reduces high-concurrency initialization latency and lock conflict rate, and ensures system stability.

Security events are reported to a threat management facility for an enterprise network as self-contained lineages that include data concerning related processes such as a parent or child process related to the source of the event. By transmitting these to a short term data store, threat timeline visualizations can be more quickly rendered for an analyst in a user interface, after which the visualization can be augmented with other data from other sources such as a data lake or other long term data repository for the enterprise network, third party reputation sources, and so forth.

The present application provides a service process configuration method and a related device. The method comprises: by means of an editing operation performed on a target sub-process node, which is referenced by a current parent process, in a service process structure page, displaying a first resource attribute editing page corresponding to the target sub-process node; for each different current parent process displayed in the service process structure page, switching a corresponding target resource attribute configuration item to an editable state according to usage requirements of a corresponding scenario and by means of an unlocking operation performed on the required target resource attribute configuration item in the first resource attribute editing page; and determining a first target resource attribute by means of a configuration operation on the target resource attribute configuration item which is in the editable state, and configuring the target sub-process node in the current parent process according to the first target resource attribute.

The invention discloses a data access control method and system based on a microkernel power mechanism. The method comprises the following steps: defining an access power type in a power space architecture of a microkernel system; when a system is initialized, a root process is created by a kernel, and the root process is endowed with access capability to all files under a root directory. When the process is created, the parent process creates an independent power branch for the child process based on the own power space, and endows the own access power to the child process. And when the processes run, the first process transmits the access power of the owned file or directory to the second process through power transmission operation. And when the process requests to access the target file, performing multi-level directory power matching verification in the power space of the process based on the path information of the target file, and determining whether access is allowed or not according to a verification result. And when the process requests to cancel the access capability of the target file, positioning and modifying the corresponding capability slot in the capability space of the process based on the information of the capability to be cancelled.

The invention discloses a process processing method and a related device, and the method comprises the steps: obtaining a target container, and configuring a process starting tool matched with the target container; wherein the process starting tool has a function of managing all processes in the target container; obtaining a task instruction matched with the target container, and creating a target process group matched with the task instruction by utilizing the process starting tool; wherein the target process group comprises a target parent process and at least one target child process which are associated with each other; obtaining an execution state of the target process group by utilizing a target probe instruction matched with the target container; based on the execution state, obtaining a target execution result matched with the target process group; wherein the target execution result is used for representing that the task instruction is successfully executed or recovering all processes corresponding to the task instruction. In this way, the stability of the operation environment of the target container can be improved.

The invention relates to the field of financial science and technology, and discloses a program execution control method and device, a medium and a program product. The method comprises the steps of obtaining a to-be-executed program, and performing signature verification on the to-be-executed program to obtain a signature verification result; if it is detected that the signature verification result is that verification is not passed, a parent process application corresponding to the program to be executed is obtained, and a trusted label list is obtained; and performing trust verification on the parent process application based on the trusted tag list to obtain a trust verification result, and when the trust verification result is that the verification is passed, executing the program to be executed to obtain a program execution result. According to the scheme of the embodiment, when the to-be-executed program does not pass the signature verification, the parent process application is subjected to the trust verification, and whether the to-be-executed program is executed or not is judged according to the trust verification result, so that the security verification of the executable program can be realized under an unsigned condition, and the program execution efficiency can be improved while the system security is ensured.

The application provides a fileless attack detection method and device, equipment and a storage medium, wherein the method comprises: obtaining a target unique identifier of a target process in a system when the target process reads an external script; the target unique identifier is associated with a parent process of the target process; obtaining target association information of the target process based on the target unique identifier; analyzing various behaviors of the parent process and the target process contained in the target association information to obtain a script source of the external script; and analyzing the script source of the external script to determine whether there is a fileless attack detection result in the system.

System and methods for restoring a state of a set of processes, for example, during live migration or restoration from checkpoint of processes or of virtual environments. Systems and methods can restore information and parameters related to the structure of the process tree and relationships between the processes. Processes can be migrated from a source environment to a destination environment. Processes can also be restored corresponding to a certain checkpoint. Systems and methods can restore processes based on information about a parent process and a closest alive born ancestor of each process from the set of processes, such as, for example, information pertaining to a process tree and CABA (closest alive born ancestor) tree from the certain checkpoint.

This invention relates to the field of operating system technology, and discloses a method, apparatus, device, medium, and product for process management. The method includes: if a first process has been terminated, before changing the parent process of child processes under the first process, obtaining the orphan process recycling process in the namespace where the first process resides, the termination reason identifier of the first process, and a first list of child processes under the orphan process recycling process; after changing the parent process of child processes under the first process, obtaining a second list of child processes under the orphan process recycling process; based on the first and second lists, determining a list of orphan processes to be identified; based on the termination reason identifier, determining whether the first process exited normally; if the termination reason identifier indicates that the first process exited abnormally, terminating the processes in the list of orphan processes to be identified. This method can quickly and accurately locate orphan processes, and compared with related technologies that identify orphan processes by polling, it can reduce identification overhead and improve identification efficiency.

A cyber-security method includes selecting for analysis a software process running in a computing platform. The process is classified into a class among a set of classes, depending on (i) whether a security identifier of the process is unique, and (ii) whether a root parent process of the process is an operating-system executable process. One or more statistical tests are applied to the process, the statistical tests depending on the class. Based on a result of the statistical tests, a decision is made that the process is suspected of being a malicious process that has been set-up to persist following reboot of the computing platform, and a responsive action is initiated.

Disclosed method and systems that support dynamic business logic distribution features may be implemented within a software ecosystem that includes first and second processes, where, in at least some contexts, the first process may be referred to as the parent process and the second process may be referred to as the child process. The parent process may detect a request for common business logic (CBL) from the child process. The CBL may include executable code stored in a process memory of an information handling system associated with the parent process. The parent process may access and retrieve or otherwise obtain the CBL and transmit the CBL to the child process. In at least some embodiments, the child process includes a logic retriever configured to generate an exact or substantially exact replicate of the CBL, and store the replicate CBL in a process memory of an information handling system associated with the child process. The process memory of the information handling system associated with the child process may include a dynamic random access memory (DRAM) system memory or another type of volatile memory wherein the CBL does not persist in the information handling system associated with the child process beyond a power tenure of the information handling system.