1467 results about "Source address" patented technology

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system, and the method comprises the following steps: extracting a source IP address and a target IP address based on a network behavior record, carrying out the statistics of the number of used ports, the transmission direction and the time interval value, analyzing the direction change times and the time interval difference, and screening abnormal communication pairs. And generating an abnormal communication pair set. According to the invention, through analyzing port usage, transmission direction and time interval value, deeply mining communication features, screening abnormal communication pairs and improving identification accuracy, dividing a time sequence window, analyzing rate fluctuation and frequency distribution, locking an unstable time window, combining with a multi-dimensional data classification behavior mode, and extracting a switching path and priority, a multi-dimensional data classification behavior mode is combined. Potential threat paths are identified independently, global threat situations are identified through node interaction relation statistics and correlation analysis and an expansion range, threat assessment precision and efficiency are enhanced, and comprehensive and reliable risk protection capability is provided for network managers.

The invention provides a protocol conversion adaptation method and device, an industrial convergence gateway and a data transmission method, and belongs to the technical field of network protocol conversion, and the method comprises the steps: receiving state data periodically sent by an industrial device through an industrial protocol or an industrial protocol data packet returned in response to a query request; extracting key fields in the received industrial protocol data packet, wherein the key fields comprise a source address, a destination address, a function code, a register address and data content; and utilizing a programmable platform and a language to convert the analyzed data into a uniform 5G data packet format which comprises a source address, a target address, a protocol type, a timestamp and a priority field. According to the invention, efficient analysis and forwarding of a mainstream industrial protocol are realized, and data transmission under a 5G network low-delay characteristic is realized; multi-protocol dynamic analysis and expansion are supported, only P4 codes need to be updated when protocols are newly added, hardware does not need to be replaced, and flexibility and adaptation capacity are improved; efficient conversion and packaging are achieved, and the data transmission speed and the overall performance of the system are improved.

Control of network traffic in a network is provided, including classifying a network request from a network source address using request classifiers selected from a plurality of request classifiers based on the network request satisfying classification conditions of the selected request classifiers, associating the network request with each classifier metric corresponding to the selected request classifiers, aggregating the classifier metrics associated with the network request to determine an aggregate request control metric of the network request, and instructing a network traffic controller to operate on the network request based on whether the aggregate request control metric satisfies a request control condition. Each of the plurality of request classifiers is associated in memory with a corresponding classifier metric.

Examples described herein and includes at least one processor and a direct memory access (DMA) device. In some examples, the DMA device is to: access a command from a memory region allocated to receive commands for execution by the DMA device, wherein the command is to access content from a local memory device or remote memory node. In some examples, the DMA device is to: determine if the content is stored in a local memory device or a remote memory node based on a configuration that indicates whether a source address refers to a memory address associated with the local memory device or the remote memory node and whether a destination address refers to a memory address associated with the local memory device or the remote memory node. In some examples, the DMA device is to: copy the content from a local memory device or copy the content to the local memory device using a memory interface.

The invention discloses a door lock and card cooperative processing method and system, and the method comprises the steps: triggering a robot calling process according to preset times of doorbell button operation detected by a first door lock and read neighbor RFID card information, verifying a matching result of an RFID card and a resident registration form, and generating an authority verification passing signal; calculating a target multicast address based on the ID number of the RFID card, and converting the ID number of the RFID card into a false source IP address to obtain a communication parameter set; sending an IGMPv3 report message to the router according to the communication parameter set; according to the triggering operation of the same RFID card detected by the assisted second door lock, an assistance multicast request message is generated, the (S, G) forwarding table item is matched through the router and forwarded to the first door lock, the first door lock sends an assistance confirmation message to the second door lock, and robot calling authorization is completed. By utilizing the embodiment of the invention, efficient, safe and low-delay cross-door-lock cooperative operation can be realized.

Examples described herein include one or more processors; a network interface; and a direct memory access (DMA) engine communicatively coupled to the one or more processors. In some examples, the DMA engine is to receive a DMA data access request and based on an address in the DMA data access request corresponding to a remote memory device, the DMA engine is to cause the network interface to generate at least one packet for transmission to the remote memory device. In some examples, if the source address corresponds to a local memory device and the destination address corresponds to a remote memory device, the DMA engine is to cause the network interface to generate at least one packet for transmission to the remote memory device.

Implementation(s) for multi-factor network segmentation are described. A plurality of packets at a higher layer of a network stack is processed, where at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer. Specifically, responsive to successful authentication of a cryptographic certificate received during the handshake process, a second service is identified from the cryptographic certificate. It is determined, based on a security policy, that the second service is authorized to access the first service. Responsive to the determination, a configuration is caused such that packets sent using the source address are now authorized to be processed by the higher layer.

The invention provides a communication method, device and system, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: receiving an Ethernet data frame sent by a first host connected with a first network device, wherein the Ethernet data frame comprises a source MAC address and a destination MAC address; determining a virtual Ethernet identifier and a target site mapping prefix corresponding to the target MAC address according to a preset address mapping relationship; generating an IPv6 message header according to the virtual Ethernet identifier, the target site mapping prefix and the target MAC address, and packaging the Ethernet data frame according to the IPv6 message header to obtain an IPv6 message; and sending the IPv6 message to a second network device, decapsulating the IPv6 message by the second network device to obtain an Ethernet data frame, and sending the Ethernet data frame to a second host connected to the second network device. The present disclosure can reduce overhead and improve system security.

A match table is used to match a concatenation of a source address of a data packet and a consecutive message sequence number (MSN) to a match data structure. The matched concatenation is inserted into the match data structure based on a source and a running counter for a MSN to each source. The currently active PDC associated with the source is attached or an empty PDC is atomically created and attached. In response to a packet arriving before the semantic layer has posted a recv( ), A canary value “failed match” is atomically inserted into the match data structure and a request to wait (RTW) message is sent to the source. In response to the semantic layer posting the recv( ), the “failed match” entry in the match data structure is identified, the “failed match” entry is atomically updated with match information, and a request to send (RTS) message is sent to the source.

The invention relates to the technical field of government affair information management, in particular to a cloud-based government affair information management method, which comprises the following steps of: S1, adding a sensitivity label for each piece of government affair data in a cloud storage layer; s2, extracting data from the government affair database and generating a dynamic data view with an authority mark; s3, establishing a mapping relation table between routing keys and data source addresses; s4, acquiring a requester department function code, a business scene code and a target data identifier; s5, matching a target data source, and based on the authority mark in the dynamic data view, executing a desensitization operation on the sensitive field; and S6, if the genetic marker bit of the original data is true, superposing the data security classification in the original tag and the current security classification to form a new tag. According to the method, by constructing the sensitivity label and the dynamic authority control mechanism, safe inheritance and accurate access of government affair data in cross-department circulation are achieved, and the safety and compliance of data management are remarkably improved.

The invention discloses a block chain security verification protection method, a block chain node, a medium and a product, and relates to the field of network security, and the method comprises the steps: obtaining received network request data; determining a reputation score of the request source address according to a historical request behavior of the request source address; when the reputation score is higher than a preset score threshold, verifying the legality of the request content through the smart contract to obtain a verification result, and recording the verification result to the block chain network; if the verification result shows that the request content is legal, processing the network request data; if the verification result shows that the request content is illegal, reducing the reputation score of the request source address by a preset score; when the reputation score is lower than a preset score threshold, generating early warning information and broadcasting the early warning information to a block chain network; and starting a protection mode according to the early warning information. By implementing the method, the capability of identifying and preventing security threats is improved.

The invention relates to the technical field of computers, and discloses a network communication method, device and equipment between a virtual machine and a host machine, the method is applied to the virtual machine, and the method comprises the following steps: the virtual machine establishes a transmission channel with the host machine by using a para-virtualization driving module; after the transmission channel is established, a first instance is registered, a channel number and a port number are recorded in the connection array, and the first instance comprises a handle used for thread or process-to-process communication; the virtual machine sends a first message to the host machine, a message header of the first message carries indication information, a source address and a destination address, the indication information is used for indicating a message type of the first message, and the host machine forwards the first message through the recorded channel number and port number according to the message type, the source address and the destination address. According to the method, the para-virtualization driving module is used for solving the problem that the virtual machine cannot communicate with the host machine when the host machine does not have network equipment or the virtual machine cannot access the network equipment on the host machine.

The invention relates to the technical field of chips, and discloses a hardware accelerator and a data handling method, the hardware accelerator comprises a doorbell processing module, a descriptor cache module and at least one DMA engine module; wherein a target engine module in the at least one DMA engine module is configured to read a target descriptor from effective descriptors in the descriptor cache module and analyze the target descriptor to obtain a source address field, a source address space identifier, a destination address field and a destination address space identifier, and carrying the target data block in the first user space to the second user space based on the source address field, the source address space identifier, the destination address field and the destination address space identifier, wherein the effective descriptor is read from a descriptor ring in the first user space through the doorbell processing module and is written into the descriptor cache module. Therefore, through cooperative work of all the modules, full-hardware acceleration of user mode data carrying is completed, and therefore the data carrying efficiency is remarkably improved.

The invention aims to provide a communication method of a multi-core system and the multi-core system, and relates to the technical field of computers. The method applied to the Mailbox hardware module in the multi-core system comprises the following steps: receiving an operation configuration instruction of a processor core to the Mailbox hardware module; under the condition that an interrupt trigger signal of the processor core corresponding to the source address is received, sending an interrupt request signal to the processor core corresponding to the destination address according to a communication channel expected to be used so as to transmit the data to be sent until a first preset condition is met, and sending a source interrupt signal to the processor core corresponding to the source address; the first preset condition is that the communication channels of the mailbox source registers recording the source addresses are all used, and the destination addresses recorded by the mailbox target registers of the communication channels are all transmitted. Therefore, the communication concurrency and throughput of the multi-core system can be improved. And meanwhile, the communication reliability of the multi-core system can be improved.

A storage device includes a non-volatile memory and a storage controller, wherein the storage controller includes a cache memory storing some of data stored in the non-volatile memory, an interface circuit receiving, from a first external host, a first request including a source address related to the external storage device, a destination address related to the storage device, and cache update information indicating an update method of the cache memory, provide a second request including the source address to the external storage device, and receive, from the external storage device in response to the second request, a response including first data corresponding to the source address, an address translation circuit generating a physical address of a first type based on the destination address, and a cache controller updating a cache area indicated by the physical address of the first type based on the cache update information.

The invention relates to the technical field of Internet, and discloses a bandwidth control method and device, equipment and a storage medium, and the method comprises the steps: determining a target resource address corresponding to a current request based on the address information of the current request in response to the issuing of the current request; the current request number and the request number threshold value of the target resource address are obtained, and the request number threshold value is determined based on the real-time bandwidth and the redundant bandwidth of the target resource address; and if the current request number is smaller than or equal to the request number threshold value, scheduling the current request to a target resource address, so that a target machine corresponding to the target resource address serves the current request. Therefore, the request number threshold value of the target resource address is determined based on the real-time bandwidth and the redundant bandwidth of the target resource address, so that prediction control is performed on the number of requests which can be borne by a machine, the bandwidth of the machine is controlled to fluctuate in a small range near the bandwidth threshold value, and the service quality of a service is not influenced while the bandwidth utilization rate is guaranteed.

The invention belongs to the technical field of Ethernet high-speed interconnection, and provides a high-speed low-delay 10-gigabit switching method and system based on an FPGA, and the method comprises the steps: receiving Ethernet data frames, storing effective data frames in a data caching module, and generating a caching write-in address and a control signal; reading a destination address, a source address and a type field of the analyzed data frame from the data caching module, and updating a forwarding address table through a dynamic learning mode or a preset mode; based on the updated forwarding address table, a three-level assembly line framework is adopted to complete address searching; reading the data frame from the cache according to the forwarding decision, repackaging the Ethernet header information and the check code, and controlling the sending standard rate; and meanwhile, the sending rate is dynamically adjusted, and VLAN division, port rate and queue scheduling parameters are optimized in combination with an external configuration command. According to the invention, the onboard processor is utilized to cooperate with the FGPA to realize the fast search of the forwarding table, the residence time of the data packet in the switching unit is reduced, and the operation efficiency of the side application is improved.

The invention discloses a data processing method and device and a nonvolatile storage medium. The method comprises the following steps: collecting a plurality of network data packets forwarded by a plurality of network nodes in a cloud platform of a private network; in the plurality of network data packets, counting the amount of data sent by each application program under the same source IP address within a preset time range; acquiring application priority information and application load information of each application program under the same source IP address, and determining an application score of the application program; and obtaining a load index of the network node at the target moment, and under the condition that the load index is greater than a preset threshold value, performing shunting processing on target traffic corresponding to the target application program under the target source IP address forwarded by the network node. According to the method and the device, the technical problems that the route for forwarding the data request of each access unit to the exclusive cloud is not reasonable enough and the efficiency is low due to the lack of an effective node load monitoring mechanism and a dynamic routing adjustment strategy are solved.

The invention relates to the technical field of network security, in particular to a source address verification method and device based on a virtual network, a controller and a medium, and the method comprises the steps: determining a nearest virtual node when a connection request of a client network is received, so as to control the client network to establish connection with the nearest virtual node, bind an input interface, and notify a source prefix; and allocating an original path to the client network based on the source prefix and the destination prefix, and when it is monitored that the client network sends a message from the source address to the destination address, obtaining all virtual nodes of the original path so as to verify the source address of the message based on all the virtual nodes, and when it is determined that the source address exists in the preset SAV verification table and is marked as legal and credible, the message is allowed to be forwarded based on the original path, so that the message is forwarded to the destination address. According to the invention, in a complex dynamic network environment, efficient and accurate source address verification is realized only through the source address of the message, so that source address forgery attacks are effectively defended.

Described are methods and devices for communication between local networks and global networks. In some examples, a method comprises storing mapping data for multiple hosts in a global network and in a local network. The method further comprises receiving a first data packet from one of the multiple hosts in the local network. The first data packet comprises a first source address being the local network address of the host in the local network, a first destination address being the local network address of the host in the global network and payload data. The method further comprises determining, based on the mapping data, the global network address of the host in the local network and a global network address of the host in the global network, and sending a second data packet over the global network.

Techniques are disclosed for sending Protocol Independent Multicast (PIM) messages across a Layer-3 (L3) transport network. In one example, a first network device receives, via an L2 network from a multicast sender device, a multicast packet for a multicast group associated with a multicast service. The first network device generates, based on the multicast packet, a unicast L3 packet comprising a PIM register request configured to register the first network device as a multicast source for the multicast group. A header of the unicast L3 packet specifies a source address comprising a network address translation (NAT) to an address of a virtual loopback interface of a second network device. The virtual loopback interface is associated with a PIM service between the first and second network devices for the multicast service. The first network device forwards the unicast L3 packet across an L3 transport network to the second network device.

Methods and systems are provided for detecting vehicle controller spoofing. The vehicle includes a plurality of vehicle controllers, a vehicle network switch, and a content addressable memory (CAM). The plurality of vehicle controllers includes first and second vehicle controllers. A first port of the vehicle network switch is designated to only receive data frames from a first vehicle controller. The first vehicle controller is associated with a first media access control (MAC) address. The CAM is configured to store an association between the first port and the first MAC address, receive a first data frame including a source MAC address at the first port, determine whether the source MAC address matches the first MAC address, and generate an anomaly event based on the determination. A generated anomaly event indicates that the first vehicle controller is masquerading as the second vehicle controller using an invalid source MAC address.

The embodiment of the invention provides a network application access method and related equipment, a security protection system receives a first message from a terminal, the first message comprises an application layer message header, the application layer message header in the first message carries a first virtual IP address corresponding to a user identifier, and the user identifier is an identifier of a user logging in the terminal; the first virtual IP address is an IP address in a second network; the security protection system obtains a second message based on the first message, the second message comprises an IP basic header, and a source IP address field in the IP basic header in the second message carries a first virtual IP address; and the security protection system sends the second message to the server. According to the embodiment of the invention, the difficulty of tracing to the user based on the message source IP can be reduced.

Multiple roots of trust are described under a super Root of trust (SROT). One embodiment includes: cores of a host processor; a host processor memory subsystem to provide access to a host processor memory; a home agent to provide access by the cores to the host processor memory subsystem and an expansion memory subsystem, a source address decoder to decode memory requests generated from the plurality of cores to determine whether the memory requests are to be directed to the host processor memory subsystem or the expansion memory subsystem. Host-based security circuitry encrypts and decrypts memory requests directed to the expansion memory subsystem, the host-based security circuitry to perform the encryption and decryption based on a second key stored in a cache maintained by the host-based security circuitry.

The invention relates to the technical field of network security, in particular to a network security threat perception recognition response method based on a security knowledge graph, and the method comprises the steps: obtaining data; determining temporary nodes and concerned nodes; determining a marked node; determining risk nodes and suspicious nodes; obtaining a corrected risk node; connecting map edges; determining an abnormal node; adjusting the threshold value and giving an alarm. According to the method, various key indexes are obtained in real time, marked nodes are determined according to the flow change rate in combination with the inlet and outlet flow ratio and the source I P address, risk nodes and suspicious nodes are further determined, the suspicious nodes are corrected through the inlet and outlet flow ratio, map edges are connected, abnormal nodes are determined, and then the threshold value is dynamically adjusted. And finally, giving an alarm based on the abnormal node, and optimizing the judgment standard in real time according to the change of the network environment, thereby effectively solving the problems of low danger identification accuracy and slow response speed caused by overlarge data volume and excessive dependence on the model.

The invention discloses a communication method and system of a serial port network, a storage medium and a program product, and relates to the technical field of communication, the method comprises the following steps: receiving a serial port data packet through a first serial port or a second serial port, and analyzing the serial port data packet to obtain a source address, a destination address and request data; when the destination address is greater than the local address, forwarding the serial port data packet through the second serial port; when the destination address is smaller than the local address, forwarding the serial port data packet through the first serial port; when the destination address is equal to the local address, executing a corresponding task according to the request data, and generating response data; packaging the response data by taking the local address as a response source address and the source address as a response destination address to generate a response data packet; and returning the response data packet through the first serial port or the second serial port receiving the serial port data packet. According to the invention, the communication efficiency of serial port communication among multiple devices can be improved.

The invention relates to the field of network traffic analysis, and particularly discloses a network traffic aggregation analysis method based on deep learning, which comprises the following steps: extracting a traffic data packet subset of a specified source I P address from an original data packet captured by a network interface, and carrying out time sequence modeling on the historical traffic data packet subset by utilizing a deep learning algorithm to obtain a network traffic aggregation analysis result; the method comprises the following steps: dynamically screening a plurality of historical network traffic behavior mode time sequence fragments most related to a current behavior mode based on a latest network traffic time sequence characteristic to form a candidate attribution group by using a source IP address as a source IP address to capture a reference behavior mode of the network traffic of the source IP address; and flow mode incremental aggregation learning is carried out on the newest network flow time sequence mode characteristics and the candidate group characteristics, and behavior migration of the newest flow mode is mined, so that dynamic updating and accurate description of the network flow behavior of the source IP address are realized. According to the method, the time sequence evolution rule of the network traffic behavior can be effectively captured, and the timeliness and accuracy of abnormal traffic detection and behavior pattern analysis are improved.

The invention relates to a data replication method and device based on DMA, equipment and a storage medium. The method comprises the following steps: receiving a data copying instruction, wherein the data copying instruction comprises an initial source address, an initial destination address and a copying data length; determining an alignment difference between the initial source address and the initial destination address; an association ID table is determined according to the data copying instruction and the alignment difference, and in the association ID table, the association ID of one write request corresponds to the association ID of one or two read requests; and for one write request, obtaining a corresponding read request according to the associated ID table and the alignment difference, and writing a target result corresponding to the read request into a target storage medium according to the address of the write request. By adopting the method, the problem that the initial address is not aligned during data copying can be effectively solved.

The invention discloses a risk assessment method and apparatus, and an electronic device. The method comprises the steps of obtaining a traffic log set and an event log set which are output by a to-be-analyzed system and last for N hours; calculating a flow event index and an abnormal request index corresponding to each source IP address according to the flow log set and the event log set; and determining a behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluating the risk of the corresponding source IP address according to the behavior risk index. Through the technical scheme provided by the embodiment of the invention, the risk assessment of the source IP address is realized, the uncertainty influence on the risk assessment caused by the data quality problem and the timeliness problem of the external intelligence data is effectively made up, and the effectiveness and the accuracy of the risk assessment result of the source IP address are effectively improved.

According to the kernel indirect control flow transfer dynamic verification method based on the eBPF, an eBPF attachment point of an indirect call instruction is positioned, a verification program is dynamically attached, a source address and a target address are captured to generate a compound key, and the legality of a control flow is verified in a pre-constructed BPF hash table; and meanwhile, three indirect addressing modes of a differential strategy adaptive register, an immediate operand and a memory are adopted. Based on an eBPF technology, an EV program can be dynamically loaded into a running kernel as required during running, and the characteristic of dynamic expansion of a modern kernel can be perfectly adapted; all the capabilities are constructed on a universal software mechanism of a Linux kernel and do not depend on any hardware extension; while powerful security defense is provided, extremely low overhead during operation is realized. Benefited from an innovative hybrid verification strategy and an efficient CFG storage scheme, control flow hijacking attacks in the real world can be effectively defended with extremely low performance loss.