718 results about "System call" patented technology

The invention provides an APT (Advanced Persistent Threat) attack detection method based on a large language model, which comprises the following steps of: S1, extracting original system call event data from a kernel audit log of an operating system, and preprocessing the data; s2, constructing a multi-model collaborative detection architecture based on a large language model, and realizing fine-grained classification of network entities according to the preprocessed data through prompt construction, model fine tuning and a confidence scoring mechanism; s3, constructing an adaptive graph search algorithm based on multi-modal feature correlation modeling, driving attack path topology reconstruction, and realizing maximum reduction of a malicious sub-graph topology structure; s4, carrying out combination with MITRE ATTamp; the CK tactical knowledge base constructs a cyclic enhancement analysis framework, a cyclic enhancement technology is adopted to drive a large language model to execute hierarchical association reasoning, a mapping relation from malicious subgraphs to attack tactics and tactical chains is derived step by step, and finally an attack report summary and a targeted defense strategy are generated. According to the invention, APT attack detection with high accuracy and high interpretability is realized.

The invention provides an enterprise product intelligent quotation collaborative decision-making platform. A platform architecture comprises a user interaction layer, a data processing layer and a decision-making layer, and platform functions are realized by relying on an intelligent agent. When a user releases a product quotation task, an authority management agent verifies the identity and access authority of the user, and a user interaction and demand analysis agent in a user interaction layer converts the natural language demand of the user into a structured instruction; the data processing layer receives an instruction, basic data and a special cost agent in the layer pull data from an external system through a cross-system calling agent, and a price calculation agent integrates the data through multi-objective optimization to generate candidate quoted prices; and finally, a man-machine cooperation and intelligent decision-making auxiliary agent in a decision-making layer displays all candidate schemes, and an expert performs fine adjustment to select an optimal quotation. According to the invention, rapid and accurate quotation is realized for enterprise products, the quotation model is continuously optimized through continuous feedback and self-learning, and finally a highly autonomous intelligent quotation system is formed.

The invention discloses an address mapping method in DPU local storage virtualization, which comprises the following steps: a virtual machine calls a system call interface provided by an address mapping configuration management module on a host side to perform mapping configuration of a virtual machine physical address and a host physical address, and issues the virtual machine physical address and length to a virtual address mapping module of a DPU; the virtual address mapping module manages global direct memory access address resources, firstly allocates a global direct memory access address on a host side, then maps a virtual machine physical address to the allocated global direct memory access address in a mapping page table of the DPU, and returns the virtual machine physical address to the address mapping configuration management module; and the address mapping configuration management module obtains the distributed global direct memory access address, and maps the distributed global direct memory access address to a host physical address in the IOMMU. According to the method, by optimizing address mapping, the efficient and flexible local storage virtualization service can be realized while the data reliability is ensured.

The invention relates to an automatic protocol adaptation method for a real-time access system of multi-source equipment. The data acquisition layer receives original protocol data sent by equipment and transmits the original protocol data to the protocol adaptation layer. And the protocol metadata analysis module extracts, analyzes, compares and matches the data, and automatically identifies the protocol type of the equipment. The rule engine converts original protocol data into a system unified internal data format according to a conversion rule and then transmits the original protocol data to the data processing layer, and after cleaning, integration, analysis and other operations are carried out, the original protocol data are transmitted to the application interface layer to be called by an upper-layer application system. And when new protocol equipment is accessed, the hot plug function allows the system to dynamically load the new protocol adapter module in a state of not stopping running. According to the method, automatic adaptation of a new protocol is achieved through rapid deployment of the containerized micro-service architecture in combination with newly added protocol rules and metadata of the protocol management module, the whole process does not need to compile and publish the system again, and efficient and stable operation of the multi-source equipment real-time access system is guaranteed.

The invention relates to a long-range task-oriented VLA model method for a humanoid robot, which comprises the following steps of: S01, analyzing a natural language instruction through a space-time semantic analyzer to generate an atomic operation sequence with a space-time dependency relationship; s02, maintaining a task state machine by using a dynamic memory network, and tracking the task execution progress in real time; s03, integrating vision, language and sensor data through a multi-modal perception fusion engine; s04, calling a predefined action primitive based on an adaptive execution system and optimizing a motion track; and S05, performing online updating and optimization on the model through a continuous learning mechanism. According to the method, a natural language instruction is analyzed into a structured task sequence with space-time dependence through a space-time semantic analyzer, an execution sequence and preconditions are defined, the semantic understanding ability and the structuring degree of task planning are improved, and task decomposition and replanning in a dynamic environment are supported; according to the method, the LSTM and the knowledge graph are combined, and the task state is maintained in real time.

The invention relates to an enhanced LLM-RAG multi-hop question and answer method based on logic tree reasoning, and belongs to the technical field of new-generation information, and the method comprises the following steps: inputting a multi-hop question and answer question into a computer system; the computer system calls a pre-training large language model LLM, the multi-hop question-answer question is decomposed into a hierarchical logic tree in a recursive mode, and each node of the logic tree comprises a sub-question and a corresponding hypothesis answer; performing image retrieval from a structured knowledge source Wikidata and performing text retrieval from an unstructured knowledge source Wikipedia on the basis of each node sub-question and the hypothesis answer to obtain corresponding evidence; traversing the logic tree, verifying the consistency between the hypothetical answer of each node and the evidence through LLM, if the contradiction exists, reconstructing the corresponding sub-tree, and dynamically correcting the reasoning path; and integrating the verified logic tree node information, and outputting an accurate answer to the multi-hop question and answer question.

A kernel monitor can be used to mitigate ransomware activity of a host system. In some aspects, a computing system can use the kernel monitor to monitor a set of system calls generated by the host system within a time window to perform a functionality. The kernel monitor can include a respective kernel program monitoring each system call in the set of system calls. The set of system calls can be filtered by the kernel monitor to identify a subset of system calls associated with encrypting a filesystem of the host system. The computing system can determine that the subset of system calls is indicative of ransomware activity associated with the host system based on the subset of system calls exceeding a predefined threshold. Subsequently, the computing system can perform a mitigation operation to mitigate the ransomware activity.

The invention relates to the technical field of voltage control, in particular to a synchronous main shift gear automatic compensation voltage control system, which comprises an area load information acquisition module, a voltage instantaneous value and a current instantaneous value are periodically read through a voltage transformer and a current transformer which are deployed on a key feeder line or a user side in a specified area, and the voltage instantaneous value and the current instantaneous value are acquired; and calculating to obtain an active power value and a reactive power value, adding a synchronous timestamp and a node position code to each collected value, transmitting and collecting the coded voltage value, active power value, reactive power value and timestamp information, organizing and storing according to a regional and time sequence, and establishing a regional load real-time measurement data set. According to the method, real-time capturing and structured processing of the system call number, the parameter and the return value are carried out on the L4T kernel event triggered by the target process PID, a serialized system call track is obtained, and an execution process recording path mainly driven by process behaviors is formed.

A system for real-time detection and mitigation of morphing malware in high-density edge networks, consisting of: a data acquisition unit configured to receive, normalize, and encode multimodal telemetry data streams originating from at least one of the following domains: network traffic, process behavior, system call sequences, binary instruction traces, and control flow graphs; the data acquisition unit is further configured to compute feature embeddings over sliding time windows and apply privacy-preserving redactions prior to storage; a generative neural processor that is operationally coupled to the data acquisition unit and configured to generate synthetic morphing malware variants by learning probabilistic transformations of previously observed malicious data representations, maintaining semantic functionality while varying structural and behavioral features; a discriminative neural processor trained adversarially with the generative neural processor, wherein the discriminative neural processor is configured to detect morphing malware by evaluating a probability distribution over multimodal telemetry embeddings and classifying anomalous process and flow behaviors in real time; a coordination processor that is communicatively connected to both the generative neural processor and the discriminative neural processor and is configured to orchestrate adversarial co-training, regulate detection thresholds, calculate reinforcement-based penalties for false negative results, and trigger countermeasures as soon as a detection confidence level exceeds a predefined adaptive threshold; a secure, system-integrated inference and enforcement unit configured to perform low-latency countermeasures at the network edge, including selective packet filtering, flow isolation, process interruption, or system microsegmentation, based on instructions from the coordinating processor; and a hardware-embedded security enclave that is embedded in the system and configured to store cryptographic keys, neural model parameters, and integrity affirmation data to ensure the confidentiality, authenticity, and immutability of model artifacts and policy configurations.

The invention relates to the technical field of data processing, and discloses a system kernel fuzzy test seed generation method and system based on a large language model. The method comprises the following steps: performing feature extraction on Linux kernel system calling on a Host host machine to obtain a feature data set; performing CFG analysis on the feature data set to obtain a system call sequence diagram and extracting a state transition table; constructing a test scene for the state transition table, and performing Syzkaller verification to obtain an effective scene library; generating an initial seed case set for the effective scene library, and executing a test in the QEMU to obtain result data; and performing coverage analysis on the result data to obtain a coverage rate report, and optimizing to generate a target test case set. According to the invention, the test coverage rate and the defect discovery capability are improved.

The invention discloses a method for communication between a user program and a virtual machine on a microkernel Hypervisor, the microkernel Hypervisor is provided with two shared memory areas, the shared memory area 1 is accessed by the user program and a root service Rootserver, the shared memory area 2 is accessed by the Rootserver and the virtual machine, the user program writes communication request data with the virtual machine into the shared memory area 1, and the user program writes communication request data with the virtual machine into the shared memory area 2. The method comprises the following steps that a VMM sub-thread is used as a shared memory area 1, a Rootserver is notified through inter-process communication, the Rootserver reads communication request data from the shared memory area 1, the communication request data is written into a shared memory area 2 after being analyzed by the VMM sub-thread, a system calls a syscale to transmit a communication request to a kernel, the kernel injects virtual interrupt into a virtual machine, and the virtual machine sends the communication request to the Rootserver. And an interrupt processing program of the virtual machine processes the communication request and writes a processing result into the shared memory area 2, then the processing result is returned to the Hypervisor through the Hypercall, and a Rootserver of the Hypervisor feeds back the processing result to a user program through the IPC. The method is designed for the microkernel Hypervisor environment, and the overall performance and efficiency of the embedded virtualization system are improved.

The invention discloses a kernel fuzz testing method and system based on a large language model, and belongs to the technical field of kernel fuzz testing. The method comprises the following steps: constructing a mapping relationship between system calling of a target operating system and a kernel object; based on the mapping relationship between the system call and the kernel object, generating a test case by using a large language model; and under the condition that the test case passes the verification, obtaining a fuzzy test result of the target operating system based on the test case. According to the method, the reasoning generalization ability of the LLM is utilized to generate a large number of effective system call sequences which conform to the dependency relationship and are wide in coverage range, so that the ability of a fuzzy test tool to generate test cases is enhanced, and potential vulnerabilities are mined.

The invention relates to the technical field of computer storage, in particular to an intention perception data prefetching method and device of solid-state storage equipment and a storage medium. The method comprises the following steps: collecting user behavior data, wherein the user behavior data comprises an application use frequency, file access time, a system call log, a hard disk reading track and network flow information; classifying, filtering and preprocessing the collected user behavior data to generate a time sequence and a behavior sequence, and mapping the time sequence and the behavior sequence into multi-dimensional feature vectors; according to the intention perception data prefetching method of the solid-state storage device, dynamic and efficient data prefetching is achieved in combination with real-time analysis of the user operation intention, and the data access speed and the overall performance of the solid-state storage device are improved.

According to the Linux real-time enhancement method based on the domestic real-time kernel, by introducing a kernel adaptation layer and designing a packaging mechanism of the kernel adaptation layer, it is ensured that code space between the real-time kernel and the Linux kernel is effectively isolated, the code coupling degree is reduced, the kernel and the Linux kernel can harmoniously coexist in the same environment and do not interfere with each other, and the real-time performance of the Linux kernel is improved. The real-time task can be called by a non-real-time system and inherits the existing functions and services of the Linux, so that the ecological advantages of the Linux are brought into full play, effective management of hardware and memory resources is ensured through flexible and diversified resource allocation and sharing strategies, and the problems of resource contention and performance reduction are reduced.

The invention discloses a mandatory access control method and device based on a process function context, and the method comprises the steps: collecting a security context associated with a system call initiated by a target process, so as to generate a standardized object description; mapping the object description into a target function classification identifier, so as to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for access decision based on the current policy era, the qualifier, the function classification identifier, the view identifier of the process function context view and the isolation domain abstract; and querying the multi-level cache according to the target decision key to determine a matched target access decision. Therefore, context-sensitive judgment and cross-component consistency taking the functional context as the center are realized.

The invention provides a method and device for starting an application program and electronic equipment. The method comprises the steps that in response to a first operation of a user, the electronic equipment displays a desktop, the priority of an animation starting thread is adjusted to be a first priority, the desktop comprises a first icon, the first icon is an icon of a first application program, and the first priority is higher than the initial priority of animation starting; in response to a second operation of the user on the first icon, calling an animation starting thread according to the first priority; displaying a starting animation of the first application program through the starting animation thread; after the starting animation of the first application program is displayed, an interface of the first application program is displayed. According to the method for starting the application program, the priority of the animation starting thread can be improved when the electronic equipment displays the desktop, and when a user triggers starting of the application program, the system calls the animation starting thread with the priority improved, so that the animation starting of the application program is not blocked, and the use experience of the user is improved.

The invention discloses a Linux process code segment measurement enhancement method based on a dual-system architecture. The method comprises the following steps: S1, collecting a process reference value; and S2, adding a kernel key data monitoring mechanism. And S3, measuring the process in real time. Based on a trusted execution environment, a prototype system for measuring the process in real time when the Linux operating system runs is realized on the basis of trusted startup, and the prototype system provides a mechanism for immediately initiating real-time measurement when kernel key data operation is abnormal while periodically measuring a process code segment. Kernel key data comprises a system call table, an interrupt descriptor table and SELinux enabling and configuration information, and the scheme solves a certain TOCTTOU problem and enhances the security of the Linux system. According to the method, real-time measurement on the processes related to kernel key data operation during operation of the computing component operating system is completed, the safety of the system is enhanced in the operation process of the operating system, the credibility of a computing platform is guaranteed, and the method conforms to the active immune credible idea.

The invention belongs to the technical field of network security, and discloses a multi-dimensional feature fusion-based APT abnormal behavior detection method, which comprises the following steps of: constructing a traceability graph by using an acquired system operation log, separating system call sequence information from acquired data, and respectively calculating point embedding of the traceability graph and sequence embedding of function call; and the two features are embedded and fused, and abnormal behavior discovery is carried out through a detection model based on the fused features, so that the generalization ability of the abnormal detection model is remarkably improved.

In general, techniques are described for providing a virtual graphics processing unit driver by receiving, in a user mode of a guest process executed by a computing system, one or more graphics commands from an application of the guest process; triggering, in the user mode of the guest process, an operating system call in response to the one or more graphics commands; translating, in a kernel mode of the guest process, the operating system call into a first virtual buffer; translating, in the user mode of a host process executed by the computing system, the first virtual buffer into the operating system call; and sending, in the user mode of the host process, the operating system call to a graphics processing unit driver in a kernel mode of the host process.

The invention discloses a CPU affinity guarantee method, computer equipment, a medium and a product, and relates to the technical field of operating systems. The method comprises the following steps: acquiring CPU affinity mask parameters; creating an application starter process, and setting the CPU affinity of the application starter process as a CPU affinity mask parameter; based on a preset application program path, creating an application program process through an application starter process, and injecting the dynamic link library into a process space of the application program process; performing Hook operation on a preset CPU affinity related system API (Application Program Interface); system calling initiated by the application program process is monitored in real time according to the dynamic link library, and when it is detected that the application program process calls a target system API function in a preset CPU affinity related system API, a calling request of the target system API function is redirected to a preset processing function; therefore, the application program process is ensured to always run in the CPU core range limited by the CPU affinity mask parameters.

Provided in the present application is a function management method. The method comprises: receiving a function call trigger event triggered by a user for a target function; on the basis of a function identifier of the target function, acquiring functionality classification information of the target function; on the basis of the functionality classification information of the target function and a mapping relationship between a function functionality and a container type, determining a target container type matching the functionality classification information of the target function; allocating, from a container resource pool, a container of the target container type to the target function; and loading, in the container, a code package of the target function, so as to execute a corresponding system call behavior. In the method, isolation technology for matching differentiated containers for functions according to requirements is provided, the functions are classified from a security dimension, and the functionalities of containers are separated, such that the functions of different security types are operated in different types of containers, and thus the calculation and data security of the functions themselves are achieved, and the security guarantee for a serverless platform is realized, thereby preventing a malicious function from performing container escaping to destroy an operation environment of the serverless platform.

The invention discloses an operating system containerization kernel compatibility method based on shadow structure mapping, which comprises the following steps of: constructing a multi-dimensional mapping rule base by analyzing the difference of data structures between a container system and a standard system, and creating a shadow structure comprising a data area, a metadata area and an expansion area when the container system runs on a host system; the host system allocates a shadow memory space and a memory pool, establishes mapping between a shadow structure and a physical memory page and bidirectional mapping between the shadow structure and a host structure, intercepts system call of a container application, obtains a target structure and allocates a shadow structure and a host structure memory, and sends the shadow structure and the host structure memory to the host system; according to the method, conversion from the target structure to the host structure is completed according to the multi-dimensional mapping rule base, the host machine completes calling through the host structure, then the calling result is reversely converted into the target structure and returned to the container application, and seamless compatibility of the container system and the host system is achieved under the condition that a user mode program of the container system is not modified.

The invention provides a vulnerability scanning method, electronic equipment, a readable storage medium and a computer program product. The method comprises the following steps: receiving a natural language instruction input by a user; recognizing the natural language instruction through an intention recognition model to obtain an instance statement recognition result; determining a system call statement corresponding to the instance statement recognition result according to a vector database; triggering a vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result; performing vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result; generating a scanning report according to the scanning result and the vulnerability analysis result; and outputting the scanning report on the interactive interface. Therefore, according to the method, efficient and flexible operation of vulnerability scanning management can be achieved according to the natural language instruction input by the user, a tedious customized development process does not need to be carried out, the universality and usability of the system are improved, and the operation and maintenance cost of the system is reduced.

Disclosed in some examples are improvements to memory controllers on distributed memory systems that include a fine-grained data mover component that offloads management of memory commands accessing multiple smaller values to the memory controller. The fine-grained data mover (FGDM) may provide low host processing overhead that enables performance improvements for small task offloads. Work requests (“data mover calls”) may be sent by hosts to the FGDM without OS system calls. The FGDM is a virtually addressed data movement engine architected to transfer data at high transfer rates even during situations where the host has many small data movement requests and where the source and / or destination addresses are not memory controller friendly.

The invention discloses a graphics processor simulation method, a simulator, a device, electronic equipment and a storage medium, and belongs to the technical field of simulation. Loading a target system call simulator for simulating the target graphics processor; the target system call simulator comprises a user space simulation layer, a graphics processor simulation layer and a graphics drive simulation layer connected with the graphics processor simulation layer and the user space simulation layer; and running a target program in the user space simulation layer, and directly sending a graphic system call generated in the running process of the target program to the graphic drive simulation layer, so that the graphic drive simulation layer transmits a corresponding GPU instruction set to the graphic processor simulation layer based on the graphic system call, and executes the GPU instruction set through the graphic drive simulation layer. Therefore, the software and hardware of the corresponding graphics processor can be simulated by calling the simulator through the lightweight target system, and the simulation precision of the graphics processor can be improved under the condition of ensuring relatively high simulation efficiency.

A method of executing a safety-critical application (130) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (115); instantiating, by the hypervisor (115), an execution environment (120); executing, in the execution environment (120), an operating system having a kernel (125, 125a); executing, in the execution environment (120), on the operating system, the safety-critical application (130) on a privilege level that is lower than that of the kernel (125, 125a); executing, by the safety-critical application (130), a system call instruction of the kernel (125, 125a) that diverts the control flow to a first-level handler (127) in the kernel (125, 125a) with the goal of invoking, by a particular intended system call, a functionality provided by the kernel (125, 125a); further diverting, by the processor core (112a, 112b), the control flow to a second-level handler (119) in the hypervisor (115); passing, by the second-level handler (119), the intended system call to a supervisor component (150); and checking, by the supervisor component (150), operations to be performed by the intended system call against a predetermined ruleset, so as to allow or disallow the system call.

This disclosure describes a large language model (LLM)-based agent operating system comprising an application layer, a kernel layer, and a hardware layer. The kernel layer comprises an AIOS kernel comprising: LLM core(s), an agent scheduler, a context manager, a memory manager, a storage manager, and a system call interface configured to manage interactions among the agent scheduler, the context manager, the memory manager, and the storage manager.

The invention provides a lightweight confidential container construction method based on a hardware trusted environment, which belongs to the technical field of confidential containers, and comprises a shared security memory module, a shared security storage module and a system call distribution module, according to the method, a lightweight confidential container is realized by utilizing an existing open source trusted execution environment operating system (OP-TEE) on end side embedded equipment supporting an ARM TrustZone technology; through the design based on the unique identifier of the confidential container, a plurality of confidential containers are realized in the TEE, and a plurality of trusted applications in the same confidential container have fine-grained secure memory and secure storage condition sharing, so that the communication overhead among the trusted applications in the confidential containers is reduced; the secure memory and the secure storage of the confidential container are strongly isolated from the untrusted world; according to the method, the development and deployment difficulty of the security sensitive application is reduced, and the resource utilization efficiency and the system expandability are remarkably improved while the confidentiality and integrity of hardware-level data are guaranteed.

The invention relates to the technical field of authority management, in particular to an authority dynamic authorization and risk monitoring method and device, equipment and a computer storage medium. According to the method, whether the request permission is necessary or not can be intelligently judged, and automatic response is performed in a low-risk situation, so that authorized popup windows during operation are remarkably reduced, and the user experience is improved; a dynamic granularity adjustment mechanism is introduced, one-time granting of full authority is avoided, and the privacy exposure risk is reduced while normal functions are guaranteed; the method has the capability of behavior detection during operation, can identify permission abuse behaviors and give an alarm in real time based on permission use frequency, calling context and behavior sequences, and fills up the defect of hysteresis of post-event analysis in an existing scheme; the method does not depend on any machine learning framework, completely adopts system calling, state machine judgment and configuration driving, is low in resource consumption and high in adaptability, can stably run on middle-end and low-end equipment, and has the industrialization landing capability.

The invention discloses a natural language driven situation awareness control method and system based on task intention and a medium. Relates to the technical field of artificial intelligence and man-machine interaction. Generating a natural language template library and a task intention field table based on the three-table knowledge; constructing an interface-data double-mapping knowledge graph by taking three-table knowledge as a construction basis and taking a natural language template library and a task intention field table as retrieval rearrangement tools, and then performing semantic retrieval and anaphora resolution to generate structured intention data; on the premise of not depending on a fixed layout, a user instruction is analyzed into a task intention, stable anchoring of an interface object is achieved through semantic positioning, and the task intention is automatically compiled into a system API call or interface event sequence; and meanwhile, the availability and compliance of execution are guaranteed through a closed-loop mechanism of credible execution scoring and minimization clarification, so that the operation complexity is effectively reduced, and the response efficiency and intelligent interaction level of the situation awareness system are improved.