275 results about "System call" patented technology

The invention relates to a long-range task-oriented VLA model method for a humanoid robot, which comprises the following steps of: S01, analyzing a natural language instruction through a space-time semantic analyzer to generate an atomic operation sequence with a space-time dependency relationship; s02, maintaining a task state machine by using a dynamic memory network, and tracking the task execution progress in real time; s03, integrating vision, language and sensor data through a multi-modal perception fusion engine; s04, calling a predefined action primitive based on an adaptive execution system and optimizing a motion track; and S05, performing online updating and optimization on the model through a continuous learning mechanism. According to the method, a natural language instruction is analyzed into a structured task sequence with space-time dependence through a space-time semantic analyzer, an execution sequence and preconditions are defined, the semantic understanding ability and the structuring degree of task planning are improved, and task decomposition and replanning in a dynamic environment are supported; according to the method, the LSTM and the knowledge graph are combined, and the task state is maintained in real time.

The invention discloses a mandatory access control method and device based on a process function context, and the method comprises the steps: collecting a security context associated with a system call initiated by a target process, so as to generate a standardized object description; mapping the object description into a target function classification identifier, so as to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for access decision based on the current policy era, the qualifier, the function classification identifier, the view identifier of the process function context view and the isolation domain abstract; and querying the multi-level cache according to the target decision key to determine a matched target access decision. Therefore, context-sensitive judgment and cross-component consistency taking the functional context as the center are realized.

This disclosure describes a large language model (LLM)-based agent operating system comprising an application layer, a kernel layer, and a hardware layer. The kernel layer comprises an AIOS kernel comprising: LLM core(s), an agent scheduler, a context manager, a memory manager, a storage manager, and a system call interface configured to manage interactions among the agent scheduler, the context manager, the memory manager, and the storage manager.

The invention discloses an eBPF-based non-intrusive application runtime protection method and system, and the method comprises the steps: firstly collecting BTF information of a target operating system, generating an eBPF kernel program adaptive to a local kernel version according to the BTF information, and loading the eBPF kernel program to an LSM control point of an operating system kernel; generating legal behavior description configuration according to known operation information of the protected application, and distributing the legal behavior description configuration to a corresponding storage mechanism of an eBPF Map in a kernel; when a protected application initiates a system call, an eBPF kernel program mounted on a corresponding LSM control point intercepts and queries legal behavior description configuration in an eBPF Map, if the system call is matched with the legal behavior description configuration, execution is allowed, and if the system call is not matched with the legal behavior description configuration, the call is blocked, so that the application is effectively protected during running, and the method has the non-invasive characteristic. Application codes are prevented from being modified; the kernel is adapted based on BTF information, so that the program stability and compatibility are guaranteed; illegal calling is effectively prevented through a legal behavior description mechanism, and a reliable environment is provided for application running.

The invention discloses a semantic unification and anomaly traceability analysis method and system for heterogeneous program logs, and the method comprises the steps: firstly collecting original logs in various formats, and packaging the original logs into standard objects in a unified manner; thirdly, identifying fields through a rule and a semantic model, uniformly mapping and labeling semantic tags, eliminating semantic differences, and constructing log data with uniform semantics; automatically constructing a cross-system call chain based on the request identifier and the like; secondly, extracting log features and comparing the log features with a normal behavior model to carry out anomaly detection, and generating an abnormal event; combining time, calling and dependency to construct an anomaly propagation path, and reversely backtracking and positioning an anomaly source; abnormal priority scores are calculated according to the propagation range, the influence degree and the like, and sorting and visual display are carried out; through unified semantic modeling and automatic association analysis of heterogeneous logs, accurate tracing and intelligent positioning of cross-service link anomalies are realized, the operation and maintenance efficiency is effectively improved, and the dependence on artificial experience is reduced.

The invention relates to the field of system optimization, and discloses a Linux-based domestic operating system kernel cutting optimization system, which comprises a hardware baseline identification module used for acquiring a processor architecture, peripheral and bus topology, storage and network resources and firmware capability of target equipment and generating hardware baseline description; the scene portrait construction module is used for statically and dynamically observing a target application and acquiring operation portrait data including system calling, driving access and interruption events to form a scene portrait; a dependency analysis module; a multi-target constraint solving module; configuring a synthesis and construction module; and a verification and difference feedback module. According to the method, portrait analysis is carried out on calling of a target application, driving access and interruption events, a trigger threshold value is set, dependency solving is executed in a high touch module range, scene-driven cutting decision is achieved, the dependency closure calculation range is made to be consistent with an actual operation behavior, redundancy and invalid dependency are reduced, and cutting precision and kernel construction efficiency are improved.

Disclosed are various approaches for large language model (LLM) application risk mitigation. A large language model (LLM) application that interacts with a network LLM service can be identified. A portion of the LLM application can be provided as input to an LLM risk mitigation code generation function that outputs LLM-specific risk mitigation code. A runtime environment can be deployed to include a modified version of the LLM application that includes the LLM-specific risk mitigation code, a kernel-layer LLM risk mitigation program that can intercept LLM interaction system calls to apply the LLM-specific risk mitigation code, or any combination thereof.

The invention discloses a node distribution method and system for a GPU (Graphics Processing Unit) use process in an NUMA (Non Uniform Memory Access) environment, and the method comprises the following steps: in a kernel mode, capturing an event that the process executes a new program and collecting meta-information of the process through an eBPF program mounted at a system call entry tracking point, and judging whether the process is a target GPU process or not based on the collected meta-information of the process; if the process is the target GPU process, transmitting meta-information of the process to a user mode, and if the process is not the target GPU process, ending and exiting; and for the meta-information transmitted to each target GPU process of the user mode, reading the meta-information of the target GPU process through the user mode daemon process, evaluating each node in the NUMA environment based on a preset node allocation rule, selecting an optimal NUMA node, and binding the target GPU process to a CPU of the optimal NUMA node for execution. The GPU computing efficiency and the resource utilization rate can be improved.

To improve the usability of application programs. [Solution] A program including a first application program for communicating with a communication device, which causes a computer of an information processing device having an operating system to execute: an acquisition step in which the first application program acquires a password for an access point outside the information processing device and outside the communication device, which is managed by a second application program different from the first application program, via the file sharing function of the operating system called by the second application program; and a first transmission step in which the first application program transmits connection information, including the password acquired via the file sharing function of the operating system, to the communication device.

An RDMA queue pair multiplexing method based on a shared memory efficiently maps a large number of logical queue pairs (LQPs) to a small number of physical queue pairs (PQPs), and combines shared memory zero-copy communication and O (1) active queue management, so that ten thousand-level LQPs are supported by a small number of PQPs, the overhead of a single-connection memory is reduced by about 60%-64%, and context jitter of a network interface card (NIC) is avoided; the connection establishment time delay and the short flow end-to-end time delay are greatly reduced; through O (1) active tracking and batch processing, CPU idling and system calling overhead are greatly reduced, and high throughput and expandability are achieved; the method can be implemented in a pure user mode, a kernel or NIC does not need to be modified, and the method can be immediately deployed in an existing RDMA environment.

The invention relates to a system calling ptrace-based operating system micro-service security protection system and method, which are characterized in that the running state of micro-service is monitored in real time through calling of a ptrace system in a user state, and dynamic integrity verification is realized in combination with an SM3 hash algorithm. The method comprises the following steps: calculating an SM3 hash value of a code segment of a micro-service when the micro-service is started, storing the SM3 hash value as a static reference, periodically reading memory data of a target process through ptrace in a running process, recalculating a dynamic hash value, and comparing the dynamic hash value with a reference value; if it is detected that the hash values are inconsistent, it is judged that code injection attacks exist, and a defense mechanism is triggered. According to the method, the system stability risk caused by kernel module injection is avoided, meanwhile, real-time interception of tampering attacks during operation is achieved through high-frequency dynamic comparison, the lightweight design enables the method to be suitable for high-reliability scenes such as spaceflight with limited resources, the integrity of a micro-service code segment can be guaranteed, low performance loss of the system can be maintained, and the system reliability is improved. The balance blank between dynamic defense and system stability in the prior art is effectively filled.

A cyber threat information processing method including generating stack trace information of a reader program of an operating system executing a non-executable file at a hooking point of a system call of the operating system when the reader program performs the system call, obtaining a calling function for calling the system call and a variable corresponding to the calling function from the generated stack trace information, and providing description information about the obtained calling function and the variable corresponding to the calling function.

The invention discloses a file sharing method between operating systems, which is applied to realizing file sharing between the operating systems in a network-free scene. In the method, when a first operating system obtains a system call request for a file, the first operating system sends a corresponding file operation request to a second operating system through a shared memory, so that the second operating system can complete corresponding operation on the file and return a file operation result. In this way, the first operating system can process the system call request for the file based on the file operation result and return the corresponding system call result. Namely, the first operating system instructs the second operating system to execute the operation on the specific file through the shared memory, so that the file managed by the second operating system is shared to the first operating system, and interaction between the two operating systems is realized through the shared memory without depending on a network environment. And file sharing can still be realized between operating systems in a scene without a network.

The invention discloses a system call hijacking method and device compatible with multiple versions of Linux kernels, a first hijacking channel and a second hijacking channel are deployed in parallel in a target version of Linux kernel in advance, the first hijacking channel is adapted to a Linux kernel version executing system call through a system call table, and the second hijacking channel is adapted to a second hijacking channel which is adapted to a Linux kernel version executing system call through a system call table. The second hijacking channel is adapted to a Linux kernel version which executes system calling through a system calling distribution function, and the method comprises the following steps: in response to a system calling request, hijacking the system calling request to a pre-defined target address through a target hijacking channel which actually takes effect in a Linux kernel of a target version, determining a corresponding target function based on the target address; sorting system call parameters carried in the system call request into a data format required by a preset hook entry function through a target function, and sending the data subjected to format sorting to the hook entry function; and determining a security processing strategy for the system call request through a hook entry function on the basis of the formatted data.

The invention provides a large model assisted Fuzz test Harness generation method and system, and the method comprises the steps: migrating a library of a QNX platform to a Linux environment for operation, and carrying out the glue code packaging of interface difference and system call difference through the generality that the library of the QNX platform and the Linux environment share a POSIX standard, thereby achieving the automatic adaptation of key API and context constraint; then analyzing binary semantics by means of an intelligent Agent constructed by a large model, automatically generating a Harness skeleton, focusing potential dangerous points (such as memory management, character string processing functions and the like), generating an initial seed in combination with a static or dynamic analysis result, and finally executing a Fuzz test in a controllable execution environment. And high coverage and rapid vulnerability positioning of the multi-dimensional attack vector of the target library are realized. The technical problems that Harness writing highly depends on expert experience, a customized generation strategy for target binary semantics is lacked, and comprehensive understanding on the binary semantics and context constraints is lacked are solved.

The embodiment of the invention provides a memory strategy management method and device, and relates to the technical field of computers.The method comprises the steps that a kernel of a multi-memory-node system receives a strategy setting request sent by a first process through preset system calling, and the strategy setting request comprises strategy setting parameters and an identifier of a second process; verifying the permission and strategy setting parameters of the first process and the second process; if it is determined through verification that the first process has the permission to modify the memory strategy, the strategy setting parameters are legal, and the second process exists, the memory strategy of the second process is processed according to the strategy setting parameters. According to the scheme, the problems that in the prior art, cross-process memory strategy management operation is complex, flexibility and adaptability are insufficient, and extra safety risks, performance fluctuation and instability are possibly introduced can be solved.

The invention belongs to the technical field of intelligent building automation communication, and discloses a KNX protocol hierarchical communication system and method, and the system comprises a microcontroller subsystem and a main control subsystem. The main control subsystem runs a standard Linux operating system and deploys a standard KNX protocol stack, the standard KNX protocol stack comprises a link layer, a network layer, a transmission layer and an application layer and provides a standard programming interface for upper-layer application, and a Web server running on the same Linux system calls the standard programming interface to process KNX communication; the microcontroller subsystem is used for realizing a physical layer function of a KNX protocol; the master control subsystem is connected with the microcontroller subsystem through a USB interface, and the USB interface adopts a private protocol to carry out data transmission. By decoupling a hardware processing layer and a software protocol part, the overall architecture of hierarchical communication is used as a KNX equipment communication node, a complex algorithm can be realized, a bus signal can be responded at a microsecond-level speed, and completeness and reliability of data transmission are ensured by constructing a self-defined private protocol.

The invention relates to a high-performance spaceborne intelligent calculation terminal and a starting method thereof. The terminal comprises a routing unit, a storage unit and an intelligent calculation unit, each of the routing unit and the intelligent calculation unit comprises a hardware physical layer, a hardware driving layer, an embedded operating system, a resource scheduling management layer and an application service layer; the application service layer is used for configuring different application service APPs according to spaceflight application scenes and function requirements, and the application service APPs comprise service plug-ins corresponding to the resource scheduling management layer called by an embedded operating system and universal task distribution and resource management modules in the operating system according to the different application service APPs related to intelligent AI model intelligent calculation. In combination with corresponding hardware drive, computing power and hardware resources required by the intelligent AI model are flexibly configured for multi-user application software; the routing unit is used for providing interface communication with the outside, and realizing optical fiber data receiving and transmitting health management, Ethernet bus communication, RS422 bus communication, data routing management, task scheduling management, remote control and telemetering, centralized management of a system program or an application program or an FPGA configuration program, and a power supply control function; the intelligent calculation unit dynamically loads the on-satellite intelligent AI model and parameters thereof and is used for completing operation of the on-satellite intelligent AI model; and the storage unit is used for storing on-satellite load original data, intermediate data processed by the on-satellite intelligent AI model and processed data.

The application discloses a kind of application layer bucket level local host memory weight cache management method, equipment and medium, it is related to big language model inference field, method includes: obtaining the bucket level cache index table established by application layer, wherein, bucket level cache index record at least one bucket corresponding to big language model in local cache state, bucket is formed by the independent unit of all weight tensor of big language model according to preset bucketing rule division;The cached bucket is fixed in local host memory by memory locking system call, can solve the defect that operating system autonomously expels weight data in existing scheme, application layer cannot intervene;And when target big language model is loaded, based on bucket level cache index table, cache state is inquired bucket by bucket, and the cached bucket is loaded from local host memory, the expelled bucket is supplemented from other remote storage source, can accurately identify missing weight and only supplement from remote storage source, without full load, finally reduce cold start time consumption.

Systems and methods are directed to incorporating large language model (LLM) prompts into graph queries using graph query language and executing these graph queries. The system receives a graph query that includes a LLM prompt in the graph query language. The LLM prompt comprises an input context and a query to be answered. Based on the graph query, the system traverses a knowledge graph to obtain context data associated with the input context. The context data may be constrained by access control policies of an enterprise providing the knowledge graph. A context table may be generated using the context data based on the input context indicated in the LLM prompt. The system then invokes an LLM to determine a result by applying the query of the LLM prompt to the context data obtained from the traversal of the knowledge graph. The result is then presented on a user interface of a client device.

A kernel of an operating system receives a request from a parent process (e.g., an exec or spawn system call) to launch a child process that executes a binary. The kernel identifies a process-specific launch constraint, which is a precondition for launching the child process. The kernel evaluates the constraint, which can match against any type of system state or variable, including the process's location on disk, protection on disk, and how the process is to be launched. The kernel can then determine whether to launch the child process, thus permitting the child process to be scheduled for execution by the operating system. Launch constraints can be used both for a child process to impose preconditions on the parent process, and vice versa. Launch constraints can be included in the launch request, embedded in the binary, or located elsewhere, such as in a trust cache in kernel memory.

The present application relates to the technical field of computer data processing, and especially relates to an intelligent agent system for automatically identifying, downloading and installing self-controllable peripherals, which comprises a device information acquisition module for collecting data to generate hardware identification data; a driver compatibility determination module for comparing a pre-stored self-controllable peripheral list to match a driver resource to generate a resource identification; a secure downloading module for establishing an encrypted connection to download a driver file, storing the driver file in an isolated sandbox after hash verification and digital certificate verification; a driver migration module for simulating a system call environment through an operating system compatibility layer in the driver migration module, and converting a driver instruction into a host system instruction by using a user-level binary translator in the driver migration module; and an automatic installation module for calling a system interface to deploy the driver and verifying an installation state. The present application realizes closed-loop automatic processing from identification to installation of a peripheral driver, and solves the problem of compatibility between a Linux system and a Windows driver.

This invention discloses a quantum-resistant method and system based on stateless signatures and execution isomorphism, belonging to the field of quantum-resistant cryptography. First, the sender generates an mKEM broadcast payload based on a modulus error rounding algorithm and signs it using a stateless hash signature algorithm. The receiver performs microsecond-level verification of the signature at the network card driver layer; if verification fails, the signature is silently discarded. After successful verification, a dedicated PQC hardware engine decapsulates the signature, implicitly outputting a pseudo-random scrap key if verification fails. The operating system executes an I / O-aware microarchitecture with isomorphic execution, forcing subsequent processes to maintain physical isomorphism in system calls, memory accesses, and peripheral bus activities, regardless of whether the key is real or scrap. This invention eliminates the risk of private key leakage caused by cloud-based state management through stateless signatures and completely eliminates distinguishable side-channel fingerprints across the entire link through physical-level execution isomorphism, achieving system-level quantum-resistant security in high-concurrency scenarios.

The invention provides a ransomware detection method and device based on eBPF and machine learning, and relates to the technical field of information security, the method comprises the following steps: mounting an eBPF program to a key system of a target system for calling, and capturing file operation behavior data such as a process identifier and an operation type in real time through an event-driven mechanism; extracting features based on a preset time window, counting process file operation cumulative times, screening out abnormal operation behaviors through threshold filtering, and constructing context features at the same time; utilizing a support vector machine algorithm to train feature data to generate a classification model, and optimizing kernel function parameters to improve small sample scene classification accuracy; and continuously collecting real-time file operation data through an eBPF program, inputting the real-time file operation data into the model, carrying out dynamic classification, and triggering alarm and blocking when the ransomware is detected. According to the method, the system performance overhead is effectively reduced, the detection real-time performance and accuracy are improved, and the model stability is enhanced.

The invention provides an address space management method and a secure container, and relates to the technical field of computers.The method comprises the steps that a two-stage address translation page table EPT corresponding to at least one LibOS process in at least one container instance is constructed; each EPT is used for representing a mapping relation between a user physical address corresponding to each LibOS process and a real physical address so as to construct a mutually isolated virtual address space between different LibOS processes; and based on the VMFUNC instruction, switching the EPT corresponding to the current LibOS process in a user mode so as to switch to the EPT corresponding to the target LibOS process. According to the method, security isolation of multiple LibOS process address spaces can be realized; meanwhile, address space view switching is completed in a user mode by using a VMFUNC instruction, high-performance overhead brought by VM-Exit and system calling is completely avoided, and extremely-low-delay and high-efficiency process and instance switching is achieved.

The present application belongs to the technical field of coal mine safety engineering, and particularly relates to a gas extraction blind area detection method and system based on three-dimensional space analysis and intelligent algorithm. The method is based on the secondary development of the AutoCAD platform. The system calls the AutoCAD ActiveX interface through VBA programming, realizes the automatic import of the extraction drilling data and three-dimensional modeling, and adopts the Bezier interpolation algorithm to construct the coal seam model under the influence of gas extraction. The present application realizes the automatic and high-precision detection of the gas extraction blind area, has high detection accuracy, greatly reduces the manual detection error, improves the coal mine gas control efficiency, and provides intelligent technical support for the prevention and control of gas disasters.

A kernel monitor can be used to mitigate ransomware activity of a host system. In some aspects, a computing system can use the kernel monitor to monitor a set of system calls generated by the host system within a time window to perform a functionality. The kernel monitor can include a respective kernel program monitoring each system call in the set of system calls. The set of system calls can be filtered by the kernel monitor to identify a subset of system calls associated with encrypting a filesystem of the host system. The computing system can determine that the subset of system calls is indicative of ransomware activity associated with the host system based on the subset of system calls exceeding a predefined threshold. Subsequently, the computing system can perform a mitigation operation to mitigate the ransomware activity.

A three-dimensional model (i.e., MCAD model) for additively manufacturing a physical object with a laser is received in a computer system. The laser is controlled or driven by a set of instructions. The instructions specify scan properties for scanning each of multiple deposit layers during the additive manufacturing. Two-dimensional (2D) maps representing the scan properties for the deposit layer are generated. Each 2D map includes values in grid points representing the deposit layer. Each 2D map corresponds to a respective scan property for the deposit layer. A trained machine learning model is invoked to predict a physical behavior of a layer of the physical object based on the 2D maps as an input. The input further includes a state map showing a state of an immediately prior deposit layer. The layer of the physical object corresponds to the deposit layer.

The invention discloses an AI-based Jetson equipment system state dynamic atlas diagnosis system and method, and relates to the technical field of Jetson equipment state analysis, and the analysis system comprises a system call collection module which carries out the structural processing of a system call track; the calling sequence extraction module is used for carrying out continuous calling identification on the execution process recording path and extracting a calling sequence fragment with a specific mode; the state atlas construction module is used for establishing a system state change atlas for the screened calling sequence fragments in a graph structure splicing manner; the AI intelligent diagnosis module is used for analyzing the system state change atlas by using a pre-trained artificial intelligence model; according to the AI-based Jetson equipment system state dynamic graph diagnosis system and method, the system state change graph is established through graph structure splicing, so that a dynamic behavior has a static structure expression capability, the running state of equipment can be analyzed more accurately, and the fault detection precision and reliability are improved.

A storage system includes a storage device and a host device. The storage device includes a non-volatile memory device configured to store data and a storage controller configured to control the non-volatile memory device to isolate and store the data by grouping storage spaces of the non-volatile memory device into a plurality of isolated storage spaces. The host device includes a file system configured to generate and manage a plurality of file allocation instances corresponding to a plurality of file allocation system calls from an application program by allocating, with respect to each of the plurality of file allocation system calls, a logical address range and an isolated identifier of a plurality of isolated identifiers corresponding to the plurality of isolated storage spaces.