Abstract: A system can be provided for managing software service operations in multi-node environments (e.g., edge computing systems). For example, the system may receive a request to execute an external event from an input device of an edge computing system. In response to receiving the request to execute the external event, the system may identify one or more operations involved in execution of the external event based on configuration data associated with the edge computing system. The system may then control one or more computing nodes to execute the external event by causing the computing nodes to perform the operations.

Abstract: This application relates to automatic real-time detection and mitigation of reverse shell attacks. In some examples, a system can execute a machine-learning model to detect a reverse shell attempt by an attacker in relation to a target network machine in a computer network. In response to detecting the reverse shell attempt, the system can deploy a honeypot network machine in the computer network. The honeypot network machine can be configured to mimic the target network machine and can be sandboxed from a remainder of the computer network. The system can then redirect a connection of the attacker from the target network machine to the honeypot network machine. By redirecting the attacker to the sandboxed honeypot machine, the reverse shell attack can be mitigated.

Abstract: In one example, a system can receive a dependency tree associated with a first software program. The dependency tree can indicate that the first software program has a first dependency on a second software program and a second dependency on a third software program. The dependency tree can further indicate that the third software program has a third dependency on the second software program. The system can determine an update to the third dependency for the third software program. The update can be from relying on the second software program to relying on a fourth software program. The system can cause an action associated with the first software program based on determining the update.

Abstract: Freeze attacks can be prevented using the techniques described herein. In one example, a computing device can receive a software update for a software program. The computing device can receive the software update from an update provider through a first communication channel. Based on receiving the software update, the computing device can transmit a request associated with the software update to a remote server through a second communication channel, the second communication channel being different from the first communication channel. The computing device can receive a response to the request from the remote server. The response can indicate that the software update is outdated. Based on the response indicating that that software update is outdated, the computing device can discard the software update from the computing device without installing the software update. Discarding the software update in this way can help prevent against a freeze attack.

Abstract: A retrieval augmented generation (RAG) process for a large language model (LLM) can be enhanced using contextual data. For example, a system can transform a query into a query embedding and generate weighted similarity scores for chunk embeddings stored in a database. Each weighted similarity score can be generated based on the query embedding, the chunk embedding, and at least one contextual data embedding. The system can select at least one of the chunk embeddings based on the weighted similarity scores. The at least one chunk embedding corresponds to at least one chunk of at least one text document. The system can then retrieve the at least one text document from a document database, generate an input for a LLM that includes the at least one text document and the query, and execute the LLM based on the input to generate a response to the query.

Abstract: Systems and methods for detecting an interaction with an application displayed on a user interface to perform a metric exporting function of the application by using an exporter configuration that is inaccessible to a user. The system and method also includes exporting by a processing device executing an exporter, metrics generated by each of the one or more classes of the application to a monitoring program, wherein the exporter uses the exporter configuration to export the metrics generated by each of the one or more classes.

Abstract: Service disruption avoidance techniques are provided based on deployment metadata associated with a cluster. The cluster includes one or more nodes. A plurality of applications are installed on the cluster. Prior to a maintenance activity to the one or more nodes of the cluster, a processor receives a request to determine a state of maintenance availability of an application. The processor retrieves deployment metadata for the plurality of applications installed on the cluster, in response to receiving the request. The processor parses the deployment metadata to identify one or more installation rules associated with the plurality of applications. The processor determines a set of conflicts for the first application, and determines the state of maintenance availability of the first application based on the set of conflicts.

Abstract: The size of an input prompt for a large language model (LLM) can be reduced according to some techniques described herein. As one example, a system can generate a first vector embedding of a natural language query from a user. The system can also generate a second vector embedding of a conversation history between the user and a LLM. The system can then generate a truncated embedding by executing a filtering process based on the first vector embedding and the second vector embedding. The system can generate an input prompt based on the truncated embedding. The system can then execute the LLM based on the input prompt to generate a response to the query. Reducing the size of the input prompt can decrease latency, execution time, and hallucinations associated with the LLM.

Abstract: Replicated secrets can be migrated from a cloud environment to a local system. For example, a system can receive a secret stored in a first geographic region and a second geographic region of a cloud environment. The system can determine a first security level associated with a first source location of the secret and a second security level associated with a second source location of the secret. The system can encrypt the secret using a first encryption key associated with the first security level to generate a first encrypted secret. The system can determine that a first filesystem in a physical server corresponds to the first source location of the secret and store the first encrypted secret in the first filesystem of the physical server. The first encrypted secret can be usable to control access of one or more protected computing resources.

Abstract: Systems and methods for cloud-based keyless entry are generally described. In some examples, a first number is received from a vehicle. A first computing device of the vehicle may be configured to control an electronic door lock. A first unlock code may be generated using the first number. In some examples, a notification is sent to a remote entry device associated with the vehicle. A response to the notification may be received from the remote entry device. In some examples, the first number may be retrieved from a messaging service based at least in part on the receiving the response to the notification. A second unlock code may be generated using the first number. A determination may be made that the first unlock code matches the second unlock code. An instruction may be sent to the first computing device, the instruction effective to cause unlock of the electronic door lock.

Abstract: In some examples, a system can receive sets of metric values from a first load balancer and a second load balancer in a computer network. The system can detect an anomaly with respect to the first load balancer based on the sets of metric values. The system can determine, based on the anomaly, a first action to execute with respect to the first load balancer. The system can also determine a second action to execute with respect to the second load balancer. The system can then execution the first action and the second action to help resolve the anomaly.

Abstract: Methods and systems for improved optimization of machine learning model explanation processes are provided. In one embodiment, a method is provided that includes generating an approximation model using a model explanation process in order to present one or more relevant features for an output as generated by a model based on an input. Generating the approximation model may include determining a stability measure for a first set of parameter values for the model explanation process. The first set of parameter values to be iteratively adjusted to identify and optimize set of parameter values. The approximation model may then be generated using the model explanation process configured according to the optimize set of parameter values.

Abstract: A computing device can detect an interrupt associated with a virtual machine. Based on detecting the interrupt, the computing device can determine whether the virtual machine is in an idle state. Based on determining that the virtual machine is in the idle state, the computing device can delay the interrupt by storing the interrupt in an interrupt register for a period of time and preventing the interrupt from being transmitted to the virtual machine during the period of time. After storing the interrupt in the interrupt register, the computing device can determine that the virtual machine is in an awake state. In response to determining that the virtual machine is in the awake state, the computing device can transmit the interrupt from the interrupt register to the virtual machine.

Abstract: A system can be provided for deploying a software application in a unikernel to facilitate safety compliance. For example, the system may determine that a software application associated with a computing system satisfies encapsulation criteria of the computing system. The software application may further be associated with a functional safety standard issued by a standard-setting organization. The system may then identifying a minimum set of dependencies for executing the software application on the computing system. Additionally, the system can generate a unikernel comprising the software application and the minimum set of dependencies and deploy the unikernel on the computing system to facilitate execution of the software application on the computing system and compliance of the software application with the functional safety standard.

Abstract: A modification to a filesystem may be identified. It may be determined that the modification to the file system corresponds to a link in the filesystem. A processing device may update a current graph representation of links in the filesystem to produce an updated graph representation of links in the filesystem including the link that corresponds to the modification to the filesystem based on determining the modification to the file system corresponds to the link in the filesystem.

Abstract: Techniques for distributing automation packages are disclosed. An example method includes receiving a playbook that includes a task to be performed by a set of target devices. The method also includes generating an automation package that includes the task included in the playbook. The method also includes encapsulating the automation package in one or more messages, where the one or more messages include a topic identifier that identifies a topic corresponding to the set of target devices. The method also includes sending, by a processing device, the one or more messages to a message service to be published to the topic, where the set of target devices are configured to subscribe to the topic.

Abstract: In some examples, a system can establish a container-registry mesh network across a group of nodes of a computer network. Each node in the group of nodes can execute a container registry API that provides details about container image layers locally stored in the node. The system can receive a request for one or more layers of a container image from a client device. In response, the system can determine one or more nodes storing the one or more layers by transmitting queries to the respective container registry APIs of group of nodes. The system can then instruct the client device to obtain the one or more layers of the container image from the one or more nodes.

Abstract: Packet loss associated with endpoint location changes can be reduced using the technique described herein. In one example, a system can receive a data packet from a sending device, where the data packet is intended for a destination endpoint. The system can determine that a location of the destination endpoint changed from a first location to a second location. This location change might normally result in loss of the data packet. But, based on receiving the data packet and determining that the location of the destination endpoint changed, the system can generate a notification indicative of the location change. The system can then transmit the notification to the sending device. Based on this notification, the sending device can retransmit the packet’s content to the second location to prevent data loss.

Abstract: The present disclosure provides new and innovative systems and methods for automating functional safety scoring in applications. An example method includes a computing device having a processor detecting a requirement to generate a functional safety score for at least a portion of a program. The functional safety score may be based on a functional safety standard (e.g., the ISO 26262 standard). The method may further include determining one or more provisions of the functional safety standard; and identifying one or more signatures for each of the one or more provisions. For each provision, the processor may query the portion of the program for the corresponding one or more signatures. For each provision, the processor may determine a subscore based on the query for the corresponding one or more signatures, resulting in a set of subscores. Based on the set of subscores, the processor may generate the functional safety score.

Abstract: Services can be executed on nodes using initial random access memory disk (initrd) schemes. For example, a system can receive, from an orchestrator node, a request to execute a service at a host node. The request can include data indicative of the service, and the host node can include an initrd scheme. The system can determine that the service is available for execution at the host node based on the service being included in the initrd scheme. In response to determining that the service is available, the system can further transmit a notification to the orchestrator node indicating that the service is available for execution at the host node. Additionally, the system can execute the service on the host node as part of executing the initrd scheme.