초록 ▼

A computer software architecture for an embedded computer system. The architecture includes a hierarchy of software object classes. One classification includes a common information blackboard object. Data is written to the blackboard object by processes in a protected manner, and is otherwise global

A computer software architecture for an embedded computer system. The architecture includes a hierarchy of software object classes. One classification includes a common information blackboard object. Data is written to the blackboard object by processes in a protected manner, and is otherwise globally readable by all processes. A run-time executive is provided to schedule and coordinate processes. Processes register with the run-time executive at start-up. One process can know the existence and generation of data by another process. The architecture is layered in increasing levels of system abstraction. In one embodiment, the embedded system is an airborne fuel gauging subsystem.

대표청구항 ▼

A computer software architecture for an embedded computer system. The architecture includes a hierarchy of software object classes. One classification includes a common information blackboard object. Data is written to the blackboard object by processes in a protected manner, and is otherwise global

A computer software architecture for an embedded computer system. The architecture includes a hierarchy of software object classes. One classification includes a common information blackboard object. Data is written to the blackboard object by processes in a protected manner, and is otherwise globally readable by all processes. A run-time executive is provided to schedule and coordinate processes. Processes register with the run-time executive at start-up. One process can know the existence and generation of data by another process. The architecture is layered in increasing levels of system abstraction. In one embodiment, the embedded system is an airborne fuel gauging subsystem. 1. A system for detecting intrusions on a host, comprising: a) a sensor configured to collect information directly from a filesystem, the filesystem being associated with the host and including directories having allocated and deallocated directory entries; and b) a directory processing mechanism configured to extract the deallocated entries and create a partial ordering of the entries, wherein each of the deallocated entries is associated with a deleted file and the partial ordering comprises an indication of the relative order in which the deallocated entries were created. 2. The system as recited in claim 1, further comprising a file processing mechanism configured to match contents of a deleted file to a directory and filename in the filesystem. 3. The system as recited in claim 1, wherein the sensor includes the directory processing mechanism. 4. The system as recited in claim 1, wherein the directory processing mechanism is configured to create the partial ordering based on a level of embedding of the entries. 5. The system as recited in claim 4, wherein the directory processing mechanism is configured to create the partial ordering based on a temporal ordering of the entries. 6. The system as recited in claim 4, wherein the entries include filenames, and further comprising an analysis engine configured to expand the partial ordering using at least one constraint based on lengths of the filenames. 7. The system as recited in claim 6, wherein the at least one constraint includes a determination that an allocated directory entry, having a filename of a first length, found after a deallocated directory entry having a filename of a second length not less than the first length, was linked into the directory before the deallocated directory entry was unlinked from the directory. 8. The system as recited in claim 6, further comprising a database of known filenames, and an analysis engine configured to search the partial ordering for filenames matching filenames in the database. 9. The system as recited in claim 8, wherein the analysis engine is configured to use regular expressions in searching for matching filenames. 10. The system as recited in claim 9, wherein the database of known filenames comprises regular expressions. 11. A system for detecting intrusions on a host, comprising: a) a sensor configured to collect information directly from a filesystem directory associated with the host; and b) a file processing mechanism configured to match contents of a deleted file to a directory and filename in the filesystem; wherein the file processing mechanism is configured to use temporal information in matching the contents to a directory and filename. 12. The system as recited in claim 11, wherein the contents include i-nodes. 13. The system as recited in claim 11, wherein the file processing mechanism is further configured to use ordering relationships between unlinked filenames in the directory. 14. A method for detecting intrusions on a host, comprising the steps of: a) collecting information directly from a filesystem associated with the host, the filesystem including directories having allocated and deallocated directory entries; b) extracting the deallocated entries; and c) creating a partial ordering of the entries; wherein each of the deallocated entries is associated with a deleted file and the partial ordering comprises an indication of the relative order in which the deallocated entries were created. 15. A computer program product for detecting intrusions on a host, the computer program product being embodied in a computer readable medium having machine readable code embodied therein for performing the steps of: a) collecting information directly from a filesystem associated with the host, the filesystem including directories having allocated and deallocated directory entries; b) extracting the deallocated entries; and c) creating a partial ordering of the entries; wherein each of the deall