11results about How to "Achieve defense" patented technology

The invention relates to a network attack defense method and system for a distributed new energy grid-connected system, and the method comprises the steps: generating a dynamic defense strategy based on an IP address for the network abnormal flow and an attack sensing result when a new energy terminal is accessed; generating a random routing scheme based on a preset depth deterministic policy gradient; and performing dynamic defense in combination with the dynamic defense strategy and the random routing scheme. The method has the advantages that the comprehensiveness and comprehensiveness of network attack defense of the new energy grid-connected system are improved, and the network and data security of the new energy grid-connected system is guaranteed.

The invention discloses a large-scale network security defense system based on collaborative intrusion detection, and belongs to the field of network security intrusion detection.The large-scale network security defense system comprises the steps that firstly, an intrusion unit node detection module preliminarily conducts intrusion detection by monitoring feature data of network equipment, and an intrusion detection analysis instruction is sent to a collaborative analysis module; the collaborative analysis module receives an intrusion detection analysis instruction, collaboratively analyzes network security audit log data, screens intrusion detection results and matches a defense strategy, and finally, the management control module filters and blocks network traffic according to the defense strategy. Through the large-scale network security defense mode of collaborative intrusion detection, data and resources of a plurality of nodes are fully utilized, distributed intrusion detection and defense are realized, intrusion behaviors can be detected and blocked more quickly, the influence of network security events is reduced, potential security threats can be quickly responded, and the security risk of the network is reduced. And the network security is effectively protected.

The embodiment of the invention provides a method and system for defending against a sample attack and a storage medium, and is used for enhancing the defending effect of the sample attack, and the method comprises the steps: obtaining a combined uncertainty expression; the combined uncertainty expression is an expression for combining cognitive uncertainty and accidental uncertainty of the neural network model; performing model training based on the combined uncertainty expression to obtain an adversarial sample detection model; when a to-be-searched text is received, inputting the to-be-searched text into the confrontation sample detection model, and determining the type of the to-be-searched text; the to-be-searched text type comprises a normal text and an abnormal text; and if the type of the text to be searched is the abnormal text, refusing the search request.

The present invention discloses a honeypot service system based on a mimic architecture and a processing method thereof, the system comprising: a traffic proxy module for receiving traffic from an attacker, distributing the traffic to various heterogeneous executors, and sending the result of the heterogeneous executors feedback to the attacker; the heterogeneous executors for responding to the traffic from the attacker and feeding back the result to the traffic arbitration module; a kernel monitoring module for real-time monitoring of the host machine of the virtualization platform, when traffic with dangerous instructions enters the heterogeneous executors and generates an escape on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment; the traffic arbitration module is used to make an arbitration according to the feedback results of the kernel monitoring module and the heterogeneous executors, and send the arbitration result to the scheduling module; the scheduling module is used to send instructions to the heterogeneous executors and the traffic proxy module according to the feedback results of the traffic arbitration module. The present invention realizes the detection and defense of virtual machine escape.

The malicious code defense method, system, electronic device and storage medium based on simulated disguised debugging environment disclosed in the embodiment of the present invention relate to the technical field of malicious code protection. It can realize the detection and defense of malicious code. The method includes: obtaining the function call related to debugging in the system, modifying the return value of the function call; modifying the registry item related to the debugger configuration in the system registry; the registry item includes: calling the debugger name; starting at least one debugger process in the system to simulate and disguise the running debugging environment to confuse the malicious code to misjudge that it is currently in the running debugging environment when executing; monitoring the execution of instructions used to measure the execution time of malicious code; when the execution time of the instruction is monitored to be abnormal, controlling the execution behavior of the instruction to prevent the malicious code from judging the current simulated disguised debugging environment. It is suitable for malicious code detection scenarios.

This invention provides a privacy-preserving method, system, and device for perturbation-based graph federation learning. Specifically, it includes the following steps: S0, acquiring original local graph data in the local environment of each federation participant, the original local graph data including graph node feature vectors and a first adjacency matrix; S1, calculating graph node embedding representation vectors based on the graph node feature vectors and the first adjacency matrix, simultaneously calculating the average degree of nodes, and then constructing a node similarity matrix; S2, selecting a potential edge for any node based on the node similarity matrix and average degree generated in S1, generating a potential edge set, and constructing a second adjacency matrix; S3, performing a secondary screening of the potential edges based on the potential edge set and the second adjacency matrix obtained in step S2, constructing a final adjacency matrix; S4, regenerating the graph node embedding representation vectors based on the final adjacency matrix obtained in S3, and uploading them to a central server.

The present application discloses a small celestial body offset efficiency evaluation method based on state transition tensor, and belongs to the field of spacecraft orbit mechanics. The method of the present application is as follows: a multi-body system dynamics model is established, the impact geometry of the small celestial body relative to the earth is calculated, and the state transition tensor of the small celestial body orbit is derived, so as to quickly calculate the influence of the initial state change of the small celestial body on the impact geometry, and obtain the orbit offset caused by the impact of the impactor when the earth's gravity is dominant after the small celestial body approaches the earth; the second-order state transition tensor is used to obtain the orbit offset of the small celestial body after a period of time, and the high-efficiency quantitative evaluation of the offset efficiency of the small celestial body after being impacted by the impactor is realized. By fixing the velocity deviation and changing the position and direction of the applied deviation, the optimal change direction corresponding to the optimal offset efficiency of the small celestial body orbit can be determined. The present application has the advantages of high evaluation accuracy and high efficiency, and is suitable for offset strategy selection and efficiency evaluation of small celestial body defense tasks.

The invention discloses a virus defense method, system and device and a computer readable storage medium, relates to the technical field of information security and storage protection, and is applied to defense software to detect whether a target host is attacked by a virus or not. In response to the fact that the target host is attacked by the virus, generating a hardware-level blocking signal; the hardware-level blocking signal is sent to a preset hardware device, so that the hardware device modifies firmware area parameters of the target host hard disk after responding to the hardware-level blocking signal, and then the target host hard disk refuses write-in operation on the physical level; wherein the communication link between the defense software and the hardware device is a link independent of the operating system of the target host, and the communication link between the hardware device and the hard disk of the target host is a link independent of the operating system of the target host. According to the method, independent defense which is not influenced by the authority of the operating system can be realized, the defense mechanism can still run normally even if the system is crashed or controlled, the defense capability of the hard disk to viruses is improved, and the security of the hard disk is ensured.

The invention discloses a method for defending Spectre v1 attacks on an ARM framework by using binary instrumentation, which comprises the following implementation steps of: acquiring disassembling information of a target binary file, analyzing the disassembling information, identifying code snippets which are easily attacked by Spectre v1, adding the code snippets which are easily attacked by Spectre v1 into a code snippet set, and performing binary instrumentation to defend Spectre v1 attacks. Whether the code snippet set is empty or not is judged, a defense instruction is constructed according to the code snippets prone to attack under the non-empty condition, and the defense instruction is inserted into the target binary file through a binary instrumentation tool. The method is used for defending Spectrev1 attacks, source codes are not needed, the method is suitable for commercial software and closed source systems, system complexity is not increased, and development cost is low.

The invention provides a traffic detection method and device, electronic equipment and a storage medium. The method is applied to intrusion detection equipment for performing bypass monitoring on network traffic flowing through switching equipment, and comprises the following steps: if the first password error times of a source IP address in a first time period fall into a preset numerical value interval, marking as a first-level early warning state and synchronizing to firewall equipment; for the source IP address in the first-level early warning state, if the number of second password errors in a second time period falls into a preset numerical value interval, marking the source IP address as a second-level early warning state and synchronizing the second-level early warning state to the firewall equipment; and for the source IP address in the second-level early warning state, if the number of third password errors in a third time period falls into a preset numerical value interval, it is judged that the attack is slow brute force attack, and a signal is sent to the firewall device to enable the firewall device to block network traffic from the source IP address. According to the method, the network security defense capability and accuracy are remarkably improved.

The invention discloses a computer information security protection system based on big data, and the system comprises a data collection module which is used for collecting network logs, system logs, application program logs and other information from a plurality of data sources; the preprocessing module is used for carrying out preprocessing operations such as cleaning and formatting on the collected data so as to improve the data quality and availability; the big data analysis engine is used for analyzing the preprocessed data by adopting a machine learning and / or deep learning technology and identifying potential security threats; the threat assessment and response module assesses the detected security event according to the big data analysis result and automatically triggers corresponding defense measures; and the user interface provides a visual and easy-to-use operation interface, so that an administrator can conveniently check the system state, manage rule configuration and query historical records. Various security threats can be effectively monitored and defended, the whole process is highly automatic, and meanwhile efficient operation of the system is guaranteed.