5results about How to "Implement intrusion detection" patented technology

A CAN bus feature fusion intrusion detection method based on adversarial learning relates to a CAN bus intrusion detection method, and time features and signal features of the same CAN ID are spliced into a comprehensive feature matrix for data processing and adversarial training of a detection model; each LSTM sub-network of the detection model is used for processing the corresponding CAN ID comprehensive characteristic matrix; the outputs of the LSTM sub-networks are spliced into a joint potential vector; a coding and decoding re-coding model of the detection model carries out dimension reduction on the joint potential vector to obtain an original intermediate representation, then dimension raising reconstruction is carried out to obtain a reconstructed comprehensive feature close to the latest comprehensive feature, and then dimension reduction is carried out to obtain a reconstructed intermediate representation; and according to the reconstruction error and the recoding error, carrying out abnormal scoring on the latest comprehensive characteristics to judge whether an attack behavior exists or not. According to the method, wider attack types can be detected, the method can still be effectively operated under the condition of lacking labeled training data, and the detection efficiency and safety are remarkably improved.

The application discloses a dangerous area personnel intrusion detection method, comprising the following steps: acquiring image data and preprocessing video; detecting the position and confidence of personnel; continuously tracking the personnel target; comprehensively analyzing the effectiveness of the target trajectory; and judging personnel intrusion to trigger an alarm mechanism. The application realizes real-time personnel intrusion detection of the workshop automation station by combining the YOLOv8 personnel detection algorithm, the Kalman filter and the target tracking technology of the Hungarian algorithm, and the target effectiveness judgment mechanism, constructs a real-time and continuous monitoring process, ensures real-time monitoring and personnel intrusion detection of the workshop automation station, effectively improves the detection precision, reduces the false alarm rate, guarantees production safety, has high detection precision and low false alarm rate in a complex scene, can effectively guarantee the production safety of the workshop, and can also adjust the algorithm parameters and threshold according to the actual field demand, and adapt to different detection frame rate requirements.

The invention discloses a vehicle-based intrusion detection method, device and system and a storage medium, and the method comprises the steps: capturing log data of a target system event based on an eBPF program running in a vehicle operation system kernel, and constructing N to-be-detected sequences based on the captured log data; processing the N to-be-detected sequences based on a preset attack discrimination model deployed in the vehicle to obtain an initial type corresponding to each to-be-detected sequence; all the M to-be-detected sequences of which the initial types are abnormal types are uploaded to a cloud end, and known attack type identification is performed on the M to-be-detected sequences through the cloud end; k to-be-detected sequences are screened out from the to-be-detected sequences of which the initial types are normal types, the K to-be-detected sequences are uploaded to a cloud end, unknown attack type identification is carried out on the K to-be-detected sequences through the cloud end, and N, M and K are positive integers. According to the scheme, vehicle intrusion detection can be comprehensively and accurately realized.

The present disclosure provides a traffic processing method, system, electronic device and storage medium. The method includes: the service communication agent network element sends traffic detection configuration data to the network function network element through a signaling channel; the network function network element performs anomaly detection on the traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result; wherein the detection result is that the traffic data is abnormal traffic data, or the traffic data is normal traffic data; when the detection result indicates that the traffic data is abnormal traffic data, the network function network element performs anomaly processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication agent network element through a signaling channel. The method can reuse the signaling channel between the service communication agent network element and other network elements to realize configuration distribution, and can realize network element-level intrusion detection without affecting the performance of each network element in the 5G core network, thereby improving the overall security protection capability of the 5G core network.

The present invention discloses a DOS attack detection method and storage medium for a vehicle CAN network, the method comprising: generating a remote frame set according to a CAN matrix table; a detection node sequentially acquiring a remote frame and broadcasting it to a CAN bus according to a preset broadcast period; the detection node statistically retrieves the number of other frames received between the remote frame and the corresponding data frame, obtains a count value, and stores it in a storage queue; according to a preset analysis period, respectively calculates the proportion of the number of count values ​​exceeding a preset comparison threshold in the storage queue of each remote frame to the total number of count values, and obtains the first proportion corresponding to each remote frame; respectively judges whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusts the intrusion risk value according to the judgment result; if the intrusion risk value exceeds the preset risk threshold, it is determined that a DOS attack is suffered. The present invention can detect potential DOS attacks in a timely manner.