225results about How to "Improve defense" patented technology

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

The invention provides an information network security self-defense method and system based on trusted computing, and the method comprises the steps: constructing a trusted computing platform which comprises the steps: deploying a trusted platform module TPM, building a trusted software stack TSS, and implementing a trusted network connection TNC; designing a self-defense architecture, wherein the self-defense architecture comprises deployment of a network layer, an application layer and a data layer defense system, integration of an intelligent sensing system and establishment of a central control and decision center; network traffic and user access behaviors are monitored, and embedded attack behaviors are preprocessed; performing anomaly detection on the network flow and the user access behavior by applying a machine learning algorithm; calculating a real-time risk score based on the anomaly detection result, and generating a security situation awareness report; and based on the security situation awareness report, defining a threat level and a response level, and executing automatic defense.

The invention provides a firewall attacked surface carding and security reinforcing method, which comprises the following steps of: protecting sensitive data in each link of data flow in an identified supply chain, deploying a data leakage prevention gateway on a data flow link, and adopting deep packet detection of content awareness to carry out security reinforcement on the data flow link. Visualized presentation and security auditing of data flow behaviors are realized, and abnormal data flow is blocked and alarmed; the method comprises the following steps: constructing a security policy configuration knowledge base, mapping service description into a security policy component, automatically generating a fine-grained security policy matched with service semantics by adopting a policy generation engine based on combination of rules and deep learning, and realizing cross-scene policy conflict detection and correction by virtue of reasoning of a constructed knowledge graph.

The invention discloses a data communication method and system based on information security, and belongs to the technical field of data communication, and the data communication method comprises the stages of preparation, transmission, intrusion detection and defense, receiving verification and cleaning ending. The two parties authenticate and exchange keys during preparation; encrypting data by using a symmetric key and an AES algorithm; automatic defense is performed after intrusion detection; the receiver verifies the data; and cleaning the resources at the end, and performing log optimization on the system. According to the invention, through innovatively improving the intrusion detection and defense method, based on real-time network flow monitoring, intrusion analysis based on machine learning and an automatic defense mechanism, the detection accuracy and efficiency are greatly improved, and false alarms and missing alarms are reduced; defense capability and flexibility are enhanced, attacks are intelligently blocked and isolated, and cooperative emergency response is rapid; data communication security technology progress and expansion are promoted, and network security is powerfully guaranteed.

The invention relates to the technical field of network security, and discloses an LLM-based network threat flow detection rule automatic generation method and system. According to the system, an automatic rule generation framework based on a large language model is constructed for network threat traffic, and the system comprises a cue word module, a large language model module, a rule engine module and a rule base management module; the four modules are executed in sequence to form a complete link from traffic information input to rule automatic generation and application verification; according to the method, domain knowledge is fused into a pre-training model through LoRA fine tuning, small sample cue word engineering and a correction mechanism based on engine feedback, verification is carried out through an actual detection engine, and the effectiveness of a rule automatically generated by the model is verified. According to the method, the network threat traffic sample can be fully and effectively analyzed, meanwhile, the requirement for training data is reduced, the rule set capable of being practically applied is generated, and the network defense capability is improved.

The invention discloses a federal learning data processing method based on privacy protection, and the method comprises the following steps: S1, a client uses local data to train a generator of a generative adversarial network, and generates virtual data similar to the local data in distribution; s2, setting three privacy protection levels according to the privacy sensitivity of the local data; s3, performing model updating operation by using a homomorphic encryption technology; s4, utilizing a dynamic weight optimization mechanism based on a multi-arm bandit algorithm to obtain a priority processing data set; s5, preliminarily updating the global model, analyzing generated data through a reverse inference detection mechanism, and judging whether a privacy disclosure risk exists or not; s6, the server feeds back the updated global model to the client, and the client continues personalized model training in combination with local data; and S7, generating new virtual data, and carrying out the next round of global model training. According to the method, the generative adversarial network, differential privacy and homomorphic encryption are combined, so that efficient federated learning under privacy protection is realized.

The invention relates to an earthquake fracture inversion method based on multi-source observation data. The method comprises the following steps: acquiring a seismic source mechanism solution of a specified earthquake event; according to the seismic source mechanism solution, geometric parameters of a fault of the seismic event are obtained; generating a three-dimensional grid model of a fault plane to which the fault belongs according to a pre-constructed geometric shape model of the fault and the geometric parameters of the fault; according to the limiting condition of each sub-fault in the three-dimensional grid model, obtaining the slippage of the sub-fault to which the seismic fracture belongs; and according to the observation data to which the seismic event belongs and the slippage of the sub-faults, performing inversion verification by means of an inversion model, and if the verification is passed, taking the slippage of all the sub-faults as a seismic fracture inversion result when the verification is passed. According to the method, the stability and reliability of an inversion result are improved, the sliding vector at each sub-fault can be better estimated, and the sliding process of the whole seismic fault can be more comprehensively understood.

The invention discloses a security operation method and device based on multi-agent collaboration, and relates to the technical field of network security, and the method comprises the steps: a data collection step, a data preprocessing step, and a step that an attack detection agent obtains network security request information to carry out first judgment; a step of controlling the decision-making agent to perform comprehensive judgment by using a second deep learning network according to the initial judgment result of the attack detection agent and the network security response information in the structured input data; and the emergency response agent obtains a first comprehensive judgment result from the message queue and executes a defense behavior. According to the invention, the powerful data processing capability of a large model and the division and cooperation advantages of multiple agents are utilized, so that the real-time defense capability and the cooperation effect of the system are improved.

The invention discloses a security protection method and system for an information management system and a storage medium, and relates to the technical field of security protection.During operation of the system, when a user logs in or carries out sensitive operation, multiple identity verifications are carried out, an identity verification coefficient AC is obtained through calculation, various security parameters in the system are collected and updated in real time, and the security protection efficiency is improved. A high-strength encryption algorithm is applied to data to be transmitted, an encrypted data packet is generated, a transmission encryption coefficient EC is obtained through calculation, corresponding access permissions are set for different data based on user roles, identities and access content, an abnormal monitoring coefficient ADC is obtained, and a comprehensive safety coefficient SEC is obtained through calculation according to an identity verification coefficient AC, the transmission encryption coefficient EC and the abnormal monitoring coefficient ADC. The overall safety of the system is dynamically evaluated, abnormal behaviors are recognized and logs are recorded by comparing the comprehensive safety coefficient SEC with a preset threshold value, and when the system detects an abnormal access mode, a safety alarm is triggered and countermeasures are taken.

The invention discloses a human face sensitive data protection method based on an elastic anti-interference privacy protection mechanism, belongs to the field of information processing, and provides a dynamic self-adaptive sampling strategy based on information entropy in a data preprocessing stage, and the sampling rate is adjusted according to the distribution characteristics of a human face data set and the weight of sensitive information. And the model performance is maximized on the premise of ensuring user privacy. In order to obtain a better privacy protection effect, an entropy adjustment differential privacy mechanism is designed, and Gaussian noise of different degrees is adaptively added according to an information entropy value of face data after a face data set is dynamically and adaptively sampled, so that refined privacy protection of face sensitive data under differential privacy constraint is realized. In a model training stage, an elastic anti-interference training method is provided, diversified adversarial samples are dynamically generated in different stages of model training, and the over-fitting risk of the model is reduced while the robustness of the model to various types of adversarial attacks is enhanced.

The invention discloses an attack trapping method and system based on network attack surface adaptive conversion, and the method comprises the steps: dynamically converting vulnerabilities and weaknesses in a system, so that an attacker is difficult to determine an entrance of a real system; threat intelligence and a network environment are monitored and analyzed in real time, and abnormal traffic and potential attack behaviors are identified; constructing a false target and monitoring attack behaviors, and obtaining behavior characteristics and attack means of an attacker; attack behavior data are analyzed by using artificial intelligence and a machine learning algorithm, potential threats are quickly identified and responded, a threat intelligence library and a defense strategy are updated, and the method better adapts to constantly changing attack means and threat forms. The method not only can trap attack behaviors, but also can collect and analyze behavior characteristics of attackers, and provides more accurate data support for network security decision and threat prediction.

The invention provides a tracking type unmanned aerial vehicle countering method and system, and belongs to the technical field of unmanned aerial vehicle countering, and the method comprises the steps: monitoring a communication frequency band of a tracking type unmanned aerial vehicle in real time, and determining real-time signal data and a signal feature vector; extracting a frequency hopping behavior of the tracking type unmanned aerial vehicle, determining frequency hopping data, and analyzing the frequency hopping data to determine a frequency hopping type; determining a communication interference signal and a frequency hopping interference signal of the unmanned aerial vehicle; transmitting a communication interference signal and a frequency hopping interference signal, and acquiring interference signal data of the tracking type unmanned aerial vehicle after the communication interference signal and the frequency hopping interference signal are transmitted; and dynamically adjusting a communication interference signal and a frequency hopping interference signal, and evaluating a countering effect. The method can optimize the countering strategy in real time, improves the pertinence and accuracy of the interference effect, guarantees the effectiveness of countering measures in a complex environment, provides a more flexible and more efficient technical means for the safety management of the unmanned aerial vehicle, remarkably enhances the defense capability, and remarkably improves the intelligent level of the monitoring and management of the unmanned aerial vehicle.

The invention relates to the technical field of network security, in particular to a network security analysis method and system based on digital twinning. The method comprises the following steps: carrying out network topology perception on a target network to obtain a network data transmission topological graph; carrying out real-time traffic first acquisition on the target network to obtain a first real-time traffic data set; performing digital twinborn model construction on the target network according to the first real-time traffic data set based on the network data transmission topological graph to obtain a network digital twinborn model; performing real-time traffic second acquisition on the target network to obtain a second real-time traffic data set; performing equipment system log collection on the target network to obtain an equipment system log set; and performing data synchronous mapping on the second real-time traffic data set, the equipment system log set and the network digital twinborn model to obtain a real-time network digital twinborn model. According to the invention, the network security risk is obviously reduced.

The invention relates to the technical field of security monitoring, in particular to an intelligent all-in-one machine operation security monitoring method and system, and the method comprises the following steps: obtaining an operating system log and an application program log, integrating the logs into a comprehensive data stream, judging the security risk level of the comprehensive data stream, obtaining a primary risk assessment result, and obtaining a secondary risk assessment result; and adjusting intrusion detection sensitivity and an access control list of the firewall according to the primary risk assessment result to obtain dynamic security policy configuration. In the invention, the dynamic security policy configuration enables the security system to automatically adjust according to real-time analysis, such as firewall setting and access control, so as to quickly cope with a changing threat environment. The strategy not only improves the adaptability of defense measures, but also optimizes the use efficiency of system resources. Furthermore, behaviors which do not conform to a normal mode can be identified and predicted through analysis of the comprehensive data stream, and the prediction capability of potential threats is enhanced.

The invention relates to an intelligent behavior analysis and anomaly detection system for Internet of Things security, which is applied to the technical field of Internet of Things security, and comprises a data acquisition module, a data preprocessing module, a behavior modeling module and an anomaly detection module, the data preprocessing module cleans the data, the behavior modeling module generates a vector sequence of equipment behaviors through feature embedding and position coding, and the anomaly detection module analyzes time sequence association of the equipment behaviors by utilizing a self-attention mechanism and a multi-head attention mechanism and judges whether the equipment has abnormal behaviors or not. The cooperative defense module realizes cross-device cooperative defense through an edge detection unit and a cloud analysis unit, and the threat intelligence sharing module realizes sharing and updating of threat intelligence through a local intelligence database and an external intelligence interface. And the response module carries out automatic defense and notifies a system administrator through the automatic defense unit and the alarm unit when an abnormity is detected.

The invention discloses a defense method oriented to adversarial patch attacks, and the defense method oriented to adversarial patch attacks is realized by designing an adversarial mask generation method and a classification-reconstruction joint training method by utilizing the characteristic that a mask reconstruction task has good feature extraction capability. According to the defense method facing the adversarial patch attack, an image recognition model is divided into a backbone network and a full connection layer which are respectively used for feature extraction and classification prediction, and after a reconstruction model is connected to the backbone network, the reconstruction model is used for receiving image features extracted by the backbone network and reconstructing an image. The connected image recognition model backbone network, the full connection layer and the reconstruction model are generally called as training models. The connection mode does not need to modify the structure of an original image recognition model, only optimizes the weight parameters of the original model, is suitable for deep learning visual models of any architecture, is suitable for models in any training state, and does not need to forcibly train from the beginning.

The invention discloses a large model method for network security, which sequentially constructs an adaptive security policy generation model, a network security risk assessment model and a multi-task deep neural network model through multi-stage training, so that a large model covers wide network security tasks, and comprehensive protection from threat detection to risk assessment is realized. The fine training and optimization of each stage ensure that the model deeply understands and deals with complex network security challenges. The self-adaptive security policy generation model adjusts the security policy in real time by learning the change of the network state, and the defense capability is enhanced. The network security risk assessment model generates an accurate risk score by analyzing risk factors, and provides a clear security situation view for managers. A double-attention mechanism is introduced to further optimize feature processing, channel attention intensifies key features, and space attention optimizes space distribution, so that the model is more accurate when capturing and positioning abnormal behaviors.

The invention discloses a robust backdoor defense method and system without auxiliary data dependence, and belongs to the technical field of deep learning model security and artificial intelligence defense. The internal relation between back door injection and sample pollution is analyzed through confrontation disturbance, and a clean sample and a polluted sample are preliminarily isolated from a toxic data set; performing reverse learning and re-learning on the selected clean sample, and training to obtain an enhanced poisoning model; polluted samples and clean samples are accurately identified by enhancing a poisoning model, model training is performed based on the clean samples, a back-door-free robust model is finally obtained, finally, the polluted samples are re-labeled and are used for fine adjustment of the back-door-free robust model, and the robustness of the model is further improved. The method does not depend on any auxiliary clean data set, various backdoor attacks can be effectively resisted, and meanwhile the high precision of the model is kept. According to the method, the vacancy of robust backdoor defense model training under the condition of no auxiliary data in the prior art is filled.

The embodiment of the invention provides a method and a device based on ATTamp; the invention discloses an industrial control intrusion detection method and system of a CK framework, and belongs to the technical field of intrusion detection. The method comprises the following steps: collecting and standardizing required related data, and reproducing each attack technology to generate an initial attack detection rule; comparing the attack event information with an initial attack detection rule, and identifying an attack behavior; identifying false-report and / or missing-report attack behaviors as optimization attack behavior targets, and executing iterative optimization attack detection rules on each optimization attack behavior target to obtain an optimization attack behavior set; and constructing a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and executing intrusion real-time monitoring based on the knowledge graph. According to the scheme of the invention, automatic attack behavior detection and optimization are realized, the defense capability for the intrusion attack of the industrial control system is greatly improved, and meanwhile, through continuous iterative optimization, the accuracy and real-time performance of attack detection are ensured.

The invention relates to a network attack defense method and system for a distributed new energy grid-connected system, and the method comprises the steps: generating a dynamic defense strategy based on an IP address for the network abnormal flow and an attack sensing result when a new energy terminal is accessed; generating a random routing scheme based on a preset depth deterministic policy gradient; and performing dynamic defense in combination with the dynamic defense strategy and the random routing scheme. The method has the advantages that the comprehensiveness and comprehensiveness of network attack defense of the new energy grid-connected system are improved, and the network and data security of the new energy grid-connected system is guaranteed.

The invention discloses a computer network security transaction optimization system, and belongs to the technical field of network transaction security. The system comprises an identity verification authorization module, a transaction request processing module, a security monitoring protection module, a transaction intelligent optimization module, a transaction auditing management module and a transaction report analysis module, protection is enhanced by analyzing a user behavior mode, additional verification is triggered when abnormality is detected, the risks of identity false use and fraud are reduced, and the safety of the transaction is improved. Network traffic is monitored in real time, potential attack behaviors are identified and blocked, through transaction request checking and dynamic request scheduling strict auditing, node loads are monitored in real time, transaction requests are intelligently scheduled, system overload or bottleneck is avoided, standby nodes are automatically started, stable operation under the high concurrency condition is guaranteed, and the system reliability is improved. The method enhances the adaptation to the increase of the transaction flow and the change of the network environment, improves the security, efficiency and transparency of the transaction through the transaction audit management and report analysis, and guarantees the stability and compliance of the financial transaction environment.

According to the program behavior intervention method based on the quantum state, the target program state is quantized, the quantum state is generated, synchronous monitoring of multiple program behaviors is achieved through the quantum entanglement effect, and the malicious behavior tendency of the program is detected by defining the quantum threshold function; the program quantum state is intervened by using a quantum control operator, so that the program state is adjusted and malicious behaviors are prevented; in addition, a random disturbance term is introduced to increase system complexity, and an intervention strategy is dynamically adjusted through multiple quantum state measurement and feedback, so that control parameters are optimized. According to the method, the problems of insufficient detection precision and weak defense capability when a traditional program behavior detection technology is used for processing complex program behaviors are effectively solved, the safety and the stability of the system are remarkably improved, and the detection and defense capability on complex malicious behaviors is enhanced.

The invention discloses a large-scale network security defense system based on collaborative intrusion detection, and belongs to the field of network security intrusion detection.The large-scale network security defense system comprises the steps that firstly, an intrusion unit node detection module preliminarily conducts intrusion detection by monitoring feature data of network equipment, and an intrusion detection analysis instruction is sent to a collaborative analysis module; the collaborative analysis module receives an intrusion detection analysis instruction, collaboratively analyzes network security audit log data, screens intrusion detection results and matches a defense strategy, and finally, the management control module filters and blocks network traffic according to the defense strategy. Through the large-scale network security defense mode of collaborative intrusion detection, data and resources of a plurality of nodes are fully utilized, distributed intrusion detection and defense are realized, intrusion behaviors can be detected and blocked more quickly, the influence of network security events is reduced, potential security threats can be quickly responded, and the security risk of the network is reduced. And the network security is effectively protected.

The invention discloses an internet of things-oriented federated learning anti-poisoning attack method. The method comprises the following steps of S1, initializing an internet of things federated learning system; s2, performing mask processing on the privacy data of the Internet of Things participants; s3, the cluster server collects mask data provided by all the Internet of Things participants and aggregates the mask data; and S4, identifying malicious poisoning participants of the Internet of Things through robust clustering. According to the method, an advanced machine learning algorithm and a privacy protection technology are introduced, a more effective anti-poisoning protection measure is provided for the Internet of Things system, the security and robustness of the Internet of Things system are remarkably improved through successful application of the method, and an important guarantee is provided for coping with potential hostile attacks and data tampering.

The invention discloses a wireless router access management method and system and a wireless router, relates to the technical field of wireless routers, and remarkably improves network security and resource utilization efficiency through multiple authentication and a dynamic management mechanism. According to the system, first behavior characteristic data and network state data of equipment are collected, intelligent analysis is carried out in combination with a CNN model, and the security of the access equipment is judged in real time. For equipment meeting the security standard, the system automatically allocates bandwidth and provides continuous network service, and for abnormal equipment, the system blocks access of the abnormal equipment in time through multiple rounds of authentication and load evaluation, so that the security and stability of a network environment are ensured. In the aspect of bandwidth management, the system intelligently sorts and dynamically allocates bandwidth resources according to the second access safety index # imgabs0 # and bandwidth requirements of the access equipment, and low efficiency and resource waste of a traditional static allocation mode are avoided.

The invention provides a reinforcement learning method and system for unmanned aerial vehicle intelligent decision, and a storage medium, and relates to the technical field of unmanned aerial vehicles. According to the invention, on one hand, the decision-making scheme of the unmanned aerial vehicle can be updated through the detection result of the unmanned aerial vehicle, thereby scheduling the task execution scale of the unmanned aerial vehicle formation in real time, and improving the defense effect. And on the other hand, a boundary grid reward obtained based on the differential game is designed, it is ensured that a reward mechanism can accurately reflect the target achievement situation of both game parties, and through continuous iterative optimization of reinforcement learning, the unmanned aerial vehicle can gradually learn an effective unmanned aerial vehicle formation defense strategy in a complex environment.

The invention relates to the technical field of network security, in particular to a network defense method, device and equipment and a medium, which are used for effectively coping with continuously changing network threats and improving the network defense effect. The method comprises the following steps: constructing a deep reinforcement learning DRL model, setting a state space and an action space of the DRL model, and constructing a reward function based on a key defense index of a network system; a flexible action-evaluation SAC algorithm is adopted to train the DRL model; and obtaining current network state information of the network system, inputting the current network state information into the trained DRL model to obtain an optimal network defense measure, and executing the optimal network defense measure. Therefore, by using the deep reinforcement learning technology, a protection mechanism can be dynamically adjusted to cope with continuously changing network threats, and in addition, when potential threats are detected, effective network defense measures are automatically executed, so that the system can turn from passive monitoring to active defense.

The invention belongs to the field of network security, and discloses a defense method for zero dynamic attacks of a wind power generation system, which comprises the following steps: constructing a mathematical model of the wind power generation system; a gain scheduling PI controller and electronic adjustable passive elements are introduced into the wind power generation system, and the electronic adjustable passive elements are a controllable inductance module and a controllable capacitance module and are used for adjusting inductance and capacitance of the system; designing a zero-dynamic attack signal, injecting the zero-dynamic attack signal into the system, and analyzing destructive factors of the zero-dynamic attack; defending the designed zero-dynamic attack signal, dynamically adjusting and optimizing the parameter value of the element adjustment coefficient so as to adjust the inductance and capacitance, converting an unstable zero point into a stable zero point, weakening the destructiveness of the zero-dynamic attack, and realizing defending. According to the method, the system can keep stable operation in a complex environment, the dependence limitation in the prior art is overcome, and the defense robustness is enhanced.

The invention relates to the technical field of network security, in particular to realization of self-efficient autonomous defense in an Internet of Things network. Comprising the following steps: constructing a network attack and defense scene, and modeling observation information by using a graph data structure; modeling the action space of the attacker and the defense agent; modeling an attack and defense process in the network attack and defense scene; performing normalization processing on the feature matrix of the nodes by adopting graph normalization; dynamically aggregating the current state information of each device according to the interaction between the network device and the adjacent device by using the self-attention mechanism of the GAT; selectively reserving a node host according to the self-attention score by using a down-graph sampling pooling strategy; and training a defense agent by using a graph attention network enhanced reinforcement learning algorithm. The problems that automatic defense of an existing reinforcement learning algorithm faces performance bottleneck in a complex network scene, convergence to a high return value is difficult, and an effective defense strategy cannot be made are solved.

The invention relates to the technical field of communication adjustment, and discloses a communication system and method for diabetes outpatient service user management, and the system comprises an acquisition module which is configured to acquire real-time communication data of a plurality of communication devices in a diabetes management system; and the judgment module is configured to obtain network parameters of each communication device, and is further configured to determine a communication fluctuation value according to a relationship among the historical communication data. The prediction module is configured to predict a communication performance change trend of each communication device in a preset time period based on the long short-term memory network, and generate a prediction threshold. The control module is configured to dynamically adjust the communication path according to the relation between the real-time communication fluctuation value and the prediction threshold value. The encryption module is configured to dynamically encrypt the adjusted communication path and data. The communication efficiency of diabetes outpatient service user management can be improved by collecting the communication data in real time, predicting the performance change trend, dynamically adjusting the communication path and encrypting the protection data.