32results about How to "Low detection false positive rate" patented technology

The invention relates to a multi-feature fusion phishing webpage detection method, which comprises two parts such as a training process and a detection process. The multi-feature fusion phishing webpage detection method integrates three views of phishing webpage characteristics by combining a semi-supervised learning tri-training method, and mainly solves a problem that the existing phishing webpage detection methods mostly need to perform classification model training by using supervised learning through a large amount of annotation data. The method provided by the invention mainly combines a coordinated training algorithm, starts from webpage URL characteristics, webpage information characteristics and webpage search information characteristics, applies the idea of multiple views and multiple classifiers to phishing webpage detection, and achieves the purposes of reducing the total numbers of manual annotation training samples and timely recognizing a phishing webpage through coordinated training and learning of different classifiers.

The invention relates to a financial fishing webpage detection method based on Web page characteristics. The method is based on pre-established financial first Title keyword library, second Title keyword library, sensitive keyword library and webpage Logo icon characteristic point rule library, and comprises the steps of obtaining an HTML of a to-be-detected webpage by employing a crawler, extracting text information of a Title label, calculating a matching degree with the first and second Title keyword libraries, and if the matching degree is greater than a threshold value, judging as a fishing webpage, or otherwise, going to the next step of detecting; extracting the text information of a special label of the to-be-detected webpage, making a statistics on a matching number with the sensitive keyword library, calculating a sensitive characteristic value, and if the characteristic value is greater than the threshold value, judging as the fishing webpage, or otherwise, going to the next step of detecting; and carrying out fixed point interception on the to-be-detected webpage, obtaining a Logo icon of the to-be-detected webpage, extracting characteristic points of the Logo icon, comparing with the icon characteristic point rule library, calculating a similar degree according to the matching number of characteristic points, and if the similar degree is greater than the threshold value, judging as the fishing webpage, or otherwise, as a normal webpage. According to the financial fishing webpage detection method based on the Web page characteristics related by the invention, whether the to-be-detected Web page is the financial fishing webpage can be judged accurately and quickly.

The invention provides a network intrusion detection method based on multilayer immunization. The method includes: an innate immunization layer performs autologous clustering on a network normal data packet to generate a pattern detector set so as to realize quick response to a known attack; a self-adaptive immunization layer generates a mature detector set used for network data packet abnormality detection through secondary negative selection so as to eliminate network attacks and intrusion that the innate immunization layer cannot eliminate; and a detection response layer uses the pattern detector set generated by the innate immunization layer and the mature detector set generated by the self-adaptive immunization set to perform parallel and dynamic detection on network data to be detected, and feeds back to the innate immunization layer and the self-adaptive immunization layer according detection results so as to improve system detection efficiency and quality.

The invention relates to an early fire smoke detection method based on a semi transparent feature. The method includes 1, acquiring an image as an original one; 2, calculating a recover image of the original image, if the original image is a first frame image being acquired, storing the image and the recover image thereof as a background image and the recover image thereof, repeating the step 1, if not, executing a step 3; 3, acquiring the similarity of the corresponded small regions of the two recover regions; 4, establishing a dissimilar block marking image IO1 different to the recover image in size; 5, calculating the similarity of each image block of the original image and background image; 6, establishing a dissimilar block marking image IO2 different to the original image in size; 7, acquiring image semi transparent regions; 8, searching for a communication region in the semi transparent regions, and calculating the area; 9, searching for a complete smoke region; 10, calculating a dynamic image; 11, outputting alarm signals, and marking the smoke region location in the original image. The method can be applied to the fields of petrochemical factories, large warehouses, large-scale public places and so on.

The invention discloses a host intrusion detection method and device, and relates to the technical field of computers. One specific embodiment of the method comprises the following steps: acquiring signal data of a host, wherein the signal data comprises static signal data n and dynamic signal data s; searching a static detection rule rets matched with the static signal data from a preset featurelibrary; obtaining a dynamic prediction result retd according to the dynamic signal data and an SVM model; wherein the training parameters of the SVM model are obtained by adopting a particle swarm optimization algorithm; and judging whether the current process of the host is an attack behavior or not according to the static detection rule rets and the dynamic prediction result retd. According tothe embodiment, the detection rate of unknown attack behaviors can be improved; the detection false alarm rate of normal operation is reduced, and the stability of normal service is ensured; the detection rule is automatically generated and the detection feature library is updated when the attack behavior is detected, the manual intervention cost is reduced, and the response time to the unknown attack behavior is shortened.

The invention relates to the technical field of vehicle-mounted network intrusion detection, in particular to a vehicle-mounted controller local area network intrusion detection method based on a sliding window and a convolutional encoder neural network. The method comprises the steps: carrying out the data cleaning of received original data, and selecting a CAN ID and a CAN Data as features; converting the characteristics of each dimension of the CAN ID and the CAN Data into binary data; calculating a feature size according to the digit of the converted binary data; setting a square window according to the obtained feature size, and performing sliding window processing on the data by using the window to obtain processed features; inputting the processed features into a convolutional encoder neural network, wherein the convolutional encoder neural network obtains a detection result according to the input data. According to the invention, the abnormal flow and the normal flow can be discriminated with a low false alarm rate and a high detection rate, and the purpose of CAN network intrusion detection is achieved.

The invention discloses an agent user detection method based on a communication behavior portrait. The method comprises the following steps: constructing a portrait model based on the communication behavior; preprocessing the input real traffic data, and aggregating the network traffic according to organized user IP attributes and time attributes in a specified time window to obtain traffic data of each user; extracting communication object stability characteristics and communication object quantity characteristics of a user in a specified time window based on the flow data, and then filteringand screening the two characteristics based on a threshold value to obtain IP information of a suspected proxy user; performing machine learning detection classification on the network flow of each suspected proxy user; and marking the IP of which the flow judgment result satisfies the threshold setting as the IP of the proxy user. The detection method provided by the invention is high in universality, can meet the data volume in the current big data network environment, adopts the portrait model based on the communication behavior, and is low in detection false alarm rate.

An embodiment of the invention provides an API-based Android malicious program detection method, includes decompiling APK file to get smali file, obtaining sensitive API set by Pscout tool, matching API in smali file with API in sensitive API set, composing matching sensitive API set by successful matching API. LibD tool is used to eliminate the API called by the third party library in the matching sensitive API set, and the purified matching sensitive API set is obtained. According to the purified matching sensitive API set, the first eigenvector is constructed, and TF-IDF algorithm reconstructs the first feature vector to obtain a second feature vector;taking the second feature vector as training set, the training depth learning model is used to get the effective classification model, and the effective classification model is used to detect the Android program and obtain the Android malicious program. The embodiment of the invention also provides an active interactive device and a non-transient readable storage medium for realizing the method. The invention can accurately detect the Android malicious program.

The invention provides a webpage feature tampering detection method and device, electronic equipment and a storage medium, and the method comprises the steps of obtaining webpage sample data, and building a webpage sample data set document; extracting text features, structural features and network features from the data set document; and mining a nonlinear relationship among the text feature, thestructure feature and the network feature, and further detecting the tampering behavior category of the webpage feature. The method is advantaged in that through a heterogeneous feature classificationalgorithm based on deep learning, text features, structural features and network features are effectively fused, different types of webpage tampering behaviors are recognized more accurately, and thefalse alarm rate of detection is reduced.

The invention discloses a block chain transaction monitoring method and system based on static characteristics and dynamic instrumentation, and the method and system reduce the detection false alarm rate of malicious transactions to the greatest extent through transaction data static semantic analysis and transaction replay dynamic execution detection, distinguish malicious transaction and normal transaction behaviors more accurately. The transmission behavior of sensitive data in the transaction is detected by intelligent contract virtual machine instrumentation and dynamic taint analysis methods; and meanwhile, a machine learning method is utilized, return results of malicious transaction behaviors and normal transaction behaviors detected by a system dynamic and static method are analyzed, and a final study and judgment stage is added, so that whether the transaction is the malicious transaction or not can be effectively judged. The invention can detect the transaction of the corresponding smart contract of the block chain, assists a machine learning algorithm to effectively improve the detection accuracy in a mode of combining static feature analysis and dynamic execution detection and analysis, and has a significant effect on improving the detection accuracy.

The invention relates to an anti-dry-burning gas stove which comprises an inner fire cover, a temperature detection piece and an air guide assembly. The temperature detection piece and the inner firecover are correspondingly arranged, the temperature detection piece is used for detecting the temperature of a target position on a pot placed above the inner fire cover, a through hole is formed in the inner fire cover, and the through hole penetrates through the bottom face and the top face of the inner fire cover; an air guide duct is arranged in the air guide assembly, an air outlet of the airguide duct is located near the target position, and the air guide duct is in butt joint with the through hole, so that airflow in the through hole can only flow to the air outlet end along the air guide duct, so that the air circulation of the target position is improved, heat generated by combustion flames is taken away, and the detection misjudgment probability of the temperature detection piece is reduced. In the whole process, guiding is conducted based on physical structures such as the air guide assembly, the purpose of reducing the misjudgment probability is achieved, the situation that the physical structures lose the guiding function or the guiding function is reduced due to the fact that the temperature in the using environment is high is avoided, and therefore the service lifecan be guaranteed.

The invention relates to the fields of gene engineering and molecule biology, and provides a KRAS gene detection kit and a detection method. The kit has the advantages that a specific amplification primer sequence is designed according to the specific sites of No.2 exon and No.3 exon regions of KRAS, so that the false positive rate of the to-be-detected sites is low in detection, the sensitivity is high, and the gene mutation with mutation ratio of 5% or above can be detected; library molecules are respectively obtained from an F terminal and a R terminal at both ends of a KRAS nucleic acid segment of the to-be-detected site, and the F terminal and the R terminal respectively contain amplification primer binding sites; when the KRAS nucleic acid segment containing the multiple to-be-detected sites is sequenced, the amplification primers for amplifying the library molecules are unified, the consistency in amplification efficiency is guaranteed, and the difficulty in design of the primeris decreased; the R terminal is of a hairclip structure, and can be used for sealing the tail end of the corresponding amplification product, so that the F terminal is effectively prevented from being connected with the R terminal, and the connecting efficiency is improved.

The invention discloses a high-precision leaked liquid detection and recovery early warning device, which comprises a leaked liquid confluence port, a leaked liquid confluence channel, a leaked liquidcollection tank and a detection sensor. The leaked liquid confluence port is communicated with the leaked liquid confluence channel, the tail end of the leaked liquid confluence channel is provided with the leaked liquid collection tank, and the detection sensor is fixed above the leaked liquid collection tank. The high-precision leaked liquid detection and recovery early warning device can accurately judge and detect whether liquid permeates into the liquid cooling modules in the case and the cabinet or not, the misjudgment rate of traditional liquid leakage detection is reduced, and liquidleakage reminding is carried out in time.

The invention relates to a torsion spring assembly detection mechanism suitable for a vehicle door locking safety device. The torsion spring assembly detection mechanism comprises a base, a clamping tool, a torsion test function part and a force measurement assembly. The clamping tool is used for clamping the vehicle door locking safety device arranged in the clamping tool. The torsion test function part comprises a driving arm and a power unit, wherein the driving arm moves in the front-back direction, deflects in the circumferential direction under the driving force of the power unit and isused for driving the swing plate to rotate by a preset angle. The force measurement assembly comprises a mounting plate, a front force transfer rod and a front pressure sensor. The mounting plate is fixed on the base, and a front insertion hole extends downwards from the upper plane of the mounting plate. The front force transfer rod and the front pressure sensor are sequentially inserted into thefront insertion hole and abut against each other. When the swing plate rotates to the preset angle, the swing arm abuts against the front force transfer rod under the combined action of the torsionalmoment of the first torsional spring and the torsional moment of the second torsional spring. The front pressure sensor is used for sensing the jacking force borne by the front force transfer rod.

The invention discloses a method for reducing the false positive rate of breast ultrasonic focus detection. The method comprises the following steps: tracking a suspected focus in a video by using a KCF tracking algorithm; extracting sub-videos according to a tracking result and preprocessing the sub-videos; inputting the preprocessed sub-videos into a CSN network for prediction; if the probability of the genuine yang category output by the CSN is greater than a preset threshold value, judging that the suspected focus is genuine yang, and if the probability of the genuine yang category output by the CSN is less than or equal to the preset threshold value, judging that the suspected focus is false yang. According to the method for reducing the false positive rate of breast ultrasonic focus detection provided by the embodiment of the invention, the inter-frame information is utilized to screen the results of the single-frame detection algorithm, so that the false positive rate is greatly reduced.