137 results about "Advanced persistent threat" patented technology

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

Disclosed are an advanced persistent threat (APT) detection method and system based on a continuous-time dynamic heterogeneous graph network (CDHGN). The method includes: selecting network interaction event data, extracting entities from the network interaction event data as source nodes and target nodes, extracting an interaction event occurring between a source node and a target node as an edge, and determining a type and an attribute of a node, a type and an attribute of the edge, and a moment at which an interaction event occurs, to obtain a continuous-time dynamic heterogeneous graph; converting each type of edge in the continuous-time dynamic heterogeneous graph into a vector by a CDHGN encoder, to obtain an embedding representation by a CDHGN decoder to obtain a detection result of whether each type of edge is an abnormal edge, to intercept an APT attack.

The invention belongs to the field of safety research of advanced persistent threat detection, and particularly relates to an APT detection method based on semantic enhancement and an attention mechanism. The method comprises the following steps: collecting and analyzing a system log, and constructing a traceability graph according to the analyzed system log; obtaining a summary sentence of each node according to attributes of the nodes of the traceability graph and types of edges, inputting the summary sentences into a BERT model, and extracting attribute semantic feature vector representation of the nodes in the traceability graph; generating a sub-graph of each node according to the nodes in the traceability graph, extracting a feature matrix of each sub-graph by using the self-attention graph convolutional network, and taking the feature matrix as a node feature vector representation of each sub-graph; and inputting the node feature vector representation of the to-be-detected node into the lightweight classifier, and carrying out anomaly detection. According to the method, the semantic information of the log is deeply mined and understood, the coding structure and causal information of the traceability graph are deeply mined, and the accuracy and efficiency of APT attack detection are improved.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

A system for identifying and preventing Advanced Persistent Threats (APTs) using big data analytics, including: a data collection module [100] configured to collect real-time data from network devices, endpoints, security applications and external threat data feeds; a data preprocessing module [101] configured to normalize and filter the collected data; a big data analytics engine [102] that uses both supervised and unsupervised machine learning models and is configured to detect anomalous behaviors and known attack patterns from the preprocessed data; a classification module [103] configured to categorize detected threats based on identified behaviors and characteristics of APTs; a real-time threat response module [104] configured to automatically initiate countermeasures based on the classified threat, the countermeasures including isolating compromised systems, blocking malicious traffic and adjusting network security configurations; a continuous learning module [105] configured to update the machine learning models using feedback from past threats and external threat data to ensure adaptability to evolving APT strategies; and a management dashboard [106] configured to provide security administrators with real-time alerts, visualizations and control over system configurations and responses.

The invention discloses a network intrusion intelligent detection system based on a 5G network, and relates to the technical field of network security. Comprising a traffic anomaly detection and analysis module, a data encryption tampering detection module, an anomaly analysis and evaluation module, an attack prediction and prevention module, a dynamic isolation and protection module, a reverse tracking and tracing module and a redirection and isolation protection module. According to the system, more efficient and more accurate intrusion detection and threat defense can be realized in a 5G network environment by integrating a plurality of advanced technologies and intelligent modules. Compared with a traditional rule-based detection method, the system can adaptively learn and identify a new attack mode, and the detection capability for zero-day attacks, variant attacks and advanced persistent threats (APT) is enhanced. Besides, by combining deep learning and reinforcement learning algorithms, the system can predict potential attacks in a dynamically changing network environment and automatically optimize a defense strategy, and the response speed and accuracy of the defense system are improved.

The invention provides a time sequence security atlas-oriented network threat detection method, and relates to the technical field of attack traceability, and the scheme comprises the following steps: obtaining and cleaning security event data to obtain entity data, constructing a security map, and introducing an entity and relationship enhancement history to construct a time sequence security map; performing fine tuning on the trained large language model to obtain a forward prediction model, adjusting the position sequence of entities and relationships, and optimizing the forward prediction model in combination with a position perception prompt strategy to obtain a reverse reasoning model; associating a current event with a historical event to establish a historical chain for the time sequence security map, and introducing a mode matching mechanism based on the reverse reasoning model to perform reverse reasoning on the time sequence security map to obtain traceability attack information, and predicting the entity data based on the forward prediction model to obtain potential attack information, and then outputting a threat detection report in combination with the traceability attack information. According to the method, reverse reasoning is optimized, so that the inference capability on historical events is enhanced, and the detection requirements of advanced persistent threats and variant attacks are met.

The invention discloses a vulnerability and threat scanning method and system based on artificial intelligence, and particularly relates to the technical field of artificial intelligence. The method comprises the following steps of: extracting known threat and potential zero-day attack data from a real environment to train an AI model, performing threat detection test on the AI model in diversified scenes by combining with generated simulation attack samples of high-complexity low-anomaly and low-complexity high-anomaly, analyzing the response capability of the AI model to high-complexity attacks, and determining the risk of high-complexity attacks by recording and counting false alarm and missing alarm conditions. Comprehensively evaluating the accuracy of identifying unknown novel threat features by the model; when it is detected that recognition of the model on unknown novel threat features is not accurate, by predicting the abnormal degree in a fixed time period, generating an early warning signal and optimizing the model, the detection capacity of the AI model on complex camouflage attacks can be remarkably improved, a blind area of the model in an actual environment can be found and repaired in time, and the recognition accuracy of the model on the unknown novel threat features is improved. And breakthrough of zero-day vulnerabilities and advanced persistent threats to the system is effectively prevented.

Techniques for beacon and threat intelligence based Advanced Persistent Threat (APT) detection are disclosed. In some embodiments, a system / process / computer program product for beacon and threat intelligence based APT detection includes collecting firewall log data from monitored network traffic; analyzing the firewall log data at a cloud security service to identify beacon traffic based on a plurality of heuristics; performing a risk evaluation of the beacon traffic to detect malicious beacon traffic; and performing an action in response to detecting the malicious beacon traffic.

The invention discloses an APT (Advanced Persistent Threat) attack threat judgment method based on traceability graph matching and a storage medium, and the method finds out how an attacker permeates a system step by step through deep analysis of data such as system logs and network traffic, and comprehensively judges the threat degree of a current event in combination with threat scores of past attack events. Therefore, deep analysis and accurate detection of APT threat attack behaviors are realized.

The invention relates to the technical field of big data security analysis and network information security, in particular to a communication data intelligent security supervision system based on big data, which comprises a data acquisition module used for extracting standardized entity behavior feature vectors from multi-source heterogeneous communication data; the baseline modeling module is used for dynamically generating a multi-dimensional behavior baseline portrait based on the historical sequence of the entity behavior feature vectors; the anomaly detection module is used for comparing the real-time entity behavior feature vector with the multi-dimensional behavior baseline portrait so as to calculate a micro anomaly score; the atlas construction module is used for screening the micro-anomaly events according to whether the micro-anomaly score exceeds a preset threshold value or not, and quantifying association confidence among the screened events so as to construct an attack chain atlas; the risk quantification module is used for aggregating the characteristics of the attack chain atlas to determine a systematic risk score; according to the method, the discovery capability and response efficiency of complex attacks such as advanced persistent threats and the like are greatly improved.

The invention provides an APT (Advanced Persistent Threat) attack active defense method based on a four-honey system. The APT attack active defense method comprises the following steps: collecting events fed back by a defense component in the four-honey system and external threat intelligence to obtain safety observation data, and generating an alignment sub-graph representing a relationship between anchored tactical behaviors; performing explicit relation reasoning and implicit relation reasoning by combining the aligned sub-graph and the APT knowledge graph to realize attack intention prediction so as to generate a candidate attack intention set and confidence distribution thereof; generating an optimal deployment strategy under the constraint of a system resource state, and packaging the optimal deployment strategy into an executable work order; calling resources for deployment and generating a deployment state receipt to complete construction of a new trapping environment; and collecting attacker behavior data, evaluating strategy validity according to the attacker behavior data and the deployment strategy, and updating the strategy deployment priority. The method can be applied to real-time strategy adaptation and automatic resource scheduling of attack behavior evolution, and the flexibility and continuous interference capability in a complex attack and defense environment are remarkably improved.

The invention discloses an APT (Advanced Persistent Threat) attack detection method, device and equipment. The method comprises the following steps: constructing and updating a space-time diagram based on multi-source security data; calculating only aiming at the change sub-graph influenced by the change node to obtain a node threat score so as to determine a high-risk node; extracting an operation behavior of the high-risk node, determining a tactical stage to which the operation behavior belongs by using a preset attack tactical system, and forming a security event comprising a timestamp, a behavior description vector and a tactical stage label; determining the causal degree by analyzing the time interval, tactical intention consistency and tactical stage coherence between any two security events; mapping the security events and the causality degree into nodes and edges of an event directed graph; and determining an attack path from candidate attack paths with relatively high accumulated edge weights in the event directed graph. According to the method and the device, real-time and accurate detection and automatic attack chain reconstruction of the APT attack are realized.

The invention discloses an API (Application Program Interface) monitoring security audit model based on a government affair system, which relates to the technical field of network security, and comprises the following steps: collecting and converging network traffic of each collection point; analyzing the distribution condition of APIs in the collected flow, identifying and displaying key information, meanwhile, realizing data real-time processing, data stream splitting, data reading and writing and offline data analysis, and detecting risk behaviors by utilizing a rule strategy library; aPI asset weaknesses are identified and marked, state management is supported, and an attacker portrait, security study and judgment and attack traceability model is constructed; and pushing and displaying risk model early warning, realizing multi-dimensional data source real-time association analysis based on a big data framework, automatically converging alarms to form an event file, and linking with automatic arrangement to complete event response and report generation. According to the method, the problem of insufficient security and stability of the government affair system is solved, and complex attacks and advanced persistent threats can be identified more accurately.

Techniques for intrusion prevention based on infection chains are disclosed. In some embodiments, a system, a process, and / or a computer program product for intrusion prevention based on infection chains includes monitoring network traffic at a security platform; prefiltering the monitored network traffic at the security platform to select a subset of the network traffic to perform further analysis using a plurality of signatures based on infection chains; and determining whether a plurality of sessions in the network traffic is associated with advanced persistent threat (APT) attack traffic activity based on a match with at least one of the plurality of signatures based on the infection chains.

The invention discloses a non-file attack detection method, system and device based on multi-view behavior modeling and frequency domain enhancement contrast learning and a medium, and belongs to the technical field of network security, and the method comprises the steps: collecting and coding multi-source behavior data of a target system during operation, and carrying out the unified coding; performing time sequence division on the multi-source behavior data, and constructing a corresponding behavior graph; inputting the divided time sequence into a self-attention mechanism neural network, extracting time domain representation of behaviors, inputting the constructed behavior graph into a graph structure neural network, and extracting structure representation; respectively performing fast Fourier transform on the time domain representation and the structure representation to generate frequency domain representation; constructing a joint contrast learning loss function, and training a consistency detection model; and judging whether the behavior is a file-free attack behavior based on the consistency deviation in combination with an anomaly detection judgment mechanism. According to the method, the non-file-attack characteristic behaviors are accurately identified, and the capability of detecting the non-file-attack in the advanced persistent threats is effectively improved.

The invention belongs to the technical field of network security defense, and particularly discloses a multi-stage network security threat defense method and system based on adaptive feedback. A defense strategy is dynamically generated and optimized by performing multi-dimensional analysis on feature differences of historical security events and events to be processed and combining an adaptive feedback mechanism and an attack detection model for iterative training; when deviation or novel threats are detected, rollback and incremental training can be automatically triggered, and multi-round iterative closed-loop defense is formed. The method effectively deals with advanced persistent threats, zero-day vulnerabilities and multi-stage attacks, significantly improves threat detection accuracy and strategy response efficiency, reduces redundant feature interference, enhances expandability and adaptivity of the system, can be widely applied to environments such as the Internet of Things, cloud computing and enterprise intranets, and has wide application prospects. And the intelligence and flexibility of network protection are obviously improved.

The invention discloses an attack detection method and device for a power monitoring system, electronic equipment, a medium and a product, and relates to the technical field of information security, and the method comprises the steps: obtaining network flow data of the power monitoring system through a distributed network flow collection unit, and converting the network flow data into a feature matrix to obtain a basic feature matrix; inputting the basic feature matrix into a preset attack detection model to obtain an attack detection result; and if the attack detection result represents that the power monitoring system suffers from the advanced persistent threat, generating warning information based on the attack detection result and outputting the warning information. According to the application, the detection accuracy of the APT attack detection method can be improved, the security of the power monitoring system is improved, and reliable guarantee is provided for stable operation of the power monitoring system.

The invention discloses an attack behavior analysis engine construction method and system based on deep learning, and belongs to the technical field of power system network security. The method comprises the following steps of: firstly, performing deep syntax tree analysis on an electric power industrial control protocol by constructing a multilayer feature extraction module for business semantic decoupling, and realizing semantic mapping from a network message to a business operation intention and generating a three-dimensional feature tensor in combination with a pre-constructed electric power business knowledge graph; secondly, designing a dynamic adversarial training mechanism, synthesizing a high-simulation adversarial sample by adopting a Wasserstein generative adversarial network obeying power business logic constraints, and continuously optimizing the robustness of the detection model; and finally, establishing a topology-aware graph neural network attack detection model, converting an equipment connection relationship of physical scenes such as a transformer substation into a graph structure, and analyzing a cross-node attack propagation chain by using a graph convolutional network. According to the method, the detection precision and the response speed of complex attacks such as advanced persistent threats are remarkably improved.

The embodiment of the invention provides a security protection method and device based on a multi-level multi-player security master-slave game, and the method comprises the steps: constructing a multi-level multi-player security master-slave game decision model corresponding to a security protection system according to a large complex attack and defense scene facing the security protection system; analyzing Stackelberg equilibrium and Nash equilibrium of the model so as to solve a Stackelberg equilibrium strategy and a Nash equilibrium strategy; determining the consistency condition of the Stackelberg equilibrium strategy and the Nash equilibrium strategy of the model according to the disturbance of the model in practical application and the threat of uncertainty factors to the Stackelberg equilibrium reliability of the model; and setting the model according to the consistency condition, and applying the set model to an advanced continuous threat attack and defense scene which is actually faced by a security protection system for security protection. In this way, the security protection effect can be improved based on the multi-level multi-player security master-slave game decision model.

The embodiment of the invention discloses a security protection efficiency evaluation method and system based on intelligent calculation data security analysis and electronic equipment, relates to the technical field of network security, and aims to verify whether a basic function of network security equipment is normally enabled or not, perform a new and old attack action hybrid test on the network security equipment and improve the security protection efficiency of the network security equipment. Acquiring the detection capability of the network security equipment on the network attack; and verifying the detection capability of the network attack, simulating the security evaluation of the SIEM / SOC system based on an advanced persistent threat scene, measuring event response and recovery time indexes, and generating a security protection efficiency evaluation result. According to the embodiment of the invention, the overall efficiency of the network security system in the case of complex attacks can be evaluated, a comprehensive security protection efficiency evaluation result is generated, and a scientific basis is provided for optimizing a network security strategy, so that the overall efficiency of the network security system and the capability of coping with the complex attacks are improved.

The invention discloses an advanced persistent threat detection and response method based on improved self-supervised learning. The method comprises the following steps: S1, acquiring an unlabeled data set in a network environment; s2, embedding a behavior path learning and prediction module in the self-supervised learning model; s3, forming a reference basis for an APT threat behavior path; s4, marking the nodes as potential threat nodes; s5, if potential threat nodes are detected, a behavior path learning and prediction module predicts potential threat nodes possibly occurring in the next attack stage according to the space-time relevance in the behavior path and the preliminary labeling information, and generates corresponding threat levels according to the features of the predicted nodes and the behavior path; and S6, triggering a response decision module according to the threat level, and triggering corresponding response measures by the response decision module according to the level of the threat node and the prediction path, including sending out an alarm, isolating a threat source, limiting access authority and recording an event log. According to the method, the detection efficiency and the response capability of the APT attack are remarkably improved.

The embodiment of the invention discloses an APT (Advanced Persistent Threat) network attack identification method, which comprises the following steps: collecting multi-source data from a plurality of data sources, and filtering current attack behavior data from the multi-source data; performing multi-dimensional similarity calculation on the current attack behavior data and the APT organization intelligence in the multi-modal threat knowledge graph to obtain a comprehensive similarity, the multi-modal threat knowledge graph being obtained by modeling after the multi-dimensional attack data and the threat intelligence are fused; nodes in the multi-modal threat knowledge graph are used for representing APT organizations, TTP, used tools and attack targets, and edges connected with the nodes are used for representing relationships among entities represented by the nodes; and based on the comprehensive similarity and the multi-modal threat knowledge graph, performing attribution reasoning on the APT organization of the current attack behavior data to obtain the identity information of the attacker. According to the method, unknown threats can be identified, the identity information of an attacker can be obtained through accurate reasoning, and the utilization rate of intelligence is improved.

The invention discloses a communication data analysis system and method for network security, and relates to the technical field of computer internet. Time sequence features, protocol semantic features and interactive topology features of communication session historical data are extracted based on network flow data; the method comprises the following steps of: acquiring a time sequence feature, a protocol semantic feature and an interactive topology feature, fusing the time sequence feature, the protocol semantic feature and the interactive topology feature into a unified high-dimensional feature vector, acquiring a communication behavior record and a communication behavior dynamic feature vector of network equipment in a communication network, calculating a digital feature of a coupling relationship evaluation value, and when a certain communication session occurs, judging whether the communication session occurs or not. The method comprises the following steps of: calculating real-time coupling relationship evaluation values among network equipment, quantifying the difference degree of the real-time coupling relationship evaluation values through digital characteristics, accumulating the coupling relationship evaluation values in the process of performing a certain communication session, calculating the total anomaly degree of the communication session, and calculating the abnormal degree of the communication session. The method aims at solving the problems that advanced persistent threats are difficult to effectively recognize, feature expression is insufficient and the perceptual ability is weak in the prior art.

The invention discloses a firewall dynamic policy adaptation method and system based on big data, and the method comprises the steps: collecting multi-source heterogeneous data in a network, and constructing a dynamic network entity map in real time; processing the time sequence of the atlas by using a preset time sequence diagram attention network model to obtain a behavior fingerprint vector representing the behavior state of the entity, and calculating the risk score of the entity; when the risk score exceeds a risk threshold value, automatically generating a temporary security policy for managing and controlling the access behavior of the entity; and managing the life cycle of the temporary security policy, and automatically updating, renewing or cancelling according to the entity risk state change. According to the method, the network entity behavior baseline is constructed and the risk prediction is carried out, so that the conversion from passive defense to active defense is realized, the security policy can be automatically and accurately generated and managed, advanced persistent threats and zero-day attacks can be effectively coped with, and the self-adaptability and the intelligent level of network defense are improved.

A real-time, information-security, border-endpoint system and process to block a zero-day threat is disclosed. Data, traffic, patterns, and payloads for incoming and outgoing border control devices (or edge devices) delineating protected from unprotected areas of a network, or close to the border of such, can be monitored, analyzed, compared, and processed by artificial intelligence (AI), which can be used to identify suspect traffic based on differences between the two and historical information compiled from prior Advanced Persistent Threats. Mitigation, countermeasures, reporting, quarantining, blocking, patching, and other features are disclosed as well.

The invention is suitable for the technical field of network security, and provides a multivariate attack feature recognition method and system based on persistent threat attacks, and the method comprises the steps: obtaining a real-time traffic data sequence in a target network environment; performing primary anomaly sensing processing on the real-time traffic data sequence to obtain a suspicious traffic fragment set; executing thinking chain reasoning analysis on the suspicious traffic fragment set, and generating an attack behavior reasoning path comprising multi-stage reasoning steps; performing matching verification on the attack behavior reasoning path and a pre-constructed threat intelligence knowledge base, and determining an attack stage and an attack intention of the persistent threat attack; and generating a multivariate attack feature recognition result according to a matching verification result. According to the method, analysis of advanced persistent threat attack multi-stage features is realized through a thinking chain reasoning mode, and the timeliness and reliability of detection are improved, so that the active protection capability of network security is improved.

The invention discloses an active attack trapping method and system for advanced persistent threats, and belongs to the technical field of safety monitoring. The method comprises the following steps: generating a trapping target to enable an inducer to initiate an attack on a protected object, a trapping server or / and a trapping intranet area based on an advanced persistent threat; wherein real service software and high-simulation data are deployed on the trapping server, and the trapping intranet area is a simulation network containing services, applications and data of a conventional intranet; identifying a malicious code file corresponding to the advanced persistent threat based on the flow generated in the attack process; activity records generated when an attacker attacks a protected object, a trapping server or an intranet system are obtained, and the attack state of advanced continuous threats is perceived in combination with attack conditions. According to the method, an attack surface and high-value assets can be actively exposed to an attacker, and the attacker is induced to explore and attack, so that attack means can be obtained, malicious codes can be captured, the attention of the attacker can be attracted, and a real information system can be protected.

The invention belongs to the technical field of data flow, and discloses a data flow monitoring model device based on a government affair system. By solving the problem that government affair public data generally lacks security monitoring blind spots of overall government affair public data flow monitoring, the depth and breadth of security monitoring are effectively improved, so that the problem that a traditional security protection means is difficult to deal with advanced persistent threats, large-scale sensitive data leakage and novel threats of complex network attacks is solved. Through safety supervision and safety panoramic analysis of government affair public data flow monitoring, a result after safety data analysis is analyzed according to research and judgment analysis, authorization analysis and flow supervision process analysis of flow data safety monitoring and supervision design, and cross-platform, cross-department and cross-level unified data safety situation presentation and centralized management are realized.

The invention relates to the technical field of data security and access control, in particular to an implementation method and system of a dual access control mechanism based on a block chain and an encryption machine, and the implementation method comprises the steps of authority management based on a smart contract, encryption machine dynamic key generation, dual access control, and exception handling and auditing. The method has the beneficial effects that the non-tampering property of authority distribution and operation records is ensured through a distributed account book technology of the block chain, and a double-layer security barrier of logic credibility and physical isolation is formed in combination with hardware-level key protection (such as a security chip HSM) of an encryption machine. And the anti-attack capability is improved, the block chain resists data tampering and insider disintegration, the encryption machine prevents key side channel attacks, and the double mechanisms can cope with complex attack modes such as man-in-the-middle attacks, replay attacks and advanced persistent threats (APT).