125 results about "Advanced persistent threat" patented technology

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

The invention discloses a network intrusion intelligent detection system based on a 5G network, and relates to the technical field of network security. Comprising a traffic anomaly detection and analysis module, a data encryption tampering detection module, an anomaly analysis and evaluation module, an attack prediction and prevention module, a dynamic isolation and protection module, a reverse tracking and tracing module and a redirection and isolation protection module. According to the system, more efficient and more accurate intrusion detection and threat defense can be realized in a 5G network environment by integrating a plurality of advanced technologies and intelligent modules. Compared with a traditional rule-based detection method, the system can adaptively learn and identify a new attack mode, and the detection capability for zero-day attacks, variant attacks and advanced persistent threats (APT) is enhanced. Besides, by combining deep learning and reinforcement learning algorithms, the system can predict potential attacks in a dynamically changing network environment and automatically optimize a defense strategy, and the response speed and accuracy of the defense system are improved.

The invention provides a time sequence security atlas-oriented network threat detection method, and relates to the technical field of attack traceability, and the scheme comprises the following steps: obtaining and cleaning security event data to obtain entity data, constructing a security map, and introducing an entity and relationship enhancement history to construct a time sequence security map; performing fine tuning on the trained large language model to obtain a forward prediction model, adjusting the position sequence of entities and relationships, and optimizing the forward prediction model in combination with a position perception prompt strategy to obtain a reverse reasoning model; associating a current event with a historical event to establish a historical chain for the time sequence security map, and introducing a mode matching mechanism based on the reverse reasoning model to perform reverse reasoning on the time sequence security map to obtain traceability attack information, and predicting the entity data based on the forward prediction model to obtain potential attack information, and then outputting a threat detection report in combination with the traceability attack information. According to the method, reverse reasoning is optimized, so that the inference capability on historical events is enhanced, and the detection requirements of advanced persistent threats and variant attacks are met.

Techniques for beacon and threat intelligence based Advanced Persistent Threat (APT) detection are disclosed. In some embodiments, a system / process / computer program product for beacon and threat intelligence based APT detection includes collecting firewall log data from monitored network traffic; analyzing the firewall log data at a cloud security service to identify beacon traffic based on a plurality of heuristics; performing a risk evaluation of the beacon traffic to detect malicious beacon traffic; and performing an action in response to detecting the malicious beacon traffic.

The invention discloses an APT (Advanced Persistent Threat) attack threat judgment method based on traceability graph matching and a storage medium, and the method finds out how an attacker permeates a system step by step through deep analysis of data such as system logs and network traffic, and comprehensively judges the threat degree of a current event in combination with threat scores of past attack events. Therefore, deep analysis and accurate detection of APT threat attack behaviors are realized.

The invention relates to the technical field of big data security analysis and network information security, in particular to a communication data intelligent security supervision system based on big data, which comprises a data acquisition module used for extracting standardized entity behavior feature vectors from multi-source heterogeneous communication data; the baseline modeling module is used for dynamically generating a multi-dimensional behavior baseline portrait based on the historical sequence of the entity behavior feature vectors; the anomaly detection module is used for comparing the real-time entity behavior feature vector with the multi-dimensional behavior baseline portrait so as to calculate a micro anomaly score; the atlas construction module is used for screening the micro-anomaly events according to whether the micro-anomaly score exceeds a preset threshold value or not, and quantifying association confidence among the screened events so as to construct an attack chain atlas; the risk quantification module is used for aggregating the characteristics of the attack chain atlas to determine a systematic risk score; according to the method, the discovery capability and response efficiency of complex attacks such as advanced persistent threats and the like are greatly improved.

The invention provides an APT (Advanced Persistent Threat) attack active defense method based on a four-honey system. The APT attack active defense method comprises the following steps: collecting events fed back by a defense component in the four-honey system and external threat intelligence to obtain safety observation data, and generating an alignment sub-graph representing a relationship between anchored tactical behaviors; performing explicit relation reasoning and implicit relation reasoning by combining the aligned sub-graph and the APT knowledge graph to realize attack intention prediction so as to generate a candidate attack intention set and confidence distribution thereof; generating an optimal deployment strategy under the constraint of a system resource state, and packaging the optimal deployment strategy into an executable work order; calling resources for deployment and generating a deployment state receipt to complete construction of a new trapping environment; and collecting attacker behavior data, evaluating strategy validity according to the attacker behavior data and the deployment strategy, and updating the strategy deployment priority. The method can be applied to real-time strategy adaptation and automatic resource scheduling of attack behavior evolution, and the flexibility and continuous interference capability in a complex attack and defense environment are remarkably improved.

The invention discloses an APT (Advanced Persistent Threat) attack detection method, device and equipment. The method comprises the following steps: constructing and updating a space-time diagram based on multi-source security data; calculating only aiming at the change sub-graph influenced by the change node to obtain a node threat score so as to determine a high-risk node; extracting an operation behavior of the high-risk node, determining a tactical stage to which the operation behavior belongs by using a preset attack tactical system, and forming a security event comprising a timestamp, a behavior description vector and a tactical stage label; determining the causal degree by analyzing the time interval, tactical intention consistency and tactical stage coherence between any two security events; mapping the security events and the causality degree into nodes and edges of an event directed graph; and determining an attack path from candidate attack paths with relatively high accumulated edge weights in the event directed graph. According to the method and the device, real-time and accurate detection and automatic attack chain reconstruction of the APT attack are realized.

The invention discloses an API (Application Program Interface) monitoring security audit model based on a government affair system, which relates to the technical field of network security, and comprises the following steps: collecting and converging network traffic of each collection point; analyzing the distribution condition of APIs in the collected flow, identifying and displaying key information, meanwhile, realizing data real-time processing, data stream splitting, data reading and writing and offline data analysis, and detecting risk behaviors by utilizing a rule strategy library; aPI asset weaknesses are identified and marked, state management is supported, and an attacker portrait, security study and judgment and attack traceability model is constructed; and pushing and displaying risk model early warning, realizing multi-dimensional data source real-time association analysis based on a big data framework, automatically converging alarms to form an event file, and linking with automatic arrangement to complete event response and report generation. According to the method, the problem of insufficient security and stability of the government affair system is solved, and complex attacks and advanced persistent threats can be identified more accurately.

The invention discloses a non-file attack detection method, system and device based on multi-view behavior modeling and frequency domain enhancement contrast learning and a medium, and belongs to the technical field of network security, and the method comprises the steps: collecting and coding multi-source behavior data of a target system during operation, and carrying out the unified coding; performing time sequence division on the multi-source behavior data, and constructing a corresponding behavior graph; inputting the divided time sequence into a self-attention mechanism neural network, extracting time domain representation of behaviors, inputting the constructed behavior graph into a graph structure neural network, and extracting structure representation; respectively performing fast Fourier transform on the time domain representation and the structure representation to generate frequency domain representation; constructing a joint contrast learning loss function, and training a consistency detection model; and judging whether the behavior is a file-free attack behavior based on the consistency deviation in combination with an anomaly detection judgment mechanism. According to the method, the non-file-attack characteristic behaviors are accurately identified, and the capability of detecting the non-file-attack in the advanced persistent threats is effectively improved.

The invention belongs to the technical field of network security defense, and particularly discloses a multi-stage network security threat defense method and system based on adaptive feedback. A defense strategy is dynamically generated and optimized by performing multi-dimensional analysis on feature differences of historical security events and events to be processed and combining an adaptive feedback mechanism and an attack detection model for iterative training; when deviation or novel threats are detected, rollback and incremental training can be automatically triggered, and multi-round iterative closed-loop defense is formed. The method effectively deals with advanced persistent threats, zero-day vulnerabilities and multi-stage attacks, significantly improves threat detection accuracy and strategy response efficiency, reduces redundant feature interference, enhances expandability and adaptivity of the system, can be widely applied to environments such as the Internet of Things, cloud computing and enterprise intranets, and has wide application prospects. And the intelligence and flexibility of network protection are obviously improved.

The invention discloses an attack detection method and device for a power monitoring system, electronic equipment, a medium and a product, and relates to the technical field of information security, and the method comprises the steps: obtaining network flow data of the power monitoring system through a distributed network flow collection unit, and converting the network flow data into a feature matrix to obtain a basic feature matrix; inputting the basic feature matrix into a preset attack detection model to obtain an attack detection result; and if the attack detection result represents that the power monitoring system suffers from the advanced persistent threat, generating warning information based on the attack detection result and outputting the warning information. According to the application, the detection accuracy of the APT attack detection method can be improved, the security of the power monitoring system is improved, and reliable guarantee is provided for stable operation of the power monitoring system.

The invention discloses an attack behavior analysis engine construction method and system based on deep learning, and belongs to the technical field of power system network security. The method comprises the following steps of: firstly, performing deep syntax tree analysis on an electric power industrial control protocol by constructing a multilayer feature extraction module for business semantic decoupling, and realizing semantic mapping from a network message to a business operation intention and generating a three-dimensional feature tensor in combination with a pre-constructed electric power business knowledge graph; secondly, designing a dynamic adversarial training mechanism, synthesizing a high-simulation adversarial sample by adopting a Wasserstein generative adversarial network obeying power business logic constraints, and continuously optimizing the robustness of the detection model; and finally, establishing a topology-aware graph neural network attack detection model, converting an equipment connection relationship of physical scenes such as a transformer substation into a graph structure, and analyzing a cross-node attack propagation chain by using a graph convolutional network. According to the method, the detection precision and the response speed of complex attacks such as advanced persistent threats are remarkably improved.

The embodiment of the invention provides a security protection method and device based on a multi-level multi-player security master-slave game, and the method comprises the steps: constructing a multi-level multi-player security master-slave game decision model corresponding to a security protection system according to a large complex attack and defense scene facing the security protection system; analyzing Stackelberg equilibrium and Nash equilibrium of the model so as to solve a Stackelberg equilibrium strategy and a Nash equilibrium strategy; determining the consistency condition of the Stackelberg equilibrium strategy and the Nash equilibrium strategy of the model according to the disturbance of the model in practical application and the threat of uncertainty factors to the Stackelberg equilibrium reliability of the model; and setting the model according to the consistency condition, and applying the set model to an advanced continuous threat attack and defense scene which is actually faced by a security protection system for security protection. In this way, the security protection effect can be improved based on the multi-level multi-player security master-slave game decision model.

The embodiment of the invention discloses a security protection efficiency evaluation method and system based on intelligent calculation data security analysis and electronic equipment, relates to the technical field of network security, and aims to verify whether a basic function of network security equipment is normally enabled or not, perform a new and old attack action hybrid test on the network security equipment and improve the security protection efficiency of the network security equipment. Acquiring the detection capability of the network security equipment on the network attack; and verifying the detection capability of the network attack, simulating the security evaluation of the SIEM / SOC system based on an advanced persistent threat scene, measuring event response and recovery time indexes, and generating a security protection efficiency evaluation result. According to the embodiment of the invention, the overall efficiency of the network security system in the case of complex attacks can be evaluated, a comprehensive security protection efficiency evaluation result is generated, and a scientific basis is provided for optimizing a network security strategy, so that the overall efficiency of the network security system and the capability of coping with the complex attacks are improved.

The embodiment of the invention discloses an APT (Advanced Persistent Threat) network attack identification method, which comprises the following steps: collecting multi-source data from a plurality of data sources, and filtering current attack behavior data from the multi-source data; performing multi-dimensional similarity calculation on the current attack behavior data and the APT organization intelligence in the multi-modal threat knowledge graph to obtain a comprehensive similarity, the multi-modal threat knowledge graph being obtained by modeling after the multi-dimensional attack data and the threat intelligence are fused; nodes in the multi-modal threat knowledge graph are used for representing APT organizations, TTP, used tools and attack targets, and edges connected with the nodes are used for representing relationships among entities represented by the nodes; and based on the comprehensive similarity and the multi-modal threat knowledge graph, performing attribution reasoning on the APT organization of the current attack behavior data to obtain the identity information of the attacker. According to the method, unknown threats can be identified, the identity information of an attacker can be obtained through accurate reasoning, and the utilization rate of intelligence is improved.

The invention discloses a communication data analysis system and method for network security, and relates to the technical field of computer internet. Time sequence features, protocol semantic features and interactive topology features of communication session historical data are extracted based on network flow data; the method comprises the following steps of: acquiring a time sequence feature, a protocol semantic feature and an interactive topology feature, fusing the time sequence feature, the protocol semantic feature and the interactive topology feature into a unified high-dimensional feature vector, acquiring a communication behavior record and a communication behavior dynamic feature vector of network equipment in a communication network, calculating a digital feature of a coupling relationship evaluation value, and when a certain communication session occurs, judging whether the communication session occurs or not. The method comprises the following steps of: calculating real-time coupling relationship evaluation values among network equipment, quantifying the difference degree of the real-time coupling relationship evaluation values through digital characteristics, accumulating the coupling relationship evaluation values in the process of performing a certain communication session, calculating the total anomaly degree of the communication session, and calculating the abnormal degree of the communication session. The method aims at solving the problems that advanced persistent threats are difficult to effectively recognize, feature expression is insufficient and the perceptual ability is weak in the prior art.

The invention discloses a firewall dynamic policy adaptation method and system based on big data, and the method comprises the steps: collecting multi-source heterogeneous data in a network, and constructing a dynamic network entity map in real time; processing the time sequence of the atlas by using a preset time sequence diagram attention network model to obtain a behavior fingerprint vector representing the behavior state of the entity, and calculating the risk score of the entity; when the risk score exceeds a risk threshold value, automatically generating a temporary security policy for managing and controlling the access behavior of the entity; and managing the life cycle of the temporary security policy, and automatically updating, renewing or cancelling according to the entity risk state change. According to the method, the network entity behavior baseline is constructed and the risk prediction is carried out, so that the conversion from passive defense to active defense is realized, the security policy can be automatically and accurately generated and managed, advanced persistent threats and zero-day attacks can be effectively coped with, and the self-adaptability and the intelligent level of network defense are improved.

A real-time, information-security, border-endpoint system and process to block a zero-day threat is disclosed. Data, traffic, patterns, and payloads for incoming and outgoing border control devices (or edge devices) delineating protected from unprotected areas of a network, or close to the border of such, can be monitored, analyzed, compared, and processed by artificial intelligence (AI), which can be used to identify suspect traffic based on differences between the two and historical information compiled from prior Advanced Persistent Threats. Mitigation, countermeasures, reporting, quarantining, blocking, patching, and other features are disclosed as well.

The invention is suitable for the technical field of network security, and provides a multivariate attack feature recognition method and system based on persistent threat attacks, and the method comprises the steps: obtaining a real-time traffic data sequence in a target network environment; performing primary anomaly sensing processing on the real-time traffic data sequence to obtain a suspicious traffic fragment set; executing thinking chain reasoning analysis on the suspicious traffic fragment set, and generating an attack behavior reasoning path comprising multi-stage reasoning steps; performing matching verification on the attack behavior reasoning path and a pre-constructed threat intelligence knowledge base, and determining an attack stage and an attack intention of the persistent threat attack; and generating a multivariate attack feature recognition result according to a matching verification result. According to the method, analysis of advanced persistent threat attack multi-stage features is realized through a thinking chain reasoning mode, and the timeliness and reliability of detection are improved, so that the active protection capability of network security is improved.

The invention belongs to the technical field of data flow, and discloses a data flow monitoring model device based on a government affair system. By solving the problem that government affair public data generally lacks security monitoring blind spots of overall government affair public data flow monitoring, the depth and breadth of security monitoring are effectively improved, so that the problem that a traditional security protection means is difficult to deal with advanced persistent threats, large-scale sensitive data leakage and novel threats of complex network attacks is solved. Through safety supervision and safety panoramic analysis of government affair public data flow monitoring, a result after safety data analysis is analyzed according to research and judgment analysis, authorization analysis and flow supervision process analysis of flow data safety monitoring and supervision design, and cross-platform, cross-department and cross-level unified data safety situation presentation and centralized management are realized.

The invention relates to the technical field of data security and access control, in particular to an implementation method and system of a dual access control mechanism based on a block chain and an encryption machine, and the implementation method comprises the steps of authority management based on a smart contract, encryption machine dynamic key generation, dual access control, and exception handling and auditing. The method has the beneficial effects that the non-tampering property of authority distribution and operation records is ensured through a distributed account book technology of the block chain, and a double-layer security barrier of logic credibility and physical isolation is formed in combination with hardware-level key protection (such as a security chip HSM) of an encryption machine. And the anti-attack capability is improved, the block chain resists data tampering and insider disintegration, the encryption machine prevents key side channel attacks, and the double mechanisms can cope with complex attack modes such as man-in-the-middle attacks, replay attacks and advanced persistent threats (APT).

The invention discloses a semi-supervised classification method of a relation graph aggregation model for APT attack recognition, relates to the technical field of graph neural networks, and solves the problems of massive graph data, complex relation modeling, label scarcity and the like in existing advanced persistent threat attacks. And the GraphSAGE layer flexibly processes large-scale graph data through sampling and aggregation of neighbor nodes. And meanwhile, a small amount of marked data and a large amount of unmarked data can be effectively utilized by adopting a semi-supervised learning strategy, so that the pressure of data marking is relieved. Experimental results show that compared with other methods, the AARGS model has certain advantages in the aspects of classification accuracy and generalization ability. Meanwhile, the semi-supervised learning method effectively reduces the dependence on high-quality annotation data, so that the cost and workload of data annotation are reduced.

The invention discloses a behavior extraction and analysis device based on a host operation log, and the device comprises a clustering and slicing processing module which is used for processing input clustering data, extracting the single operation behavior description of each cluster, processing the clusters based on the single operation behavior description, fusing the clusters with behavior continuity, and obtaining a fusion result; clustering fragments are obtained; the intention analysis model is used for analyzing the clustering slices on the basis of single operation behavior description, and analyzing the behavior pattern of the user from the whole behavior so as to obtain the intention of the user; and the intention analysis result processing module identifies the intention analysis result output by the intention analysis model, and gives an alarm if the intention analysis result is abnormal. According to the behavior extraction and analysis device based on the host operation log, the relationship and trend between the data can be analyzed, so that possible attack modes or abnormal behaviors for host operation are revealed, and complex attacks and advanced persistent threats can be recognized more accurately.

The application provides a kind of important activity network security attack early warning method before including: according to the system features of heavy protection system, construct deception system, deception system includes Web real-time communication module and multiple simulation interaction module, design false login function, the deception system is deployed in cloud server;Attack record of deception system and attack record of heavy protection system are de-duplication processing and obtain attack record set;Analysis of the access behavior information of attacker determines the type of attacker, design targeted defense measures;Generate early warning report and send early warning report and targeted defense measures to heavy protection system.The application of the method can collect data through the deception system, dynamically generate a security warning report and assess the risk of the attacker.Based on the early warning results, the heavy protection system can be guided to take defensive measures to improve the defense capabilities.The deception capability and dynamic defense level of the heavy protection system can be effectively enhanced, and the ability to deal with advanced persistent threats is improved.

The invention relates to the technical field of computers, and discloses a network elasticity capability evaluation method and device, equipment and a medium, and the method comprises the steps: determining a network elasticity capability measurement index set matched with a submitted object; scoring each network elasticity capability measurement index in the network elasticity capability measurement index set to obtain a scoring set of the network elasticity capability measurement index set in different dimensions; summarizing the obtained score sets on different dimensions to obtain a target score corresponding to each network elasticity capability measurement index; and summarizing the target scores layer by layer according to a hierarchical structure of a preset network elasticity evaluation index system to obtain a network elasticity capability score of the submitted object, and determining a network elasticity capability evaluation result of the submitted object according to the network elasticity capability score. According to the technical scheme provided by the invention, the evaluation accuracy of the recovery capability of the network security system in the face of advanced persistent threats can be improved.

The invention discloses an application security monitoring system and method based on behavior portrait data, and relates to the technical field of network security, and the system comprises a flow collection and preprocessing module, a behavior portrait module, a security analysis module and a strategy execution module. The flow acquisition and preprocessing module is deployed in a network access layer and comprises a network probe and a data cleaning unit, the behavior portrait module is connected with a log output end of the flow acquisition terminal, the security analysis module is connected with an output end of the behavior portrait module, and the strategy execution module is connected with an alarm output end of the security analysis module. According to the method, the function of high risk detection rate is realized by establishing the multi-dimensional static behavior model, the behavior baseline is constructed and is quantitatively compared with the real-time behavior, the abnormal behavior which cannot be recognized by a traditional rule base can be found, the false alarm rate is remarkably reduced, and the detection rate of internal threats and advanced persistent threats is improved.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system based on artificial intelligence, and the method comprises the following steps: 1, data collection: collecting multi-source data such as network traffic, system logs and threat intelligence, and providing basic materials for subsequent analysis; 2, data preprocessing, cleaning, normalization and feature extraction are carried out, so that the data are more regular and effective, and subsequent artificial intelligence model processing is facilitated; the network security situation awareness system based on artificial intelligence can perform deep analysis and mining on massive network security data by utilizing machine learning and deep learning algorithms, and can automatically learn and identify unknown attack modes and abnormal behaviors compared with a traditional detection method based on rules, so that the network security situation awareness system based on artificial intelligence can be applied to the field of network security situation awareness. And the detection capability on novel threats and advanced continuous threats is greatly improved.

This invention relates to the field of network security technology and discloses a network security situation prediction method and system based on artificial intelligence, comprising the following steps: embedding controllable Trojan data into user-facing software by uploading network data; collecting hardware information data of the software and software status data of the user-facing software based on a data acquisition module; extracting feature vectors from the hardware information data and software status data; and then having a third party evaluate the security coefficient of the controllable Trojan data. This invention, by proactively embedding a controllable, fingerprint-hidden authorized Trojan in a real software environment for attack and defense drills, overturns the passive mode of traditional security detection that relies on historical attack characteristics or static rule bases. This enables proactive perception and discovery of attack clues for unknown threats and advanced persistent threats, greatly improving the system's predictability of potential risks.