87 results about "Adversary" patented technology

A hybrid approach involving the mix of communication patterns and passive fingerprinting is used to identify unknown device types, manufacturers, and models of devices of digital control systems. ANDVI implementation maps the identified devices to their known vulnerabilities. According to one example, to identify how interdependence among existing atomic vulnerabilities may be exploited by an adversary to stitch together an attack that can compromise the system, model-checking based A2G2V is employed. According to another example, an A2G2V algorithm uses existing model-checking tools, an architecture description tool, and code to generate an attack-graph that enumerates the set of all possible sequences in which atomic-level vulnerabilities can be exploited to compromise system security. In yet another example, identification of label-cuts within an attack-graph automatically identifies a set of critical-attacks that, when blocked, renders the system secure. A linear complexity approximation utilizing SCCs helps identify the minimum label-cut representing a critical-attacks set.

A system and method of using generative AI to maintain conversations with attacking devices to discover their adversary techniques and tactics. The method includes receiving an initial message originating from an attacking device and directed to a target device. The method includes generating, using one or more classification models, a maliciousness score for the initial message indicating that the initial message is associated with one or more types of malicious activity. The method includes providing, by a processing device, the initial message to a predictive model trained to maintain conversations with attacking devices by predicting responses to malicious messages. The method includes generating, using the predictive model, two or more responses based on the initial message and at least one subsequent message, wherein each response of the two or more responses causes the attacking device to send a respective subsequent message to the predictive model.

A computer-implemented method comprises establishing a database based at least in part on network traffic data received from a network, detecting adversarial behavior within the network traffic data, identifying an adversary associated with the adversarial behavior, determining a plurality of specific indicators of compromise that are associated with the adversary that has been identified, constructing a query based on the plurality of specific indicators of compromise, submitting the query to search for the plurality of specific indicators of compromise within the network traffic data, searching for the plurality of specific indicators of compromise within the network traffic data, and generating, responsive to having located at least one potential indicator of compromise, a search report containing at least one specific indicator of compromise and displaying the search report to a user interface.

A method for use in protecting a first machine learning model that is queryable over an application programming interface, API, against an adversary querying the first machine learning model through the API in order to build up a database of query-response pairs. The method includes identifying a user of the API as a potential adversary. In response to a query from the potential adversary, through the API, method includes providing a response from a second machine learning model instead of the first machine learning model, wherein the first machine learning model has been trained on a first dataset and wherein the second machine learning model has been trained on a second dataset that is different to the first dataset.

A computer-implemented system and method for dynamic, explainable, and adaptive prioritization of cybersecurity controls is disclosed. The system ingests unstructured threat reports and employs a natural language processing (NLP) module to automatically extract adversary tactics, techniques, and procedures (TTPs). A scoring module applies a mathematical time-decay function to the extracted intelligence. A novel hybrid prioritization engine provides explainability-by-design by computationally integrating these objective, data-driven scores with organization-specific context within a transparent multi-criteria decision analysis (MCDA) model. Critically, the system establishes a self-optimizing closed feedback loop; it receives real-world control effectiveness metrics from the operational environment and uses this data as new ground-truth labels to continuously and automatically retrain internal machine learning models. This adaptive mechanism improves the computer's own predictive accuracy and resource allocation efficiency over time, representing a tangible technical improvement.

Systems for improving security of a computer-implemented artificial intelligence by monitoring one or more transactions received by the machine learning decision model; receiving a first score generated by the machine learning decision model in association with a first transaction; identifying the first transaction as belonging to a first class, in response to the first score being lower than a certain score threshold and the first transaction having a low occurrence likelihood; receiving a second score in association with the first transaction based on one or more adversarial latent features associated with the first transaction as detectable by an adversary detection model; and determining at least one adversarial latent transaction feature being exploited by the first transaction, in response to determining that the second score falls above the certain score threshold.

An apparatus features processor(s) and a non-transitory storage medium including an intelligent-adversary simulator and a formatting modules. The simulator calculates path(s) of least resistance for a cyber threat in a cyber-attack scenario to compromise 1) a first virtualized instance (source device), 2) a second virtualized instance (targeted device), and 3) virtualized instances of components of a virtualized instance of a network associated with selected pathways of the cyber-attack scenario through the virtualized instance of the network. The virtualized instances may be based on historical knowledge of connectivity and behaviour patterns of users and devices within an actual network under analysis. The formatting module generates a report with identified devices that are communicatively coupled to the virtualized instance of the network and prioritized to allocate security resources. The simulator calculates the least resistance path(s) through the virtualized instance of the network and refrains from calculating every theoretically path therefrom.

A new machine procedure and electronic circuitry are provided that hide one or more signals inside noise. In an embodiment, a random nonce helps unpredictably move the hiding locations of the signals. In an embodiment, the quantum complexity is related to the complexity of Grover's algorithm so that the hiding procedure is resistant to quantum computers. In some embodiments, public keys are hidden in the noise. In some embodiments, quantum randomness generates random noise and a random nonce, using photonic emission with a light emitting diode, and flip-flops.In other embodiments, our machine procedures and circuits use robustness, unpredictably and variability to hinder malware infection. In some embodiments, our machine instruction opcodes are randomized. The computing behavior of our machine is structurally stable (invariant) to small changes made to its machine instructions. Our invention expands the engineering method of stability to a cryptographically stable machine that is resistant to malware sabotage by an adversary.

The invention relates to a recursive protocol security verification method, device and equipment based on constraint solution. The method comprises the following steps: acquiring known information of a recursive protocol; establishing an opponent derivation rule, and deriving the known message according to the opponent derivation rule to obtain a new message; a new message constructed by an enemy in a certain stage of recursive protocol execution is symbolized into a variable, infinite possible execution traces of a security protocol are abstracted into a group of derivation constraints, and the enemy constructs a constraint system through initial knowledge and the derivation constraints in protocol interaction; simplifying the constraint system according to a preset simplification rule to obtain a simple constraint system; a to-be-verified security attribute is modeled as a first-order formula, and whether an enemy can destroy the security attribute or not is judged by solving whether the simple constraint system and the first-order formula have a common solution or not, so that security verification is realized. By adopting the method, the security verification of the recursive protocol can be realized.

A dynamic adversary profile is generated for a simulated attack on components of the enterprise network by selecting a profile of at least one specific threat group. The simulated attack is based on historical attack data, threat intelligence feeds, and real-time monitoring of adversary profiles. One or more relevant adversary group profiles is selected. An attack pattern (e.g., an APT attack pattern) is simulated on the components by injecting data packets based on the specific threat group without malicious components of the specific threat group to test security defenses of the components. Logs are collected from the simulated attack pattern. Based on results of the simulated attack pattern, defenses to the simulated attack on components are measured. Optionally, a security action concerning at least one of the components to better protect against an actual attack.

Examples of a computer-implemented framework and associated methods for executing payment transactions in parallel with less than f+1 validations are disclosed. The framework includes a novel quorum system called the (k1,k2)-quorum systems. In the presence of a non-adaptive adversary, these systems can be used to allow up to k1 transactions to be validated concurrently and asynchronously but prevent more than k2 transactions from being validated.

The invention relates to the technical field of privacy set intersection, and provides a two-party and multi-party privacy set intersection method based on casual key value storage and threshold secret sharing. According to the two-party privacy set intersection method, in order to judge whether an intersection cardinal number reaches a threshold value or not, OKVS is adopted to associate elements with secret sub-shares, when the number of the intersection elements reaches the threshold value, receiving is convenient, enough correct sub-shares can be obtained, then a secret value is reconstructed, and leakage of the intersection cardinal number is effectively prevented. Meanwhile, in order to avoid exponential-level combination among secret shares, a Reed-Solomon decoding algorithm based on fast Fourier transform is adopted to reconstruct a secret value. In addition, on the basis of two parties, an efficient multi-party privacy set intersection method is designed in combination with unconditional zero sharing. According to the method provided by the invention, the calculation complexity can reach # imgabs0 #, the linear communication overhead is kept, and the attack of a semi-honest enemy can be resisted.

The invention relates to a bank-enterprise direct connection scene-oriented revocable security signcryption method, and belongs to the field of information security. According to the method, digital signature and encryption are deeply coupled in a single logic step, so that the calculation complexity is reduced, and the requirements of confidentiality, integrity and non-repudiation of information transmission in a financial scene are met; and meanwhile, a key updating mechanism is designed, so that access blocking of the history and the newly-added ciphertext after permission revocation is ensured. In order to solve a subversive attack possibly initiated by an internal opponent, a password reverse firewall architecture is introduced, an encrypted ciphertext is reconstructed through a re-randomization module, and algorithm risks possibly caused by tampering of a random number generator are blocked. A block chain intelligent contract and aggregation signature technology is further introduced, a fair and reliable decentralized verification platform supporting batch verification is constructed for bank and enterprise users, the cloud verification efficiency is improved, and responsibility tracing can be performed through records on the block chain when major property safety accidents occur.

The invention provides an on-lattice password-based authentication key negotiation method. A user is allowed to use a password to negotiate a session key with a server and authenticate the identity of the user. And construction is carried out based on an ideal lattice, so that the security is established on a learning problem with errors on a ring, and quantum attacks can be effectively resisted. The voucher of the user is stored in a server side in a password encryption mode, and only the user with a correct password can decrypt the voucher to obtain a legal voucher and establish a subsequent session key. When a session key is established, the user and the server perform an authentication key exchange with a key hiding attribute to prevent leakage of user credential information. Even if the opponent obtains the certificate ciphertext encrypted by the user password and exhausts the password space to decrypt the ciphertext to obtain a possible user certificate set, the certificate corresponding to the correct password cannot be identified from the set, so that the method and the device can resist off-line dictionary attacks. In addition, bidirectional key confirmation can ensure consistency of session keys while verifying user identity.

An embodiment provides a quantum-resistant technique for distributing symmetric or other keys (e.g., in quantum key distribution (QKD), etc.). The embodiment pertains to a protocol and network architecture that integrates QKD without the need for trusted nodes, thereby meeting the requirements of the Tor or other anonymous communication network and creating a quantum-secure anonymous communication network. The embodiment re-designs the key establishment and exchange mechanisms of Tor to incorporate QKD, and provides a theoretical guarantee of security against quantum-powered adversaries (QPAs) while meeting all network or system requirements.

The disclosure relates to generating a ciphertext of arbitrary and flexibly large size and ensures that an adversary learns little about the encrypted data, even if the decryption key later leaks, unless substantially the entire ciphertext is stored. Given that communication will be inconveniently large for the adversary to store, the incompressible ciphertexts and signatures can be sent and received with low storage requirements for the honest users. In such a setting, the honest users would not store the entire ciphertext or signature, but instead generate, send, and process the communication bit-by-bit in a streaming fashion.

Endpoint system comprising an endpoint agent configured for deployment on a computing machine, a backend server adapted to curate and update intelligence fingerprints, a communication module within said agent enabling it to request and receive the latest intelligence fingerprints from said backend server, and a mechanism within said agent to directly analyse network packet details. The system may comprise logless technology and operate independently of threat intelligence platforms (TIPs) and Security Information and Event Management (SIEM) systems. The system may identify adversary inndicators such as unusual agent strings, uncommon IP addresses, or patterns inconsistent with command-and-control servers. The system may also comprise an automated response system.

Embodiments of the present application relate to the field of communications, provide a model robustness enhancement method and a communication apparatus, and can improve the robustness of an AI / ML model. The method comprises: a model training function can send detected abnormal data to an NDT system for data enhancement, acquire, from the NDT system, robustness enhancement data corresponding to the abnormal data, and input the robustness enhancement data corresponding to the abnormal data as adversarial data into a model for adversarial training, so that a target model automatically learns prior knowledge of an adversary attack and prior knowledge of a feature domain drift trajectory of the target model itself in a training process, thereby improving the robustness of the model, such as attack defense robustness and feature domain drift robustness of the model.

A UE may detect, at the UE, a suspected fabricated transmission attack based on PHY security. The UE may transmit, to a network node, and the network node may receive, from the UE, an indication of the suspected fabricated transmission attack. The network node may receive, from the UE, an indication of one or more characteristics associated with a potential attacker associated with the suspected fabricated transmission attack. The UE may transmit, via a sidelink to at least one additional UE, a second indication of whether the UE identifies that the suspected fabricated transmission attack corresponds to the UE being attacked. The network node may identify a geographical location of the potential attacker based on a plurality of indications of the one or more characteristics associated with the potential attacker. The network node may compile an adversary pool including one or more compromised identities.

A method for performing connection management of a station (STA) device within a wireless communications system for protection from identity confusion (e.g., SSID confusion and / or icon confusion caused by attacks from an attacker device) and associated apparatus are provided. The method may include: transmitting at least one probe request from the STA device to an access point (AP) device of an adversary, the adversary to a user of the STA device, wherein the AP device may act as the attacker device; receiving at least one probe response from the AP device; transmitting at least one association request from the STA device to the AP device; receiving at least one association response from the AP device; performing a four-way (4-way) handshake between the STA device and the AP device; and in response to a number of non-valid beacons from the AP device reaching a predetermined threshold, disconnecting from the AP device.

This invention discloses a method and system for generating three-party collaborative SM2 digital signatures to resist malicious adversaries. The method includes three-party collaborative key generation and three-party collaborative signing. This invention can promptly detect whether a malicious adversary deviates from the predetermined steps of the protocol during execution, and can hold the perpetrator accountable after the malicious adversary's attack causes the protocol to terminate. This scheme uses a three-party collaborative signature based on secret sharing and employs multiplication triples for security verification. It fully considers the security, reliability, and performance of collaborative signature technology, achieving a security level resistant to malicious adversary attacks while ensuring secure, reliable, and rapid digital signature generation in a three-party environment, achieving a balance between key generation and signing efficiency. This invention has advantages such as high security, high flexibility, and high performance, and can be applied to any application scenario supporting secure multi-party computation.

The application discloses an adversary-aware authentication method in federated learning based on adaptive steganographic watermarking, and the method is as follows: a device constructs its own identity information and encrypts and transmits the identity information to an authentication server; the authentication server processes the request of the external device and ensures that each device joining the system has a controlled validity period and clear identity information; the device re-applies to the authentication server according to the validity period, and the server regularly cleans up invalid internal devices; the authentication server registers the device ID of the legal device and groups the legal device, simultaneously selects a group leader device for each group and formulates a rotation rule; the authentication server generates corresponding watermark trigger data sets for each group and sends the watermark trigger data sets to all legal devices together with a global model and an authentication data set; the legal device trains the global model and learns a trigger strategy; and the authentication server performs security authentication on the legal device. The application improves the controllability, accuracy and concealment of the authentication process, and realizes safe, efficient and concealed authentication.

Techniques are disclosed for providing an innocent until proven guilty (IUPG) solution for building and using deep learning models that are resistant to adversaries and resistant to false positives. In some embodiments, a system, process, and / or computer program product includes storing a collection comprising one or more innocent until proven guilty (IUPG) models for static analysis of samples; performing static analysis of content associated with a sample, wherein performing the static analysis includes using at least one stored IUPG model; and determining, based at least in part on the static analysis of the content associated with the sample, that the sample is malicious, and in response to determining that the sample is malicious, performing an action based on a security policy.

The present invention discloses a V2C post-quantum authentication and key negotiation method based on RLWE. During system initialization, a master key, public key, hash function, and related parameters are selected. During the registration phase, the vehicle and cloud server CS register with a registration authority RA. During the login phase, the vehicle and CS log in to the local system. During the authentication and key negotiation phase, the vehicle and CS perform identity authentication and key negotiation through the RA, negotiating a session key for subsequent secure communication without revealing their true identity. During the identity and password update phase, users can directly update their identity and password without going through the RA. The present invention is based on ring fault-tolerant learning RLWE and a hash method design, effectively reducing the computational and communication overhead of the AKA process, resisting attacks by quantum adversaries, and ensuring the confidentiality of the true identity of legitimate vehicles. Furthermore, the "fuzzy verifier + honeyword" technology is used in the AKA process to resist signal leakage and key guessing attacks, ensuring key security.

A computer-implemented method, a computer program product, and a computer system for defending against adversarial attacks in federated learning. In the federated learning comprising an aggregator and parties, the aggregator receives weights sent from the respective parties. The aggregator computes values of a performance metric for weight arrays obtained by the respective parties, using a validation dataset. The aggregator ranks the values of the performance metric in a list. The aggregator recursively splits the list in half until one or more adversary updates of the weights are isolated. The aggregator excludes one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning.

Every major DAO governance failure traces to a common root cause: governance logic, voting, and treasury access reside in software that adversaries can reach. The disclosed invention provides a hardware-anchored DAO governance architecture defeating five adversary classes. A supply-chain attestation layer verifies firmware integrity against a public transparency log at node initialization. A Silicon Root-of-Trust Anchor Layer binds governance to processor-embedded cryptographic keys. A Heterogeneous TEE Orchestration Layer enforces Byzantine fault-tolerant canonical quorum through threshold BLS signatures across independent hardware architecture families. An Atomic Governance Transition Engine executes indivisible state changes: record incorporation, key destruction, counter advancement, and IOMMU treasury isolation. A Quantum-Resistant Governance Key Lifecycle Engine performs CRYSTALS-Kyber (ML-KEM, FIPS 203) key rotation with cryptographic agility. A Cross-Chain Governance Attestation Bridge publishes TEE-signed proofs to multiple blockchains. A Deterministic Governance Replay Engine reconstructs governance decisions in isolated sandboxes. An Automated Governance Incident Response Engine and Governance Regulator Verification Network provide hardware-enforced, independently auditable compliance enforcement.

The invention relates to a communication and payment device and method for preventing telecommunication fraud. If whether the caller and the electronic payment operator are abroad or not can be identified, a large amount of fraud can be stopped, and even in China, the safety can be greatly improved by identifying the position. The position is indicated only by a conventional smart phone, which is unreliable, and we must adopt a more reliable method. If the position is verified at a fixed position, the verification is relatively simple, and a device (a chip for verifying the position is hereinafter referred to as a transponder) with a fixed position can be used for sending verification information to the platform; to ensure security, the transponder may indicate the location to the platform using a dynamic authentication code. A key required for generating the authentication code can be generated by a transponder. If the position of a user is not fixed and is difficult to determine, a positioning chip can encrypt coordinates, and an enemy cannot generate a correct ciphertext, so that cheating cannot be implemented, and the chip is hereinafter referred to as a'secret bit chip '. The user activity track can well indicate the identity, hereinafter referred to as track verification.

Techniques for secure remote digital storage or transmission of a ciphertext message include determining a maximum storage capacity of an adversary, determining a security parameter k, wherein 1<<k<<m, and determining a prime number n, such that ≤0.3kn. A current public portion of random string α, comprising n random elements, is read from a public site. A secret key z, wherein z has 2k elements, comprising k additive co-primes of n and k multiplicative co-primes of n is shared with a receiving site. An encryption key X, based on the secret key and the current public string, is determined and applied to a plaintext message M of length ≤m to encrypt the plaintext message as Y=M⊕X, thereby creating the ciphertext message Y, which can be placed on a public forum for receiving by a receiving node.

Methods provide device authentication for an intrusion detection system implementing building automation and control network (BACnet) Master-Slave / Token-Passing (MS / TP). An authentication protocol provides countermeasures to vulnerabilities in the BACnet MS / TP physical layer by utilizing an extended message format to cloak device identifiers (IDs). Adversaries are prevented from using known device IDs to gain access to the network. An authenticating device hashes a device identifier of a device to be authenticated combined with a random number. The authenticating device receives a hash of the random number plus the device identifier from the device. The authenticating device compares the hashes and authenticates the device if the hashes match. To transmit the hash, the BACnet MS / TP frame format includes an extended header cyclic redundancy check (CRC) field having bytes reallocated from the data field of the frame format. Another countermeasure utilizes a physical unclonable function (PUF) of the device in the extended header CRC.

This invention relates to a hierarchical federated security aggregation method based on cloud-edge collaboration, belonging to the field of network security technology. This method effectively defends against model / data poisoning attacks through a two-layer anomaly detection mechanism, and combines a cloud-edge collaborative two-way authentication mechanism to achieve trusted user identity verification and service access control, simultaneously improving edge network security and privacy protection capabilities. This method can effectively mitigate the impact of poisoning attacks on hierarchical federated learning systems in a cloud-edge-device environment, while also reducing the risk of privacy leaks caused by external adversaries obtaining model parameters through eavesdropping.