71 results about "Attack analysis" patented technology

The invention relates to the technical field of AI agent defense, and particularly discloses an AI agent autonomous defense system and method for network attack path prediction. An attack chain reasoning module; a risk assessment module; a path prediction module; a resource scheduling module; a defense execution module; through cooperation of a dynamic environment sensing module, an attack chain reasoning module, a risk assessment module, a path prediction module, a resource scheduling module and a defense execution module, automation and intelligentization of the whole process from environment sensing, attack analysis to defense execution are realized, manual intervention is reduced, human errors are reduced, and the defense efficiency is improved. And the attack reasoning module is used for reasoning a multi-stage attack path, so that the limitation of single-stage attack analysis is broken through, an attack logic chain of an attacker from reconnaissance and penetration to transverse movement is completely presented, the attack life cycle is comprehensively covered, and the timeliness, comprehensiveness and security of network security defense are improved.

The embodiment of the invention provides a network attack research and judgment method and system, a program product, equipment and a medium, the system deploys a plurality of agents, and the method comprises the following steps: inputting an attack sample into an attack feature extraction agent, and constructing an attack feature library based on the extracted attack features; inputting the network security log into a field extraction agent to obtain an extracted attack related field; inputting the attack feature library and the attack related fields into an attack analysis module, and obtaining attack analysis data of the attack analysis module on the attack related fields based on the attack feature library; inputting the threat intelligence data, the asset data and the attack analysis data into a comprehensive analysis report agent to obtain an analysis report including an attack result, an attack severity degree, an influence range and an attack technology; and inputting the analysis report into an attack processing module to obtain an attack processing plan. Attack research and judgment process automation is realized by utilizing the intelligent agent, the analysis, research and judgment capability on known attacks can be improved, unknown attack behaviors can be identified, and closed-loop protection measures are formed.

The invention discloses a Diithium rapid side channel attack analysis method, which belongs to the technical field of information security, and comprises the following steps of: detecting leakage by adopting a Gaussian mixture difference method to complete detection and selection of feature points; the signature information is used to classify the actual leakage in which the private key participates, and the distribution difference is used to recover the normal domain private key. According to the method, the problem of high time overhead under small sample leakage of the existing non-template attack is solved. A complete private key can be recovered within a few minutes at a high noise level by using side information leakage generated by a small amount of signatures. Compared with an existing leakage detection method, the Gaussian mixture difference method can complete detection and selection of feature points without obtaining a sensitive intermediate value. The method can be used for detecting whether the password equipment and the password chip are safe and reliable or not, such as the fields of bank cards of financial economy, physical digital currency cards, mobile phone chips of mobile communication and the like, so as to detect whether the equipment has security risks or not.

The invention provides a network attack analysis method and device based on an attack chain, and electronic equipment, and the method comprises the steps: carrying out the matching of alarm data based on a predefined attack chain model, dividing an attack stage corresponding to each alarm data, carrying out the association of each alarm data based on the attack stage of each alarm data, and obtaining an alarm data association graph, based on the alarm data association, an attack link containing a complete attack stage is extracted from the first attack stage for analysis, and because the alarm data is usually a large amount of dispersed data, data belonging to the same attack chain can be found from the large amount of dispersed data based on the attack stage by dividing the attack stage. The association between the alarm data can be found, so that the hidden attack behavior can be found, and the attack analysis efficiency and the attack behavior detection rate can be improved. Meanwhile, the alarm data can be identified as the attack behavior only when forming a complete attack stage, so that the false alarm of the attack behavior is reduced, and the analysis accuracy of the attack behavior is improved.

The invention belongs to the technical field of network security, and particularly relates to a multi-source network risk information fusion and risk assessment method, which comprises the following steps of: extracting nodes and edges of a real-time event through an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; calculating a random walk transition probability matrix of the edge, and calculating a time-sensitive personalized random walk value based on the random walk transition probability matrix; a graph neural network model is adopted for training, graph neural network embedding and prediction are carried out in combination with the features of the nodes, and the classification probability is output; and carrying out three-dimensional sub-graph segmentation on the predicted multi-source heterogeneous threat knowledge graph, constructing a mapping index, carrying out aggregation calculation to obtain a propagation path and path popularity of a high-risk node, analyzing a sub-graph evolution trend and carrying out early warning. The method is suitable for carrying out dynamic analysis and prediction on multi-dimensional attack risks, and trend attack analysis of the industry changing along with time is achieved.

The invention discloses an attack trapping and analyzing method and system based on a honeynet, and relates to the technical field of attack analysis, and the method comprises the steps: collecting attack interaction data and an associated attack chain trajectory set; dividing attack behavior units, and constructing a behavior space attitude matrix; constructing a two-dimensional behavior relationship graph, performing interpolation enhancement of sub-time granularity, and raising the dimension of the interpolated behavior node into a three-dimensional semantic space; performing attack path trend analysis on the attack behavior unit, and constructing an attack path bending rule model; and inputting parameters such as the attack chain trajectory set and behavior nodes in the three-dimensional semantic space into the attack path bending rule model, outputting a trapping response strategy, and dynamically adjusting the honeynet environment. According to the invention, the type and position of the honeypot can be automatically adjusted according to the attack behavior change, the structure definition and processing precision of the attack behavior data are effectively improved, and the attack behavior identification result can be conveniently and directly used for trapping strategy optimization.

An attack analysis support apparatus includes: an acquiring unit that acquires a predicate indicating a type of an attack included in an observation indicating a trace of the attack, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating unit that generates a noise condition by, with use of selection information that is included in conversion information associated with the predicate or the observation type and is for selecting conversion target data included in log management information for managing a log, selecting conversion target data from the log management information, and converting the selected conversion target data based on conversion method information included in the conversion information; and a noise information generating unit that generates noise information to be used for determination of whether or not the observation is noise, in accordance with the noise condition generated for the log management information.

An attack analysis device stores attack abnormality relationship information indicating a relationship among (i) predicted attack information indicating an attack predicted to be received by an electronic control system, (ii) predicted abnormality information indicating an abnormality predicted to occur in response to the predicted attack, and (iii) predicted abnormality location information indicating a location within the electronic control system where the predicted abnormality occurs. The attack analysis device is configured to: acquire a security log indicating an abnormality detected in the electronic control system and a detection location of the abnormality in the electronic control system; estimate the attack based on the security log and the attack abnormality relationship information; analyze an estimation accuracy of the attack based on context data included in the security log; and output attack information, which indicates the estimated attack, and estimation accuracy information, which indicates the estimation accuracy of the attack.

An attack analysis device acquires a security log generated by a security sensor mounted on each of a plurality of electronic control units configuring an electronic control system, sets a log package in which a plurality of the security logs are packaged, estimates an attack received by the electronic control system based on the log package, and outputs attack information indicating the estimated attack.

The present invention discloses a red team attack simulation software obfuscation method and system based on dynamic encryption and decryption, belonging to the field of data analysis technology. The method aims to improve the analysis efficiency and evaluation value of the red team attack simulation task through refined analysis and obfuscation operations. In detail, the method integrates various key information of the red team attack simulation task to be obfuscated, uses advanced data processing technology to locate frequent attack events, and then performs periodic disassembly and behavior detection on the simulated attack task, and finally generates an obfuscated output report through dynamic encryption and decryption obfuscation technology. In this way, not only the depth and breadth of the simulated attack analysis are improved, but also a new and chaotic perspective is provided for the security team to examine and evaluate the simulated attack process, thereby effectively discovering potential security vulnerabilities and attack paths.

The present invention discloses a state evaluation method and system based on network security, which relates to the technical field of network security and includes: obtaining at least one attackable path and obtaining an association set of network nodes; calculating the risk coefficient of historical security vulnerabilities and forming attack characteristics for historical security vulnerabilities; forming a danger threshold for the attackable path; evaluating the attack scale of a network attack based on the danger threshold of the attackable path to obtain an overall predicted scale; obtaining the emergency repair speed of network nodes and calculating to obtain an attack offset scale; when the overall predicted scale does not exceed the attack offset scale, it is determined that the network security is in a normal state, otherwise, it is determined that the network security is in an abnormal state. By setting a node analysis module, a vulnerability analysis module, an attack analysis module, an attack prediction module and a repair prediction module, an evaluation result that is more consistent with the actual situation can be obtained, and thus the evaluation result has strong reference value.

The invention relates to the technical field of network security, and discloses an attack analysis method based on a mysqldump connection characteristic honeypot, and the method comprises the steps: obtaining a simulation tool of a MySQL server; embedding an attack vector in the version information of the simulation tool, and constructing a honeypot server based on the simulation tool; in response to the fact that an attacker is connected with the honeypot server through mysqldump, obtaining version information returned by the honeypot server; obtaining multi-dimensional attack behavior data of the attacker based on the returned version information; and based on the multi-dimensional attack behavior data, analyzing the attack behavior of the attacker. According to the method, the attack vector is embedded in the version information by using the connection characteristic to attract an attacker, prevent the attacker from attacking a real system and strive for time for defense measures, and when the attacker attacks, multi-dimensional attack behavior data is obtained and analyzed, so that the attack analysis accuracy is improved, powerful support is provided for formulating an effective defense strategy, and the method is suitable for popularization and application. And defense capability is enhanced.

The application discloses a kind of deep fake detection and tracing systems for network phishing attack, including the following steps: multi-source data acquisition module is used to form pre-processing multi-source data;Feature extraction module is used to form associated feature data;Association graph generation module is used to build fake content association layer and phishing propagation association layer, form unified attack association graph;Path screening construction module is used to identify effective relationship section, and build calculation path set;Similarity calculation backwrite module is used to perform PathSim similarity calculation, form the unified attack association graph after state update;Iterative calculation update module is used to re-execute PathSim similarity calculation, form candidate association result;Back-checking analysis output module is used to verify based on fake evidence and propagation evidence, and convert the candidate association result after verification into attack analysis result.The application improves the accuracy of deep fake content identification in network phishing attack scenario.

An attack analysis device (100) includes an analysis priority changing unit (130) that, when a target device receives a target attack that is a network attack, changes an analysis priority corresponding to the target device on the basis of the content of the target attack, the target device being a device provided in an attack target system that is provided with a plurality of devices. Each of the plurality of devices is provided with an analysis priority. When a plurality of devices provided in a system to be attacked are set as a device group to be attacked, if each device included in the device group to be attacked is subjected to a network attack, the device group to be attacked is analyzed according to an analysis priority corresponding to each device included in the device group to be attacked. Network attacks for each device included in the attack target device group are sequentially analyzed.

The present invention discloses a threat detection method, device and equipment based on an APT attack graph. The method of the present invention includes the steps of APT attack graph generation, intrusion alarm collection, attack path identification, APT attack detection, and evidence chain reconstruction. The present invention reduces the real-time attack analysis overhead by designing an APT attack graph and pre-analyzing attack actions according to network and system information; evaluates attacks from multiple angles such as harmfulness and necessity to ensure the comprehensiveness of threat detection, and designs an attack path scoring method to achieve global attack analysis; associates attack behavior traces to form an evidence chain, and uses a gray list to associate multiple attack entities to achieve accurate positioning of the attack impact range. By combining the three capabilities of APT attack prediction, detection and monitoring, the problem of threat alarm fatigue is effectively combated, and the robustness of zero-day vulnerability exploit detection is improved, so that the present invention can efficiently and accurately detect APT attacks.

This invention discloses a method for collecting evidence from control logic attacks on industrial controllers. The method primarily involves extracting PLC binary control application files by simulating the PLC's upload function; performing reverse engineering on the extracted binary files, including identifying the PLC binary's assembly instruction set architecture, performing disassembly analysis, identifying the PLC programming language, and generating an assembly log file; and performing attack detection, attack location, attack analysis, and attack recovery based on the generated assembly log file. This method effectively collects evidence from control logic attacks on industrial controllers without requiring PLC source code, plant behavior models, or any network traffic. The method can automatically execute the entire process within acceptable time and memory overhead.

The present invention discloses a method for rapid side-channel attack analysis of Dilithium, belonging to the technical field of information security. The Gaussian mixture difference method is used to detect leakage, and the detection and selection of feature points are completed; the signature information is used to classify the actual leakage involving the private key, and the difference in distribution is used to recover the private key in the normal domain. The present invention solves the problem of large time overhead in existing non-template attacks under small-sample leakage. Using the side information leakage generated by a small number of signatures, the complete private key can be recovered within a few minutes under a high noise level. Compared with existing leakage detection methods, the Gaussian mixture difference method can complete the detection and selection of feature points without obtaining sensitive intermediate values. The present invention can be used to detect whether the cryptographic device and cryptographic chip are safe and reliable, such as in the fields of bank cards in financial economy, digital currency physical cards, and mobile phone chips in mobile communication, to detect whether there are security risks in the device.

The invention relates to a dynamic displacement feedback attack and analysis method and device, and belongs to the technical field of multi-agent system control. The dynamic displacement feedback attack method comprises the following steps: acquiring a linear dynamic model of a target robot formation and a formation controller equation of the target robot formation constructed based on the linear dynamic model; intercepting a control vector sent by a first robot to a second robot in the target robot formation, and designing an attack vector for the control logic of the target robot formation based on the control vector, the incomplete dynamic model and the formation controller equation; and sending the attack vector to the second robot as a pseudo control vector. The invention provides a novel attack mode with relatively high attack precision, which is convenient for researchers to research the security of the multi-agent system.

The invention discloses a wireless network attack analysis method and system based on a large model prompt project. The method mainly comprises an offline stage and an online analysis stage. The offline stage mainly comprises the following steps: (1) constructing an attack knowledge base; and (2) constructing a prompt template. In the online analysis stage, the system periodically executes the following steps: (1) simulation data collection; (2) scene description generation; (3) template assembly is prompted; (4) large language model attack reasoning; (5) extracting parameters of the large language model; (6) simulating an attack result; and (7) updating the knowledge base and the template. According to the method, powerful context understanding, logical reasoning and common sense capabilities of a large language model are utilized to replace a traditional machine learning model, and automatic analysis of complex network attack behaviors in a large amount of simulation data is realized; the big language model reasoning output is converted into a structured attack result through the prompt project, so that the interpretability of attack analysis in a complex and changeable wireless network is greatly improved, and the overhead of manual analysis is remarkably reduced.

A data acquisition unit (21) acquires operation data including an influence-source object being an object which has performed an operation to influence another object, an influence-destination object being an object influenced by the operation performed by the influence-source object, and an attack probability representing a probability of the operation being an attack. A relation construction unit (22) constructs relation data when the attack probability is equal to or higher than a threshold value A, by adding a relation between the influence-source object and the influence-destination object to relation data. When an attack is detected, a specification unit (23) specifies at least either of an infected range supposed to be affected by the attack, and an intrusion route of the attack, based on the relation data.

A system for securing patient data in IoT-enabled hospitals, consisting of: a network of IoT-enabled medical devices configured to collect and transmit patient data; a blockchain network in conjunction with the aforementioned medical devices, configured to create an immutable ledger of patient data transactions, implement smart contracts for access control, and maintain a decentralized log of data access attempts; an Artificial Intelligence and Machine Learning (AIML) module configured to: monitor blockchain activity for anomalous patterns, implement intrusion detection using machine learning algorithms, perform predictive analytics for threat detection, and execute natural language processing to identify personal data; a secure data block storage configured for: implementing PII data masking for sensitive patient information, maintaining the masked data utility for authorized users, and storing encrypted patient records; a malware detection module configured to detect unauthorized data manipulation attempts, identify exponential data propagation patterns, monitor system vulnerabilities, and track malware transmission behavior; and a defense framework configured to: implement compartmental epidemic modeling for attack analysis, calculate reproduction numbers for malware propagation, adapt security measures based on threat levels, and maintain version control of security updates.

This attack monitoring device 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 that analyzes a log of a first monitoring target 501 on the basis of a threat scenario to calculate the possibility of a cyber attack occurring; and an offload determination unit 124 that determines whether to cause a server-side attack analysis unit 222, which is installed in a server 200 outside of the vehicle V and analyzes a log of a second monitoring target 502 on the basis of the threat scenario to calculate an occurrence possibility of a cyber attack, to execute an offload of processing for the analysis of the log of the first monitoring target 501 by the vehicle-side attack analysis unit 122.

The embodiment of the invention provides a network attack processing method, system and device, a storage medium and a program product. In the process of performing security protection on the target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior can be obtained, an interception rule corresponding to the suspicious behavior is obtained according to the behavior data, and the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training the behavior data sample of the process corresponding to the historical network attack behavior, so that the attack analysis model can better master the knowledge of the network attack field. When the behavior data of the process with the suspicious behavior is analyzed, the attack analysis model can identify and judge the behavior of the process more accurately, so that an interception rule with higher confrontation is generated. Therefore, the potential security threats corresponding to the suspicious behaviors can be quickly and accurately processed, the risk of missing potential attacks is reduced, and the defense capability is improved.

To provide an attack monitoring apparatus, an attack monitoring system, and an attack monitoring method which enable cyber attack monitoring to be continued with an in-vehicle system with limited resources.SOLUTION: An attack monitoring apparatus 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 which analyzes a log of a first monitoring target 501 based on a threat scenario, to calculate the probability of occurrence of cyberattack; a server-side attack analysis unit 222 which is mounted on a server 200 outside the vehicle V and analyzes a log of a second monitoring target 502 based on the threat scenario, to calculate the probability of occurrence of cyberattack; and an offloading determination unit 124 which determines whether to offload the process of the vehicle-side attack analysis unit 122 to analyze the log of the first monitoring target 501.SELECTED DRAWING: Figure 2

Provided is a technology that enables highly accurate analysis of a cyber-attack against a vehicle. An attack analysis device (47) comprises a determination section (472, S102) which is configured to: determine whether correspondence information matches a pre-set type of the attack, in which correspondence information a system log that is a log of an electronic control system and a communication log that is a log of communications between the electronic control system and the outside of a vehicle are associated with each other; and determine whether an target element representing at least one of a component of the electronic control system and the electronic control system is being violated.

This application discloses a method and apparatus for handling risk events in encrypted traffic. The method includes: synchronously collecting network modality data and host modality data through an eBPF program assembly with multiple function entry points pre-deployed in the Linux kernel to obtain collected network events; transmitting the network events to a user-space receiver via the Perf Buffer data transmission mechanism to append a global high-precision timestamp and host identifier to the network events to obtain network traffic; generating a comprehensive risk score for the network events based on the network traffic, combined with a pre-trained bimodal deep learning model and a cross-modal attention fusion module; and triggering an alarm and writing the network event as a risk event into a graph database when the comprehensive risk score exceeds a preset threshold. Using this application, lateral movement attacks can be effectively detected and defended, improving the accuracy of encrypted risk detection and enabling users to gain a more comprehensive understanding of attack behavior, thereby enabling more effective attack analysis and response.

Embodiments of the present disclosure provide a cyber attack processing method and system, a device, a storage medium, and a program product. In the process of performing security protection on a target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior may be acquired, and an interception rule corresponding to the suspicious behavior is acquired on the basis of the behavior data, wherein the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training behavior data samples of processes corresponding to historical cyber attack behaviors, and therefore, the attack analysis model can better grasp knowledge in the field of cyber attacks. When analyzing behavior data of a process of the suspicious behavior, the attack analysis model can more accurately identify and determine the behavior of the process, thereby generating a more adversarial interception rule. Therefore, it is convenient to quickly and accurately process potential security threats corresponding to suspicious behaviors, the risk of missing potential attacks is reduced, and the defensive capability is improved.

A data acquisition unit (21) captures operation data, which includes an influence source object, which is an object that has performed an operation to influence another object; an influence target object, which is an object that is affected by the operation performed by the influence source object; and an attack probability, which represents the likelihood that the operation is an attack. A relationship construction unit (22) creates relationship data when the attack probability is equal to or greater than a threshold A by adding a relationship between the influence source object and the influence target object to the relationship data. When an attack is captured, a specification unit (23) specifies, based on the relationship data, at least either an infected area that is said to be affected by the attack or an intrusion route of the attack.

A data acquisition unit (21) acquires operation data including an influence source target, which is a target that performs an operation that affects another target, an influence destination target, which is a target that is affected by the operation performed by the influence source target, and an attack certainty degree indicating a probability that the operation is an attack. When the attack certainty degree is equal to or greater than a threshold value A, a relationship construction unit (22) constructs relationship data by adding the relationship between the influence source target and the influence destination target to the relationship data. When an attack is detected, the specifying unit (23) specifies, on the basis of the relational data, at least one of a pollution range in which the influence of the attack is assumed to be present and an intrusion path of the attack.

Subject level privacy attack analysis for federated learning may be performed. A request that selects an analysis of one or more inference attacks may be received to determine a presence of data of a subject in a training set of a federated machine learning model. The selected inference attacks may be performed to determine the presence of the data of subject in the training set of the federated machine learning model. Respective success measurements may be generated for the selected inference attacks based on the performance of the selected inference attacks, which may then be provided.