53 results about "Attack analysis" patented technology

The invention relates to the technical field of AI agent defense, and particularly discloses an AI agent autonomous defense system and method for network attack path prediction. An attack chain reasoning module; a risk assessment module; a path prediction module; a resource scheduling module; a defense execution module; through cooperation of a dynamic environment sensing module, an attack chain reasoning module, a risk assessment module, a path prediction module, a resource scheduling module and a defense execution module, automation and intelligentization of the whole process from environment sensing, attack analysis to defense execution are realized, manual intervention is reduced, human errors are reduced, and the defense efficiency is improved. And the attack reasoning module is used for reasoning a multi-stage attack path, so that the limitation of single-stage attack analysis is broken through, an attack logic chain of an attacker from reconnaissance and penetration to transverse movement is completely presented, the attack life cycle is comprehensively covered, and the timeliness, comprehensiveness and security of network security defense are improved.

The embodiment of the invention provides a network attack research and judgment method and system, a program product, equipment and a medium, the system deploys a plurality of agents, and the method comprises the following steps: inputting an attack sample into an attack feature extraction agent, and constructing an attack feature library based on the extracted attack features; inputting the network security log into a field extraction agent to obtain an extracted attack related field; inputting the attack feature library and the attack related fields into an attack analysis module, and obtaining attack analysis data of the attack analysis module on the attack related fields based on the attack feature library; inputting the threat intelligence data, the asset data and the attack analysis data into a comprehensive analysis report agent to obtain an analysis report including an attack result, an attack severity degree, an influence range and an attack technology; and inputting the analysis report into an attack processing module to obtain an attack processing plan. Attack research and judgment process automation is realized by utilizing the intelligent agent, the analysis, research and judgment capability on known attacks can be improved, unknown attack behaviors can be identified, and closed-loop protection measures are formed.

The invention provides a network attack analysis method and device based on an attack chain, and electronic equipment, and the method comprises the steps: carrying out the matching of alarm data based on a predefined attack chain model, dividing an attack stage corresponding to each alarm data, carrying out the association of each alarm data based on the attack stage of each alarm data, and obtaining an alarm data association graph, based on the alarm data association, an attack link containing a complete attack stage is extracted from the first attack stage for analysis, and because the alarm data is usually a large amount of dispersed data, data belonging to the same attack chain can be found from the large amount of dispersed data based on the attack stage by dividing the attack stage. The association between the alarm data can be found, so that the hidden attack behavior can be found, and the attack analysis efficiency and the attack behavior detection rate can be improved. Meanwhile, the alarm data can be identified as the attack behavior only when forming a complete attack stage, so that the false alarm of the attack behavior is reduced, and the analysis accuracy of the attack behavior is improved.

The invention belongs to the technical field of network security, and particularly relates to a multi-source network risk information fusion and risk assessment method, which comprises the following steps of: extracting nodes and edges of a real-time event through an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; calculating a random walk transition probability matrix of the edge, and calculating a time-sensitive personalized random walk value based on the random walk transition probability matrix; a graph neural network model is adopted for training, graph neural network embedding and prediction are carried out in combination with the features of the nodes, and the classification probability is output; and carrying out three-dimensional sub-graph segmentation on the predicted multi-source heterogeneous threat knowledge graph, constructing a mapping index, carrying out aggregation calculation to obtain a propagation path and path popularity of a high-risk node, analyzing a sub-graph evolution trend and carrying out early warning. The method is suitable for carrying out dynamic analysis and prediction on multi-dimensional attack risks, and trend attack analysis of the industry changing along with time is achieved.

The invention discloses an attack trapping and analyzing method and system based on a honeynet, and relates to the technical field of attack analysis, and the method comprises the steps: collecting attack interaction data and an associated attack chain trajectory set; dividing attack behavior units, and constructing a behavior space attitude matrix; constructing a two-dimensional behavior relationship graph, performing interpolation enhancement of sub-time granularity, and raising the dimension of the interpolated behavior node into a three-dimensional semantic space; performing attack path trend analysis on the attack behavior unit, and constructing an attack path bending rule model; and inputting parameters such as the attack chain trajectory set and behavior nodes in the three-dimensional semantic space into the attack path bending rule model, outputting a trapping response strategy, and dynamically adjusting the honeynet environment. According to the invention, the type and position of the honeypot can be automatically adjusted according to the attack behavior change, the structure definition and processing precision of the attack behavior data are effectively improved, and the attack behavior identification result can be conveniently and directly used for trapping strategy optimization.

An attack analysis device acquires a security log generated by a security sensor mounted on each of a plurality of electronic control units configuring an electronic control system, sets a log package in which a plurality of the security logs are packaged, estimates an attack received by the electronic control system based on the log package, and outputs attack information indicating the estimated attack.

The present invention discloses a state evaluation method and system based on network security, which relates to the technical field of network security and includes: obtaining at least one attackable path and obtaining an association set of network nodes; calculating the risk coefficient of historical security vulnerabilities and forming attack characteristics for historical security vulnerabilities; forming a danger threshold for the attackable path; evaluating the attack scale of a network attack based on the danger threshold of the attackable path to obtain an overall predicted scale; obtaining the emergency repair speed of network nodes and calculating to obtain an attack offset scale; when the overall predicted scale does not exceed the attack offset scale, it is determined that the network security is in a normal state, otherwise, it is determined that the network security is in an abnormal state. By setting a node analysis module, a vulnerability analysis module, an attack analysis module, an attack prediction module and a repair prediction module, an evaluation result that is more consistent with the actual situation can be obtained, and thus the evaluation result has strong reference value.

The invention relates to the technical field of network security, and discloses an attack analysis method based on a mysqldump connection characteristic honeypot, and the method comprises the steps: obtaining a simulation tool of a MySQL server; embedding an attack vector in the version information of the simulation tool, and constructing a honeypot server based on the simulation tool; in response to the fact that an attacker is connected with the honeypot server through mysqldump, obtaining version information returned by the honeypot server; obtaining multi-dimensional attack behavior data of the attacker based on the returned version information; and based on the multi-dimensional attack behavior data, analyzing the attack behavior of the attacker. According to the method, the attack vector is embedded in the version information by using the connection characteristic to attract an attacker, prevent the attacker from attacking a real system and strive for time for defense measures, and when the attacker attacks, multi-dimensional attack behavior data is obtained and analyzed, so that the attack analysis accuracy is improved, powerful support is provided for formulating an effective defense strategy, and the method is suitable for popularization and application. And defense capability is enhanced.

The application discloses a kind of deep fake detection and tracing systems for network phishing attack, including the following steps: multi-source data acquisition module is used to form pre-processing multi-source data;Feature extraction module is used to form associated feature data;Association graph generation module is used to build fake content association layer and phishing propagation association layer, form unified attack association graph;Path screening construction module is used to identify effective relationship section, and build calculation path set;Similarity calculation backwrite module is used to perform PathSim similarity calculation, form the unified attack association graph after state update;Iterative calculation update module is used to re-execute PathSim similarity calculation, form candidate association result;Back-checking analysis output module is used to verify based on fake evidence and propagation evidence, and convert the candidate association result after verification into attack analysis result.The application improves the accuracy of deep fake content identification in network phishing attack scenario.

An attack analysis device (100) includes an analysis priority changing unit (130) that, when a target device receives a target attack that is a network attack, changes an analysis priority corresponding to the target device on the basis of the content of the target attack, the target device being a device provided in an attack target system that is provided with a plurality of devices. Each of the plurality of devices is provided with an analysis priority. When a plurality of devices provided in a system to be attacked are set as a device group to be attacked, if each device included in the device group to be attacked is subjected to a network attack, the device group to be attacked is analyzed according to an analysis priority corresponding to each device included in the device group to be attacked. Network attacks for each device included in the attack target device group are sequentially analyzed.

This invention discloses a method for collecting evidence from control logic attacks on industrial controllers. The method primarily involves extracting PLC binary control application files by simulating the PLC's upload function; performing reverse engineering on the extracted binary files, including identifying the PLC binary's assembly instruction set architecture, performing disassembly analysis, identifying the PLC programming language, and generating an assembly log file; and performing attack detection, attack location, attack analysis, and attack recovery based on the generated assembly log file. This method effectively collects evidence from control logic attacks on industrial controllers without requiring PLC source code, plant behavior models, or any network traffic. The method can automatically execute the entire process within acceptable time and memory overhead.

The present invention discloses a method for rapid side-channel attack analysis of Dilithium, belonging to the technical field of information security. The Gaussian mixture difference method is used to detect leakage, and the detection and selection of feature points are completed; the signature information is used to classify the actual leakage involving the private key, and the difference in distribution is used to recover the private key in the normal domain. The present invention solves the problem of large time overhead in existing non-template attacks under small-sample leakage. Using the side information leakage generated by a small number of signatures, the complete private key can be recovered within a few minutes under a high noise level. Compared with existing leakage detection methods, the Gaussian mixture difference method can complete the detection and selection of feature points without obtaining sensitive intermediate values. The present invention can be used to detect whether the cryptographic device and cryptographic chip are safe and reliable, such as in the fields of bank cards in financial economy, digital currency physical cards, and mobile phone chips in mobile communication, to detect whether there are security risks in the device.

The invention relates to a dynamic displacement feedback attack and analysis method and device, and belongs to the technical field of multi-agent system control. The dynamic displacement feedback attack method comprises the following steps: acquiring a linear dynamic model of a target robot formation and a formation controller equation of the target robot formation constructed based on the linear dynamic model; intercepting a control vector sent by a first robot to a second robot in the target robot formation, and designing an attack vector for the control logic of the target robot formation based on the control vector, the incomplete dynamic model and the formation controller equation; and sending the attack vector to the second robot as a pseudo control vector. The invention provides a novel attack mode with relatively high attack precision, which is convenient for researchers to research the security of the multi-agent system.

The invention discloses a wireless network attack analysis method and system based on a large model prompt project. The method mainly comprises an offline stage and an online analysis stage. The offline stage mainly comprises the following steps: (1) constructing an attack knowledge base; and (2) constructing a prompt template. In the online analysis stage, the system periodically executes the following steps: (1) simulation data collection; (2) scene description generation; (3) template assembly is prompted; (4) large language model attack reasoning; (5) extracting parameters of the large language model; (6) simulating an attack result; and (7) updating the knowledge base and the template. According to the method, powerful context understanding, logical reasoning and common sense capabilities of a large language model are utilized to replace a traditional machine learning model, and automatic analysis of complex network attack behaviors in a large amount of simulation data is realized; the big language model reasoning output is converted into a structured attack result through the prompt project, so that the interpretability of attack analysis in a complex and changeable wireless network is greatly improved, and the overhead of manual analysis is remarkably reduced.

A system for securing patient data in IoT-enabled hospitals, consisting of: a network of IoT-enabled medical devices configured to collect and transmit patient data; a blockchain network in conjunction with the aforementioned medical devices, configured to create an immutable ledger of patient data transactions, implement smart contracts for access control, and maintain a decentralized log of data access attempts; an Artificial Intelligence and Machine Learning (AIML) module configured to: monitor blockchain activity for anomalous patterns, implement intrusion detection using machine learning algorithms, perform predictive analytics for threat detection, and execute natural language processing to identify personal data; a secure data block storage configured for: implementing PII data masking for sensitive patient information, maintaining the masked data utility for authorized users, and storing encrypted patient records; a malware detection module configured to detect unauthorized data manipulation attempts, identify exponential data propagation patterns, monitor system vulnerabilities, and track malware transmission behavior; and a defense framework configured to: implement compartmental epidemic modeling for attack analysis, calculate reproduction numbers for malware propagation, adapt security measures based on threat levels, and maintain version control of security updates.

This attack monitoring device 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 that analyzes a log of a first monitoring target 501 on the basis of a threat scenario to calculate the possibility of a cyber attack occurring; and an offload determination unit 124 that determines whether to cause a server-side attack analysis unit 222, which is installed in a server 200 outside of the vehicle V and analyzes a log of a second monitoring target 502 on the basis of the threat scenario to calculate an occurrence possibility of a cyber attack, to execute an offload of processing for the analysis of the log of the first monitoring target 501 by the vehicle-side attack analysis unit 122.

The embodiment of the invention provides a network attack processing method, system and device, a storage medium and a program product. In the process of performing security protection on the target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior can be obtained, an interception rule corresponding to the suspicious behavior is obtained according to the behavior data, and the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training the behavior data sample of the process corresponding to the historical network attack behavior, so that the attack analysis model can better master the knowledge of the network attack field. When the behavior data of the process with the suspicious behavior is analyzed, the attack analysis model can identify and judge the behavior of the process more accurately, so that an interception rule with higher confrontation is generated. Therefore, the potential security threats corresponding to the suspicious behaviors can be quickly and accurately processed, the risk of missing potential attacks is reduced, and the defense capability is improved.

To provide an attack monitoring apparatus, an attack monitoring system, and an attack monitoring method which enable cyber attack monitoring to be continued with an in-vehicle system with limited resources.SOLUTION: An attack monitoring apparatus 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 which analyzes a log of a first monitoring target 501 based on a threat scenario, to calculate the probability of occurrence of cyberattack; a server-side attack analysis unit 222 which is mounted on a server 200 outside the vehicle V and analyzes a log of a second monitoring target 502 based on the threat scenario, to calculate the probability of occurrence of cyberattack; and an offloading determination unit 124 which determines whether to offload the process of the vehicle-side attack analysis unit 122 to analyze the log of the first monitoring target 501.SELECTED DRAWING: Figure 2

Provided is a technology that enables highly accurate analysis of a cyber-attack against a vehicle. An attack analysis device (47) comprises a determination section (472, S102) which is configured to: determine whether correspondence information matches a pre-set type of the attack, in which correspondence information a system log that is a log of an electronic control system and a communication log that is a log of communications between the electronic control system and the outside of a vehicle are associated with each other; and determine whether an target element representing at least one of a component of the electronic control system and the electronic control system is being violated.

This application discloses a method and apparatus for handling risk events in encrypted traffic. The method includes: synchronously collecting network modality data and host modality data through an eBPF program assembly with multiple function entry points pre-deployed in the Linux kernel to obtain collected network events; transmitting the network events to a user-space receiver via the Perf Buffer data transmission mechanism to append a global high-precision timestamp and host identifier to the network events to obtain network traffic; generating a comprehensive risk score for the network events based on the network traffic, combined with a pre-trained bimodal deep learning model and a cross-modal attention fusion module; and triggering an alarm and writing the network event as a risk event into a graph database when the comprehensive risk score exceeds a preset threshold. Using this application, lateral movement attacks can be effectively detected and defended, improving the accuracy of encrypted risk detection and enabling users to gain a more comprehensive understanding of attack behavior, thereby enabling more effective attack analysis and response.

Embodiments of the present disclosure provide a cyber attack processing method and system, a device, a storage medium, and a program product. In the process of performing security protection on a target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior may be acquired, and an interception rule corresponding to the suspicious behavior is acquired on the basis of the behavior data, wherein the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training behavior data samples of processes corresponding to historical cyber attack behaviors, and therefore, the attack analysis model can better grasp knowledge in the field of cyber attacks. When analyzing behavior data of a process of the suspicious behavior, the attack analysis model can more accurately identify and determine the behavior of the process, thereby generating a more adversarial interception rule. Therefore, it is convenient to quickly and accurately process potential security threats corresponding to suspicious behaviors, the risk of missing potential attacks is reduced, and the defensive capability is improved.

An attack analysis device according to the present invention is provided with: an abnormality acquisition unit that acquires information relating to an abnormality of an in-vehicle device; a security event detection unit that detects a security event of the in-vehicle device; a distance acquisition unit that acquires a distance connecting a shortest path between an abnormal event occurrence location at which the abnormal event occurs and a security event occurrence location at which the security event occurs; and a determination unit that determines the relevance between the abnormal situation and the security event on the basis of the distance.

An attack analysis device includes attack abnormality relationship information indicating a relationship among (i) attack information indicating an attack possible to be received by an electronic control system, (ii) an estimation abnormality information indicating an abnormality estimated to be occurred when the attack is received, and (iii) commonized estimation abnormality location information indicating a commonized estimation abnormality location, which is a location of the abnormality estimated to be occurred when the electronic control system receives the attack and commonized between the electronic control system and a different electronic control system. The attack analysis device estimates an attack received by the electronic control system with reference to the attack abnormality relationship information.

The invention relates to the technical field of network security, in particular to a computer network security protection method and system.The computer network security protection system comprises a protection strategy construction module, an attack analysis module, a protection strategy switching module and an attack tracking module; identifying the latest attack by using an attack type identification model to obtain a specific attack type; the protection strategy switching module is used for correspondingly adjusting the protection strategy based on the attack type; the attack tracking module is used for tracking an attacker and notifying personnel to process; therefore, various protection strategies are preset, then type identification is carried out on the attacks, and after the specific type is identified, the corresponding protection strategy is directly switched to carry out network security protection, so that the diversity of network attacks is flexibly handled, and the reliability and security of computer network security are remarkably improved.

An attack analysis device configured to analyze an attack against an electronic control system constructed in a vehicle, the attack being against the electronic control system via a network is provided. The attack analysis device includes a determination section configured to determine whether correspondence information matches a preset type of the attack, the correspondence information being obtained by associating a system log that is a log of the electronic control system with a communication log that is a log of communication between the electronic control system and an outside of the vehicle, and determine whether a target element representing at least one of the electronic control system or a component of the electronic control system has been violated.

The invention relates to an APT (Advanced Persistent Threat) attack analysis technology based on LLM (Logical Language Model) and RAG (Random Access Gateway), which is used for automatically analyzing an APT attack detection result and generating an APT survey report in a natural language form. The automatic APT attack analysis system provided by the invention comprises the following three key subsystems: 1, a CTI information extraction system based on LLM intelligent agent structure alignment: using an atlas extractor and an atlas inspector intelligent agent to automatically construct a CTI atlas structurally aligned with a traceability graph from CTI according to a predefined mode; and 2, an RAG system based on a GNN retrieval model: using a graph similarity matching model to retrieve a CTI graph corresponding to the traceability graph. And 3, an APT attack analysis system capable of autonomously and dynamically planning a reasoning process is used, so that traceable and automatic APT attack analysis of the reasoning process is realized. The method can be used for network attack analysis including but not limited to APT attacks, and the efficiency and accuracy of network attack analysis can be effectively improved.

The invention discloses a security alarm method, device and equipment based on chain analysis and a medium, is applied to a security alarm system and relates to the technical field of network security, and the method comprises the following steps: constructing a target context object based on target data of a preset data source, and transmitting the target context object to a filtering node in an analysis link for data filtering, filtering to obtain a filtered object; determining data features of the filtered object, and sending the filtered object to a target analysis node corresponding to the data features in an analysis link for attack analysis to obtain an attack analysis result; and carrying out secondary attack analysis on the attack analysis result based on a preset analysis model, and pushing an obtained target processing result to a corresponding processing platform through an output node in an analysis link, so that the processing platform carries out corresponding security alarm or information pushing based on the target processing result. Therefore, it can be ensured that data of different types of processing nodes can be processed in time, and then alarm accuracy is ensured.

The application discloses a DDoS attack visual detection method based on multi-dimensional feature combination analysis, multi-dimensional traffic feature extraction, a lightweight attack detection model, DDoS attack knowledge graph construction, a graph-constrained attack behavior interpretation large model, attack visual detection display and the like to realize visual detection of network attacks. The application improves the visualization level and reduces the false alarm rate. The multi-dimensional feature combination method and the lightweight security detection model provide rich information for subsequent network attack knowledge graph establishment and professional interpretation based on a large language model. The constructed knowledge graph about network attacks can enhance the rigorousness of the thinking deduction of the large model and reduce the occurrence of model hallucinations. The enhanced large model can make more professional explanations and analyses on existing network attacks, thereby reducing the huge workload of manual attack analysis, and striving for a valuable time window for timely and accurate response to network attacks and deployment of defense.

An attack analysis device includes a storage device storing attack anomaly relation information indicating a relation among (i) predicted attack information indicating an attack predicted to be received by an electronic control system, (ii) predicted anomaly information indicating an anomaly predicted to occur when the electronic control system receives the predicted attack, and (iii) predicted anomaly location information indicating a location within the electronic control system where the predicted anomaly occurs. The attack analysis device is configured to: acquire a security log indicating (i) an anomaly detected in the electronic control system and (ii) a location where the anomaly is detected; acquire an indicator indicating an internal state and / or external state of the mobile object when the anomaly occurs; estimate the received attack based on (i) the security log, (ii) the attack anomaly relation information, and (iii) the indicator; and output the attack information indicating the estimated attack.

The invention belongs to the technical field of network security detection, and provides an artificial intelligence-driven network intrusion detection method, system and device. The method comprises the steps of multi-source metadata extraction and preprocessing, causal feature discovery and selection, meta learning detection model reasoning, known attack screening, causal comparative analysis and branch judgment, adaptive threshold adjustment and interpretable report generation. According to the method, initial parameters of three layers of MLP are optimized by adopting an MAML framework, so that the model can be quickly adapted only by a small amount of fine tuning in a zero-day attack and few-sample scene, and the limitation that traditional machine learning depends on a large number of historical samples is broken through; meanwhile, by constructing a baseline normal causal graph and an abnormal causal graph, adopting GED to quantify the similarity of the two graphs and accurately distinguishing zero-day attack and concept drift based on a preset threshold value, the industrial pain point that zero-day attack detection is difficult is solved, misinformation caused by concept drift is avoided, it is ensured that resources are only used for real attack analysis, and the detection efficiency is improved.