265 results about "Attack patterns" patented technology

The invention provides a network security penetration detection method and system based on artificial intelligence, and the method comprises the steps: firstly obtaining real-time network flow data containing multi-dimensional communication behavior records and protocol metadata of a target network system, and then extracting network behavior sequence features capable of describing communication behavior time relevance and a protocol interaction mode from the network flow data; inputting the network behavior sequence features into a pre-trained multi-modal threat prediction model, generating a potential attack vector prediction result containing an attack intention label, penetration path probability distribution and a threat level score, and dynamically verifying the potential attack vector prediction result based on a threat knowledge base, and finally, generating a self-adaptive defense strategy according to the penetration threat detection result, triggering defense interface deployment of a target network system, updating attack mode characteristics and a defense rule set of a threat knowledge base, and realizing intelligent and efficient network security penetration detection and defense.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention discloses a CAPEC vulnerability management system based on a large language model, and belongs to the technical field of network security. The system comprises three modules: a vulnerability-CAPEC dynamic mapping module jointly encodes vulnerability description and code context through a bimodal large language model, accurately associates vulnerability logic with a CAPEC attack mode in combination with comparative learning and knowledge graph construction, and breaks through semantic limitation of traditional rule matching; the adversarial repair code generation module is used for generating high-robustness repair codes through adversarial training and syntax tree verification by fusing CAPEC relieving suggestions and code features on the basis of the association result, so that the secondary vulnerability risk is remarkably reduced; and the full-process automatic verification and DevOps integration module performs multi-dimensional security verification such as symbolic execution, fuzzy testing and the like on the generated repair code, and deeply integrates a development tool chain to realize real-time pushing and closed-loop management of a repair scheme.

The invention relates to the technical field of AI protection, and discloses an AI protection engine construction method and system based on Web application. The method comprises the steps of obtaining a Web application HTTP request and performing semantic analysis to obtain request feature data; performing multi-dimensional threat feature extraction to obtain a Web request threat feature set; performing mode matching on the Web request threat feature set and a preset attack mode library to obtain a threat type judgment result and attack intention information; performing time sequence behavior analysis to obtain a Web behavior abnormal index; comprehensive decision making is carried out through a multi-agent collaborative decision making system, and a defense decision making scheme is obtained; according to the defense decision scheme, a corresponding defense component is selected through a defense execution engine for safety protection, and a Web request processing result is obtained. According to the method, corresponding protection measures can be taken aiming at requests of different risk levels, so that logic vulnerability attacks which are difficult to detect by a traditional system are effectively identified and defended.

The invention relates to the field of internet attack detection, in particular to a data security event real-time monitoring method and system, and the method comprises data collection, multi-modal fusion, threat detection, causal reasoning, dynamic response and feedback optimization. Compared with the traditional security analysis which depends on isolated data dimension or simple rule association, is difficult to capture a cross-data-source complex attack mode, and is faced with the limitations of low calculation efficiency, slow link traceability, storage access bottleneck and the like in mass data association analysis, the scheme integrates multi-source heterogeneous data into a dynamic association network through graph structure modeling, so that the security analysis efficiency is improved. Hidden association and behavior patterns among users, equipment and IPs are deeply mined by utilizing a GNN framework, the suspicious degree among entities can be accurately quantified, and hidden attack chains can be identified; and meanwhile, a hybrid storage architecture and a query optimization technology are adopted, so that a security analyst can backtrack a complex attack path in a second level while breaking through the bottleneck of large-scale graph data access performance, and the threat hunting efficiency and the high-level attack traceability are remarkably improved.

The invention belongs to the technical field of network security, and particularly discloses a network security knowledge graph construction and attack path prediction method, which comprises the following steps: acquiring an attack mode of network threat intelligence; constructing a network security knowledge graph based on the security vulnerability and attack pattern classification standard data and the attack pattern of the network threat intelligence; according to the method, an entity relationship in a network security knowledge graph is predicted based on a graph attention network GAT of text enhancement, an attack path is constructed based on the predicted entity relationship, and text enhancement is to introduce text information corresponding to entity nodes into a multi-head attention mechanism layer of the GAT. According to the method, the network security knowledge graph is constructed and the entity relationships are predicted based on the GAT, so that the entity relationships can be quickly integrated, the attack paths are constructed, the paths reveal security holes and attack modes which may be utilized by attackers, and accurate and efficient attack path prediction can be realized.

The invention relates to the technical field of industrial internet security and artificial intelligence crossing, in particular to an industrial production process APT attack detection method and system based on a knowledge graph, and the method comprises the steps: obtaining industrial production data, carrying out the preprocessing of the obtained industrial production data, and obtaining an APT attack detection result; the preprocessed industrial production data are used as input for dynamic construction of a knowledge graph, known attack mode reasoning is carried out based on the knowledge graph, the known attack mode reasoning comprises the steps that a known attack chain is recognized through multi-hop matching of graph embedding, a time sequence graph convolutional network and an attention mechanism are fused to detect unknown abnormal behaviors, and the known attack chain is subjected to known attack mode reasoning. Data fusion is performed based on the topological relation of the knowledge graph, an attack entry node, an associated entity and a propagation path are positioned according to a data fusion result, and real-time detection and traceability of the hidden attack chain are realized by constructing the equipment-protocol-data stream three-dimensional semantic dynamic knowledge graph and fusing a graph embedding technology and a graph convolutional network.

The invention discloses a network intrusion intelligent detection system based on a 5G network, and relates to the technical field of network security. Comprising a traffic anomaly detection and analysis module, a data encryption tampering detection module, an anomaly analysis and evaluation module, an attack prediction and prevention module, a dynamic isolation and protection module, a reverse tracking and tracing module and a redirection and isolation protection module. According to the system, more efficient and more accurate intrusion detection and threat defense can be realized in a 5G network environment by integrating a plurality of advanced technologies and intelligent modules. Compared with a traditional rule-based detection method, the system can adaptively learn and identify a new attack mode, and the detection capability for zero-day attacks, variant attacks and advanced persistent threats (APT) is enhanced. Besides, by combining deep learning and reinforcement learning algorithms, the system can predict potential attacks in a dynamically changing network environment and automatically optimize a defense strategy, and the response speed and accuracy of the defense system are improved.

The invention provides a network intrusion intelligent monitoring method and system based on deep learning, relates to the field of network security, and solves the technical problem of response lag of an existing defense method. The method comprises the following steps: collecting multi-source data; preprocessing the multi-source data to generate a spatial-temporal feature map; inputting the spatial-temporal feature map into a first model and a second model constructed based on a deep learning algorithm for anomaly detection to obtain a detection result; wherein the first model is used for detecting a known attack mode, and the second model is used for detecting an unknown attack mode; and carrying out hierarchical risk level division on the detection result, and carrying out active defense according to the defense strategy of each risk level. The method is used in the network intrusion monitoring and defense process, intelligent monitoring and active defense of network intrusion are realized through multi-source data acquisition, spatial-temporal feature map generation, dual-model cooperative detection and layered defense strategy implementation, and the real-time performance and initiative of network security protection are improved.

The invention discloses a network security early warning method and system based on artificial intelligence, and relates to the technical field of network security early warning and defense. According to the method, multi-dimensional intelligent analysis of network traffic and accurate identification of abnormal traffic modes are realized, the defense concealment is enhanced through a concealed channel coding technology, detection of attackers is avoided, internal association and evolution paths of attack modes are mined by using a dynamic knowledge graph and an attention mechanism, and the attack modes are accurately identified. The method improves the recognition and prediction capability of novel attacks and advanced threats, optimizes a camouflage strategy, combines a lightweight encryption algorithm and distributed execution nodes, efficiently deploys defense actions, evaluates the attack mitigation effect in real time through a support vector machine, dynamically adjusts a defense strategy, achieves the quick recovery of a network state, and achieves the stable operation. And the real-time performance and the automation level of safety response are obviously improved.

The invention relates to the field of network security, and provides a security event tracing and response method and system based on an LLM intelligent agent, and the method comprises the steps: collecting log information from network equipment, and extracting a security event with a high threat degree in the log information; identifying an attack mode of the security event based on LLM, and generating a response strategy including atomization operation steps according to the identified attack mode; the natural language instruction in the response strategy is converted into a tool calling instruction through the intelligent agent, and related tools are called to execute specific operation. By constructing an LLM-driven intelligent decision-making body, full-process automation from event analysis to response execution is achieved, the LLM deep reasoning ability and a safety tool chain are innovatively and deeply fused, an unstructured log is converted into an executable disposal scheme through the semantic understanding ability of the LLM deep reasoning ability, and the processing efficiency is improved. And designing a multi-stage reasoning framework of attack mode analysis-target decomposition-tool matching, and supporting dynamic generation of a customized response scheme conforming to an enterprise strategy.

Embodiments of a cyberattack monitoring system are disclosed to identify successful attacks on a service based on benign activities of the attacker performed after the initial attack attempt. In embodiments, the system identifies the initial attack by matching client actions to known attack patterns. Clients observed with attempted attacks are remembered as suspected attackers. The system will then monitor subsequent actions of suspected attackers for signs that the initial attack attempt was successful. In embodiments, a successful attack is recognized when the system observes one or more subsequent benign actions by the suspected attacker. In embodiments, the presence of follow-on benign actions is used as a filter to filter out unsuccessful attacks and false positives detected by the system. The filtering enables the system to better focus system resources and human attention on a small set of client activities that are likely successful attacks.

The invention provides a network traffic data security assessment method and system based on deep learning. The method comprises the following steps: converting original network traffic data into a graph structure data set comprising a topological structure, node attributes and time sequence behaviors; in the process, the time-space fusion input tensor is formed through the association strength between adjacent matrix and Laplacian matrix coding network entities and the fusion of time sequence characteristics extracted by time window slices. Compared with traditional flow analysis which only pays attention to a single protocol or a rate threshold value, the method achieves global relevance expression of network behaviors through graph structure modeling. Through graph structure modeling, multi-dimensional feature fusion and probabilistic risk assessment, the method can adapt to dynamic change of network topology and continuous evolution of an attack mode, so that a final assessment result is more accurate.

The invention relates to the technical field of network security, in particular to a non-cooperative network attack tracing method based on multiple stages. The method comprises the following steps: providing security verification for network equipment and a terminal in a traceability process based on a collaborative authentication code, and ensuring credibility and integrity of the traceability process; converting the network attack into behavior feature data based on the feature extraction of the attack behavior; extracting event-level features, revealing a sequential relationship and a dependency relationship of attack behaviors, and identifying a potential attack mode; performing time alignment on the events by using causal analysis to form a standardized causal chain; performing multi-dimensional feature fusion in combination with a Transform network and an NLP pre-training model, and identifying an attack mode; an IP address database, a self-built organization library and a code author library are combined, and a multi-cascade CNN structure is adopted to carry out attack source positioning and attacker tracing. According to the invention, through multi-level feature analysis, accurate identification and traceability of complex network attacks are realized.

The invention discloses a lightweight hopping key encryption system based on a national cryptographic algorithm, relates to the technical field of data communication encryption, and solves the problem that an initial key and a hopping key are difficult to generate; a key hopping mode is difficult to analyze so as to detect an abnormal state; intelligent contract automatic key management is difficult to carry out; plaintext data is difficult to encrypt according to the analysis security index; the data verification index is difficult to analyze for data verification after the hopping key is decrypted; the operation state is difficult to monitor in real time to detect an attack mode; and the defense capability and the key hopping validity are difficult to assess, and the overall security assessment value is difficult to assess. According to the method, the state cryptographic algorithm is applied, the hopping key mechanism is combined, the key hopping rule is automatically executed by using the intelligent contract, and the overall security assessment value is comprehensively assessed by monitoring the running state.

The invention relates to the technical field of network security monitoring scheme design based on computing power, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: collecting network traffic, system logs and user behavior data; dynamically distributing CPU / GPU computing power according to network flow, attack frequency and the like; performing cleaning and format conversion on the data; intrusion detection, vulnerability scanning and traffic anomaly analysis are executed through multi-task parallel processing; a potential attack mode is mined in combination with deep learning model and rule engine association analysis; and judging threats according to a preset rule base and triggering early warning. According to the method, the resource utilization rate is improved through intelligent computing power scheduling, the threat recognition capability is enhanced in combination with deep learning and rule double engines, the method can adapt to a complex network environment, the threat detection accuracy is 98.7% according to actual measurement display, the resource occupation is reduced by 30%, and the method is suitable for high-concurrency scenes such as a cloud platform and the Internet of Things.

Systems, methods, and frameworks for detecting malicious WebAssembly (Wasm) modules under source code obfuscation are provided. The system is configured to accurately identify malicious behavior in Wasm modules irrespective of the specific malicious functionality and in the presence of source code obfuscation techniques. The detection process leverages a Vision Transformer (ViT) model to classify a Wasm module as benign or malicious, enabling robust identification of threats across diverse attack patterns. The system operates with substantially low runtime overhead on computing resources, making it suitable for integration into real-time web application environments.

Aspects of the disclosure relate to a network traffic monitoring platform. The platform may train an attack pattern analysis model to output a behavior profile and a cumulative attack score. The platform may identify a password failure rate spike. The platform may extract a password hash from the network traffic. The platform may generate the behavior profile based on the password hash. The platform may generate the cumulative attack score based on the behavior profile. The platform may compare the cumulative attack score to a threshold. Based on identifying that the cumulative attack score is below the threshold, the platform may identify the password hash as a secure hash. Based on identifying that the cumulative attack score meets or exceeds the threshold, the platform may and generate password complexity rules. The platform may refine the attack pattern analysis model based on the attacked hash and the cumulative attack score.

The invention discloses a power distribution network protection resource dynamic allocation method, system and device and a storage medium, and relates to the field of power system network security protection, and the method comprises the steps: collecting the operation data of a power distribution network in real time, constructing a multi-dimensional fusion data set, and predicting a potential attack path through an attack path prediction model in combination with a historical attack mode library; performing risk assessment on the predicted potential attack path, and calculating the protection resource demand quantity of each region of the power distribution network in combination with the topological structure of the power distribution network and the importance of key nodes; according to a risk assessment result, dynamic allocation and real-time scheduling of protection resources are realized in combination with a resource constraint condition; the method can grasp the operation of the power distribution network in real time, accurately predict the potential attack path, accurately evaluate the risk and calculate the protection resource demand. Dynamic allocation and real-time scheduling of protection resources are realized, the resources are reasonably utilized, the cost is reduced, the protection effect is improved, and safe and stable operation of the power distribution network under complex network attacks is ensured.

The present invention discloses system and method for adaptive deception orchestration is disclosed. The system comprises a dummy asset generation module configured for generating dummy assets upon receipt of defined organizational data from an organization server, a dockerized container creation module configured for generating a plurality of virtual system groups, a virtual private machine client-server communication module configured for establishing a plurality of virtual private networks (VPN) in the plurality of virtual system groups, to provide a secure communication channel, a cyber-attack path orchestration module configured for orchestrating one or more cyber-attack scenario based on a plurality of historical behavioural patterns, an adaptive camouflaging module operatively configured for transferring system logs at a predetermined time interval by masking a chatting application and an intelligence accumulation module operatively connected to the adaptive camouflaging module configured for generating an attack pattern based on the analysis of the system logs.

The invention discloses a heterogeneous atlas-based network attack path prediction method and device and a medium, and relates to the technical field of network security, and the method comprises the following steps: collecting multi-source heterogeneous data, extracting basic entities and relationships to generate structured data, defining nodes and relationship types by using a TPP framework, and generating a real-time heterogeneous atlas by using a dynamic update mechanism; based on the real-time dynamic heterogeneous atlas and the multi-source heterogeneous data, generating an attack association feature matrix, extracting potential threat features through feature fusion, mining attack association paths, and generating an attack path candidate set; constructing a quantum field game model based on the attack path candidate set, generating an evasion path set in combination with a quantum tunneling effect, quickly adapting to attacks through dual variational optimization, and generating a final attack path prediction result and a confidence score; according to the method, the game confrontation model is constructed through the attack path candidate set, and the optimal defense strategy can be quickly found in the face of continuously changing attack modes.

A threat behavior detection method based on a fuzzy enhanced polynomial neural network comprises the steps of combination of fuzzy C-means clustering and the polynomial neural network, design of an adaptive optimization mechanism, introduction of an entropy activation function, realization of dynamic edge weighting and fuzzy enhanced feature extraction. And a self-adaptive optimization algorithm for threat behavior detection is designed. According to the method, the efficient threat behavior detection model is constructed by designing the adaptive fuzzy enhanced polynomial neural network, precise recognition of complex threat modes in network traffic is realized, and the detection precision and efficiency are effectively improved. In addition, through generation of the fuzzy rule, visualization of the thinking process of the neural network is realized, and transparency and interpretability of the system are improved. Compared with a traditional method, the method has more advantages in the aspects of detection accuracy and adaptability, the recognition capability on a complex attack mode is improved, and the method is suitable for different network environments and is suitable for threat detection scenes in complex network traffic.

The invention discloses an efficient cascade multi-stage self-adaptive threshold fishing detection method, and provides a cascade multi-stage self-adaptive threshold fishing detection framework aiming at the problems of insufficient anti-robustness, insufficient multi-mode collaboration, unbalanced detection efficiency and precision and the like in the existing fishing detection technology. In the first stage, millisecond-level primary screening is achieved through a lightweight single-mode detection model, and 80% or above of low-level threats are intercepted; and in the second stage, a multi-modal fusion model with high anti-interference capability is adopted, the anti-robustness is improved by combining frequency domain feature enhancement and a dynamic noise injection technology, deep correlation features are mined through a cross-modal attention mechanism, and accurate recognition of complex phishing attacks is realized. And meanwhile, an online learning module is integrated, so that the system continuously adapts to a novel attack mode, and finally, the high-precision, low-delay and strong-anti-interference detection capability is achieved.

Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system / process / computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.

A system includes a machine learning network input interface configured to receive input data from a sensor, one or more processors collectively programmed to receive an input data from the sensor, wherein the input data is indicative of image of a scene that includes a perturbation from a black-box attack with a physical perturbation at the scene, display an adversarial pattern at the scene, determine an objective function utilizing at least the adversarial pattern and a target classification of the machine-learning network, randomly select a plurality of data points associated with the adversarial pattern and the objective function, wherein the data points are associated with a number of queries of the objective function, obtain a machine-learning model output utilizing the data points displayed in the scene, and in response to meeting a criteria associated with the adversarial pattern and model output, identify a successful attack pattern.

The invention provides an attack technique clustering and attributing method for attack modes, and relates to the technical field of network security. The attack technique clustering and attributing method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate a triple, and fusing the triple with a network security knowledge graph to obtain TTPs data; clustering TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; and constructing attack trees based on a soft clustering result, carrying out weight distribution based on an attention mechanism, and carrying out matching on the attack trees in the knowledge graph based on a similarity calculation method to obtain an attribution result. According to the method, a complete attack behavior attribution implementation framework is provided, the advantages of the frontier technology are combined, and efficient, accurate, reliable, extensible and high-interpretability attribution can be achieved.

The embodiment of the invention discloses an authority hierarchical control method based on dynamic desensitization and real-time monitoring and an operation and maintenance bastion host system.According to the embodiment of the invention, by integrating a database firewall and a dual-mode desensitization engine and combining authority hierarchical control and real-time semantic analysis, the data security and operation compliance in an operation and maintenance scene are remarkably improved, and the operation and maintenance security is improved. The dynamic desensitization rewrites a query statement in real time according to a user role, and limits exposure of original data; static desensitization is performed to pre-generate an isolated copy, so that direct access to a production library is reduced; based on semantic analysis and a rule engine, the response time is shortened to be within 1 second; the static desensitization library supports direct use of development and testing, and the permission application process is reduced; a rule base is dynamically updated through an Attention-GRU-Adaboost model, and the adaptability to a novel attack mode is improved.

The invention discloses a graph structure-based domain penetration attack path generation method, which belongs to the technical field of network security, and comprises the following steps of: constructing a multi-level relation graph comprising a host node, a service node and a user node through automatic detection by taking any host in a domain as a starting point; assigning a weight attribute to the atlas edge based on a vulnerability library and an attack pattern library; an improved heuristic graph search algorithm is adopted, all feasible attack paths and threat scores thereof are generated by integrating the path length, attack difficulty and permission improvement effect, and the problem that the threat scores of all the feasible attack paths are influenced in various scenes and dynamic change domain environments is solved. The technical problems of realizing comprehensive automatic penetration testing, accurately identifying potential attack paths and establishing a systematic threat assessment mechanism are solved, the automation, intelligence and high-efficiency level of domain penetration testing is remarkably improved, and the method has good adaptability, expansibility and practical value and is suitable for popularization and application. And attack path discovery and risk early warning work in a dynamic network environment with high security requirements can be effectively supported.

The invention belongs to the technical field of intrusion detection, and discloses an industrial Internet of Things intrusion detection method based on time sequence clustering. An intrusion detection model based on TCN-GRU-Temporal Attention is provided, and the model combines the advantages of long and short term memory processing, dynamic feature capture and key information focusing, and is especially suitable for processing complex time sequence tasks. A multi-dimensional time sequence clustering algorithm based on an evaluation index is provided, k-medoids clustering edge nodes based on DTW are used, and the intrusion detection accuracy and the system response speed in a federated learning environment are improved. The industrial network intrusion detection method provided by the invention also shows good performance under non-independent identically distributed data, and effectively improves the recognition capability for complex attack modes.

The invention discloses a computer information security processing method and system based on big data, and the method comprises the following steps: S1, collecting data generated in a computer operation process, and carrying out the data cleaning and standardization processing; s2, a deep learning-based threat feature extraction model automatically learns and extracts potential attack modes and behavior features through training data; s3, implementing continuous monitoring of user and system behaviors, and identifying suspicious behaviors of abnormal login and data access; s4, establishing a dynamic risk assessment model, and updating the risk assessment model according to the newly occurring threat case; and S5, generating and executing corresponding defensive measures, and automatically repairing vulnerabilities and triggering an alarm notification by isolating infected equipment and blocking malicious traffic. According to the method, the protection capability of computer information security is enhanced, the coping efficiency of security events is also improved, and a powerful guarantee is provided for information security in a big data environment.