40 results about "Attack response" patented technology

The invention relates to the technical field of cloud computing, in particular to a network data encryption and privacy protection system in a cloud environment, which comprises a key management unit driven by a wolf pack algorithm, an encryption algorithm optimization unit, a privacy protection strategy dynamic adjustment unit and a safety monitoring and abnormity response unit. The invention discloses a cloud environment network data encryption and privacy protection system constructed based on a wolf pack algorithm. High-security keys are dynamically generated and distributed through a key management unit, security performance and resource consumption are balanced through an encryption algorithm optimization unit, multi-target dynamic gaming and compliance guarantee are achieved through a privacy protection strategy unit, distributed attack detection and cooperative defense are completed through a security monitoring unit, and the security performance is improved through a cooperative feedback mechanism between the units. Intelligent encryption protection, dynamic strategy adjustment and efficient attack response of the full life cycle of the data in the cloud environment are realized, and the system security, the resource utilization rate and the compliance capability are remarkably improved.

A computer implemented method of evaluating attacks on a first large language model (LLM). The method comprises: inputting attack data to the first LLM; receiving attack response data from the first LLM in response to the inputted attack data; inputting the attack response data to a second LLM configured to evaluate LLM attack response data; and receiving an evaluation of the attack response data from the second LLM.

The invention discloses a quantum key dynamic management method and system of a power wireless communication network. The method comprises the following steps: constructing a three-level service security model: dividing power services into high, middle and low three-level security levels, and differentially configuring key basic parameters; secondly, proposing a dynamic key updating algorithm, adjusting a key updating period and a quantum key window in real time based on a communication state and a flow load, and dynamically expanding the updating period and the size of the key window according to the change of throughput; and finally, setting an attack response strategy, automatically shortening an update period and enhancing key strength when an anomaly is detected, and improving the security of a power wireless communication scene. According to the quantum key dynamic management method disclosed by the invention, the problem of security risk caused by the fact that a traditional fixed quantum key update period cannot meet the communication state of a power wireless communication network and the real-time change of traffic load is solved.

The invention discloses a cloud side-end cooperative multi-scene adaptive network intrusion detection method, and solves the problems of poor scene adaptation, weak dynamic processing, privacy-precision imbalance and the like in the prior art. The method is realized through four steps: 1, multi-scene traffic collection and hierarchical preprocessing, terminal sensing layer optimization frame processing and traffic classification, edge layer screening of high-value traffic, and cloud fragmentation scheduling; 2, multi-scene adaptive feature fusion is carried out, scene exclusive features and general features are extracted, and 50-dimensional feature vectors are generated; 3, a cloud edge-end collaborative detection model and an edge lightweight model are preliminarily screened, a cloud federal fusion model is finely detected, and dynamic weight and differential privacy are combined; 4, dynamic attack response and model iteration are carried out, attacks are responded in a scene mode, and the stability of the model is guaranteed through anti-forgetting optimization. According to the method, multiple scenes are covered, the detection precision is larger than or equal to 98.5%, the edge delay is smaller than or equal to 40 ms, the privacy leakage risk is reduced by 90%, the renaturation is high, and the robustness is high.

The invention relates to the technical field of network security, and discloses an SDN (Software Defined Network)-based large-scale host vulnerability identification and attack response simulation method, which comprises the following steps of: 1, creating a network topology through a Mininet script; the method comprises the following steps of: 1, acquiring a host vulnerability identifier, 2, configuring vulnerability attributes for the host by using a JSON format in an SDN network environment, and 3, based on the host vulnerability identifier, selecting a corresponding attack strategy and executing a simulation attack, monitoring network flow and a host state in real time through an SDN controller, identifying an abnormal behavior and triggering a response mechanism. According to the method, the vulnerability attribute in the JSON format is configured for each host node, and an attacker is supported to detect and position the target host based on specific vulnerability characteristics by utilizing the centralized analysis capability of the SDN controller, so that the simulation capability of a network security simulation environment to a real attack scene is remarkably improved; the limitation that a traditional method is difficult to reflect vulnerability details is solved.

The invention relates to an attack detection and elastic control method for a multi-vehicle cooperative system. The method comprises the following steps: step 1, initializing; step 2, prediction: at the moment t, according to the state ellipsoid set epsilon t and the shape matrix Qt, solving a prediction ellipsoid set epsilon t + 1t; step 3, inter-vehicle communication attack detection: judging whether inter-vehicle communication is attacked at the moment t, if not, executing the step 4, and otherwise, executing the step 6; step 4, measurement updating: at the t + 1 moment, solving a minimum ellipsoid set # imgabs0 # and measuring and updating an ellipsoid set epsilon t + 1; step 5, sensor attack detection: at the t + 1 moment, judging whether the sensor is attacked according to an intersection set of epsilon t + 1t and # imgabs1 #, if the intersection set is empty, executing the step 6, otherwise, executing the step 2; step 6, elastic control: according to the attack response, respectively replacing the attacked ellipsoid sets, and respectively carrying out measurement updating and prediction processes at the t + 1 moment; and step 7, repeating the steps 2-6 until the end. Compared with the prior art, the method has the advantages of reducing network attack influence and the like.

The invention discloses an intelligent protection switching method, system and device for DDoS attacks and a medium, and the method specifically comprises the steps: obtaining DDoS attack alarm information through a multi-source data collection interface, and constructing a multi-dimensional attack knowledge graph based on a graph database; based on the multi-dimensional attack knowledge graph, verifying the causal relationship between protection actions and business indexes by adopting a double difference method, calculating the contribution degree of each protection measure to business recovery through a Bayesian network, and constructing a protection effect attribution model; generating a protection strategy set in a three-dimensional decision space by adopting a multi-objective optimization algorithm based on a confidence evaluation result of the protection effect attribution model; and based on the protection strategy set, docking a multi-cloud platform protection resource API interface, dynamically scheduling high-defense packet resources based on a Q-learning reinforcement learning algorithm, and executing cross-cloud traffic traction and cleaning service switching. According to the method, the timeliness and effectiveness of DDoS attack response are improved, the protection response speed is increased, and the influence of attacks on services is effectively reduced.

The invention provides a honeypot attack response method and device based on a large model, and the method comprises the steps: constructing an attack response prompt word based on a current attack command, and a historical attack interaction data set and a historical honeypot system state set under a current attack round; and generating an attack response result based on the large model application attack response cue word, and updating to obtain a historical attack interaction data set and a historical honeypot system state set of the next attack round based on the attack response result of the current attack round. According to the method provided by the invention, through the current attack command, the historical attack interaction data set and the historical honeypot system state set, the attack response cue word is constructed, the attack response cue word is applied based on the large model, and the attack response result is generated, so that the traditional attack-response processing operation is converted into'question and answer 'text interaction based on the large model; the intelligence and verisimilitude of the attack response result are greatly improved, so that the honeypot can be more suitable for the current complex attack technique.

The invention discloses a network security attack coping method based on a generative large model, and relates to the technical field of network security, and the method comprises the steps: obtaining metadata: automatically obtaining network security basic knowledge and network security attack technique data, and forming a knowledge base; classifying and labeling the metadata, namely automatically classifying and labeling network security basic knowledge and network security attack technique data; establishing a security model: constructing a network security analysis model, and cleaning malicious data and error data; model training is executed, wherein training and fine tuning are carried out on network security data; and performing evaluation feedback for coping with network security attacks. According to the method, the automation level and efficiency of network security analysis are improved, the manual analysis cost is reduced, the model can adapt to continuously evolved network security threats through continuous learning and optimization, and more intelligent and reliable technical support is provided for network security protection of a power system.

The invention relates to a computer-implemented method of evaluating an attack on a first large language model (LLM). The method comprises the following steps: inputting attack data into the first LLM; receiving attack response data in response to the input attack data from the first LLM; inputting the attack response data to a second LLM configured to evaluate LLM attack response data; and receiving an evaluation of the attack response data from the second LLM.

The invention relates to the technical field of power information physical system security, and discloses a power transmission system attack scene identification method considering information physical interaction. Constructing a DAD attack and defense model, generating a plurality of typical attack scenes, and collecting historical load data, attack schemes and defense schemes; training is carried out through a classification network, and a mapping relation from a system operation state to a corresponding worst attack response is learned; optimizing network parameters by adopting a gradient descent method, and introducing a Lagrange function and an information physical coupling penalty term; after training is completed, attack scene prediction is carried out; taking the minimum expected loss of the system as an optimization target, and passing through the Camp; and carrying out iterative solution on the CG to obtain an optimized defense resource configuration scheme. According to the method, through a multi-stage collaborative optimization strategy, TCPS toughness improvement under the cyber-physical collaborative attack is realized, it is ensured that the system can quickly respond and recover when facing a dynamic attack environment, and the stability and security of the whole system are enhanced.

The invention relates to the technical field of network security, in particular to an IPv6 network DDoS attack detection and defense system based on deep learning, which comprises a flow monitoring and data acquisition module, a preprocessing and feature extraction module, a deep learning attack detection module, an attack response and decision module and a defense execution and feedback module, the method comprises the following specific steps: S1, monitoring traffic in an IPv6 network in real time through a traffic monitoring and data acquisition module, and capturing traffic characteristics; s2, cleaning and preprocessing the collected original traffic data by a preprocessing and feature extraction module, and extracting key features related to the DDoS attack; according to the IPv6 network DDoS attack detection and defense system based on deep learning, abnormal traffic can be rapidly identified through the deep learning model in the system, timely response can be ensured when a DDoS attack occurs, real-time performance is ensured, a defense strategy can be automatically adjusted through the defense execution and feedback module, manual intervention is not needed, and the intelligent degree of defense is improved.

The present application relates to the field of network security technology, and in particular to a network attack defense method, apparatus, device and storage medium, which are used to solve the problem of poor network attack response and defense in related technologies. The method is: collecting data to be detected through multiple honeypot nodes deployed in a target network, a single honeypot node is a protection device deployed for a business server or business equipment in the target network, and a single data to be detected includes behavior data of an interacting party interacting with the corresponding honeypot node; based on the graph structure features of multiple honeypot nodes obtained by feature extraction of each data to be detected, malicious detection is performed on the behavior of the interacting party interacting with the multiple honeypot nodes, thereby effectively improving the accuracy of network attack detection. When maliciousness is detected, the first interacting party interacting with the honeypot node is determined to be the attacker, and a defense mechanism is activated to block the attacker's network attack, effectively improving the attack response speed and defense efficiency.

The invention provides a firewall policy generation method and device, equipment, a medium and a program product, and relates to the field of financial science and technology or the field of big data. The method comprises the steps that asset information and calling relation data of a service system are obtained, a network flow logic model is generated based on the asset information and the calling relation data, and the network flow logic model comprises a topological structure model used for describing the interior of the service system and a communication link between the service system and an external system, generating a firewall policy according to the network flow logic model; the firewall policy refuses access of all IPs to a specified port of the database by default, and the recorded specific IPs are released only through a white list; according to the method, the automation level of strategy configuration and the attack response speed are improved, so that the real-time defense requirement is efficiently met.

The invention provides a verification method of network security equipment, and relates to the technical field of computer software, in particular to the technical field of security verification of network security, traffic detection and network traffic analysis. According to the specific implementation scheme, an attack request script and an attack response script are generated according to alarm data of network security equipment, and the attack response script is sent to an attack response simulator; an attack request is constructed based on the attack request script, the attack request is sent to an attack response simulator, and the attack response simulator is configured to receive the attack request, perform matching with the received attack response script according to the attack request, construct an attack response according to a matching result and return the attack response; obtaining attack simulation time sequence data according to the received attack request and the received attack response; and verifying the validity of the network security equipment based on the alarm data and the attack simulation time sequence data.

The present invention proposes a method and system for priority asynchronous processing in network security. By integrating multiple data sources, it can evaluate the threat level of each data packet in real time and dynamically adjust its processing priority accordingly. Different from traditional static methods, the present invention utilizes advanced machine learning algorithms to conduct dynamic evaluations in multiple dimensions, promptly identify high-risk data packets and process them with priority. This mechanism significantly improves the system's response ability to new and complex attacks. At the same time, the present invention also introduces a multi-node collaborative attack response mechanism. When an abnormal traffic is detected by a certain node, it can automatically notify other nodes and share threat scenario information, so as to achieve a rapid collaborative response. This integrated innovation not only enhances the overall security of the network, but also optimizes the data packet processing efficiency, effectively solving the main defects in traditional network security systems and providing new ideas for building a more secure and flexible network environment.

This invention discloses a network threat response system based on multi-agent cooperation, comprising: a trace configuration agent for generating behavioral configuration chains; a configuration aggregation module for generating threat configuration clusters; a trajectory inference agent for generating a threat trajectory grid; a resonance modeling module for executing a pulse-constrained resonance aggregation algorithm to form a threat intent resonance network; a probe pulse agent for executing cooperative probe pulses to form a cooperative probe pulse record set; a response graph generation module for generating an attack response graph; a resonance adjudication agent for constructing an attack relationship graph and executing an improved Tarjan algorithm, introducing a pulse resonance adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set; and a response execution module for executing network threat response based on the minimum blocking node set. This invention achieves efficient network threat response through the pulse-constrained resonance aggregation algorithm and the improved Tarjan algorithm.

This invention discloses a device terminal identification method for RIS phased array network deployment, relating to the field of terminal detection. The method includes: Step S1: collecting an initial feature set of the target identification terminal and monitoring abnormal attack behaviors suffered by the target identification terminal; Step S2: constructing a local outlier method to screen out effective attack behaviors and labeling a composite feature set; Step S3: constructing a machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set, and labeling the final result as a correlation scalar; Step S4: setting a dynamic threshold strategy for the correlation scalar to determine whether the target identification terminal needs to be re-identified. This invention, by continuing to monitor potential abnormal attack behaviors during the initial attack response lag period and introducing a local outlier detection method to capture dynamic changes in real time, has the advantages of ensuring that RIS phased array network terminals are only re-identified for influential attack behaviors and improving the accuracy of identifying potential secondary attacks.

The invention discloses a dynamic HQoS-driven deterministic network potential safety hazard real-time response method and system, and belongs to the technical field of data communication networks, and the method comprises the steps: obtaining flow data, and building a deterministic service baseline; and selecting the flow data exceeding the deterministic service baseline for analysis, and outputting and marking a threat level. And monitoring the marked flow data, and after the data is recovered, recovering the original resource configuration according to the gradient and marking. And constructing a dynamic HQoS strategy and synchronously executing attack response and service recovery based on the dynamic HQoS strategy. According to the method, the traffic data are detected and analyzed, when a security problem occurs in a deterministic network, potential safety hazards can be detected in real time, degradation, speed limiting and isolation processing are carried out according to the detected threat level, and the service quality of key services is ensured. The dynamic HQoS can directly trigger the adjustment of the resource scheduling strategy according to the security detection result, so that the network adaptability is enhanced while the limitation of static resources is overcome.

To provide a cyber attack countermeasure support system, method and program for designing an appropriate countermeasure against a cyber attack.SOLUTION: A cyber attack countermeasure support system 1000 designs countermeasures against a cyber attack on a predetermined target system. The cyber attack countermeasure support system comprises: a storage unit 120 that stores one or more attacker profiles 122 including an attack purpose and attack technique of an attacker performing the cyber attack, and one or more defender profiles 123 including a defense purpose and defense technique of a defender performing defense against the cyber attack; and a countermeasure design unit 111 that uses a system model 121 for reproducing a state of the target system and outputting index values of one or more indices indicating a performance of the target system corresponding to the state of the target system to design a countermeasure for each of combinations of the attacker profiles 122 and the defender profiles 123.SELECTED DRAWING: Figure 1

The present application relates to the technical field of digital twinning, in particular to a disease control center network elasticity evaluation and attack adaptive response system based on digital twinning. It comprises: a digital twinning modeling unit for constructing a digital twinning model containing a business-network correlation matrix and a business tolerance threshold; an elasticity evaluation unit for generating the elasticity coefficient of each network node or link; an attack detection unit for monitoring attacks and generating an alarm containing the attack type; a response strategy generation unit for generating a candidate response strategy according to the attack type and the elasticity coefficient; a strategy evaluation and admission unit for simulating the execution of the candidate strategy in the twinning model, calculating the business interruption risk index, and allowing deployment to the physical network when the preset risk threshold condition is met. The system realizes multi-dimensional quantitative evaluation of network elasticity through a digital twinning model, and guarantees the continuous operation of disease control business during the attack response process through a strategy simulation admission mechanism.

A deception as a service (DaaS) system configures a decoy to generate a decoy instance, and projects the decoy instance into a user network. The DaaS system receives, by the decoy in the deception system, from an edge point in the user network, an attack request on the decoy instance by an attacker, generates an attack response by the decoy based at least in part on the attack request; and sends the attack response to the attacker. The attack response may include erroneous information, such as a lure file or lure credentials.

The invention relates to a diagnosis service attack test method and system based on a vehicle control local area network. The method comprises the following steps: sending a specified diagnosis message to at least two physical identities based on a vehicle control local area network, and effectively screening out a target identity capable of executing a diagnosis protocol based on all specified response messages corresponding to the specified diagnosis message; sending attack messages corresponding to the basic diagnosis service to the target identity label according to a preset frequency based on the whole vehicle control local area network, and determining attack response messages and attack delay time corresponding to the attack messages so as to expect to find possible vulnerabilities of the vehicle in advance; according to the method, the attack score of the target identity label is determined based on all the attack messages, all the attack response messages and all the attack delay time, and the attack test result of the target identity label is obtained based on the attack score, so that the vehicle can be rectified in time based on the attack test result, and the safety and stability of the whole vehicle are guaranteed.

The application relates to the technical field of power information physical system security, and discloses a power transmission system attack scene identification method considering information physical interaction. A DAD attack and defense model is constructed, a plurality of typical attack scenes are generated, historical load data, attack schemes and defense schemes are collected; a classification network is trained to learn the mapping relationship between the system operation state and the corresponding worst attack response; a gradient descent method is used to optimize the network parameters, and a Lagrange function and an information physical coupling penalty term are introduced; after training, attack scene prediction is carried out; taking minimizing the expected loss of the system as an optimization objective, the optimized defense resource configuration scheme is obtained through iterative solution of C&CG. Through the multi-stage collaborative optimization strategy, the TCPS resilience under the information physical collaborative attack is improved, the system can quickly respond and recover when facing a dynamic attack environment, and the overall system stability and security are enhanced.

The invention relates to the technical field of honeypot defense, in particular to a honeypot response data generation method based on a real service mirror image and a honeypot defense system. The honeypot response data generation method comprises the following steps: forwarding an attack request to a honeypot response module, and searching a rule table to determine an attack response action matched with the attack request; and when the first response data matched with the attack response action cannot be queried in a template library, calling a sandbox environment module to return second response data according to the attack response action. And the real service mirror image response request of the target system is read in the sandbox environment module, so that the honeypot is prevented from being broken due to too rigid response data. Moreover, the honeypot defense system requests the response cache module, the honeypot response module and the sandbox environment module level by level, and returns response data requested by an attacker, so that the response speed can be increased, and the consumption of computing resources can be reduced.

A cyber safety system that provides a real-time and indepen- dent cyber-attack monitoring and automatic cyber-attack response. The cy- ber safety system comprises a cyber monitoring logic to generate a cyber at- tack signal in response to a cyber attack event. The cyber safety system fur- ther comprises an automatic segmentation controller to generate a plurality of segmentation voltage signals or a plurality of segmentation messages in response to the cyber attack signal. The cyber safety system further compris- es a plurality of firewalls configured to invoke firewall rulesets depending upon an input voltage signal level of the plurality of segmentation voltage signals or the plurality of segmentation messages to segment a site network in a plurality of site network segments and to control one or more physical devices as response to the cyber attack event.

The present invention relates to the technical field of improving the resilience of electrothermal cyber-physical systems, and discloses a multi-stage collaborative resilience improvement method for electrothermal integrated energy cyber-physical systems. A defense resource allocation optimization model is constructed, and defense resource allocation optimization is performed based on the attack scheme corresponding to each attack scenario and the load loss caused by it. An attack response simulation optimization model is constructed, and attack response simulation optimization is performed according to the attack scenario. A collaborative optimization model of attack response and resilience recovery is constructed, and through a multi-stage collaborative strategy, the comprehensive resilience improvement of PTCPS under cyber-physical collaborative attacks is achieved; the present invention enhances the system's cognitive ability and response ability to complex coupled disturbances; achieves global response and comprehensive resilience enhancement of the system under complex attack modes; performs defense resource optimization configuration before the attack, and uses the system's internal performance characteristics after the attack to achieve system emergency recovery, improve recovery efficiency, and achieve system-level resilience improvement for the entire process.

The invention relates to the technical field of network security, and discloses a method and system for realizing an industrial honeypot network based on multi-core electric power IED equipment, and the method comprises the steps: carrying out the preprocessing of traffic, and redirecting and forwarding the traffic to a processor core of the electric power IED equipment; generating multi-dimensional vectors of a plurality of distribution nodes and mimicry data, and determining the distribution nodes and the mimicry data according to the probability of the distribution nodes; based on a honeypot network kernel, forwarding the attack data to an associated electric power IED device in combination with the distribution node and the mimicry data, and generating mimicry data corresponding to the attack data by using a dense network client associated with the electric power IED device; and mimicry data returned by the secret network client is integrated, and a final attack response is generated and sent to the attack source. According to the method, one-step generation of trapping data and distribution nodes on the premise of local data security can be realized, real-time analysis, quick response and effective cheating of attack traffic are realized, and the overall security protection level of an industrial control system is fundamentally improved.

The invention relates to the field of network security, and discloses a distributed data security protection system and method adaptive to a network environment. Comprising a self-adaptive protection strategy module, a distributed data processing module, an intelligent threat detection and response module, a data encryption and integrity protection module, a load balancing and resource scheduling module and a unified management and monitoring module which are in communication connection. The self-adaptive protection strategy module is used for dynamically generating and issuing a dynamic protection strategy according to the real-time threat data; and the distributed data processing module is used for deploying a plurality of independent nodes, executing a dynamic protection strategy and sharing attack response data across the nodes. By dynamically generating and adjusting the encryption strategy and the access control measure, the system can adaptively enhance the security protection capability according to the real-time network threat data, meanwhile, the efficient data processing performance is kept, and the security and efficiency requirements are effectively balanced.

The invention relates to the technical field of toughness improvement of an electric heating information physical system, and discloses a multi-stage toughness collaborative improvement method of an electric heating comprehensive energy information physical system. The method comprises the steps of constructing a defense resource allocation optimization model, performing defense resource allocation optimization based on attack schemes corresponding to attack scenes and load loss caused by the attack schemes, constructing an attack response simulation optimization model, performing attack response simulation optimization according to the attack scenes, and constructing a collaborative optimization model of attack response and toughness recovery. The PTCPS comprehensive toughness improvement under the cyber-physical collaborative attack is realized through a multi-stage collaborative strategy; according to the invention, the cognitive ability and response ability of the system to complex coupling disturbance are enhanced; global response and comprehensive toughness enhancement of the system in a complex attack mode are realized; and defense resource optimization configuration is carried out before attack, and system emergency recovery is realized by utilizing the internal performance characteristics of the system after attack, so that the recovery efficiency is improved, and the overall process-oriented system-level toughness improvement is realized.