48 results about "Attack response" patented technology

The invention relates to the technical field of cloud computing, in particular to a network data encryption and privacy protection system in a cloud environment, which comprises a key management unit driven by a wolf pack algorithm, an encryption algorithm optimization unit, a privacy protection strategy dynamic adjustment unit and a safety monitoring and abnormity response unit. The invention discloses a cloud environment network data encryption and privacy protection system constructed based on a wolf pack algorithm. High-security keys are dynamically generated and distributed through a key management unit, security performance and resource consumption are balanced through an encryption algorithm optimization unit, multi-target dynamic gaming and compliance guarantee are achieved through a privacy protection strategy unit, distributed attack detection and cooperative defense are completed through a security monitoring unit, and the security performance is improved through a cooperative feedback mechanism between the units. Intelligent encryption protection, dynamic strategy adjustment and efficient attack response of the full life cycle of the data in the cloud environment are realized, and the system security, the resource utilization rate and the compliance capability are remarkably improved.

According to the priority asynchronous processing method and system for network security, multiple data sources are integrated, the threat level of each data packet is evaluated in real time, and the processing priority of each data packet is dynamically adjusted according to the threat level. Different from a traditional static method, the method provided by the invention utilizes an advanced machine learning algorithm, can perform dynamic evaluation in multiple dimensions, and timely identifies and preferentially processes high-risk data packets. The mechanism obviously improves the response capability of the system to novel and complex attacks. Meanwhile, a multi-node cooperative attack response mechanism is introduced, when a certain node detects abnormal traffic, other nodes can be automatically notified, threat situation information can be shared, and therefore rapid cooperative reaction is achieved. The integrated innovation not only enhances the overall security of the network, but also optimizes the data packet processing efficiency, effectively solves the main defects in the traditional network security system, and provides a new thought for constructing a safer and more flexible network environment.

A computer implemented method of evaluating attacks on a first large language model (LLM). The method comprises: inputting attack data to the first LLM; receiving attack response data from the first LLM in response to the inputted attack data; inputting the attack response data to a second LLM configured to evaluate LLM attack response data; and receiving an evaluation of the attack response data from the second LLM.

The invention provides a ChatGPT-based security protection software rule generation method and system, and relates to the field of network security threat detection, and the specific scheme is as follows: automatically crawling a threat analysis report A of an effective rule generated by other security equipment platforms, taking the effective rule of the threat analysis report A as a rule case to carry out instruction fine tuning on ChatGPT, and taking the effective rule of the ChatGPT as a rule case; generating and obtaining a sample fine tuning GPT model; obtaining a threat analysis report B of the security equipment to be protected, initiating a request for ChatGPT based on the sample fine tuning GPT model, analyzing the threat analysis report B by ChatGPT according to the request to generate a threat detection rule, and converting the threat detection rule into a grammar rule of security protection software; and performing simulation attack test and white-box test based on the grammar rules, and screening out grammar rules which do not pass the test to obtain general grammar rules of the security protection software. According to the method, the problem that the attack response is slow in the prior art is solved, the threat detection rule is automatically designed and generated, and the use cost is reduced.

The invention discloses a quantum key dynamic management method and system of a power wireless communication network. The method comprises the following steps: constructing a three-level service security model: dividing power services into high, middle and low three-level security levels, and differentially configuring key basic parameters; secondly, proposing a dynamic key updating algorithm, adjusting a key updating period and a quantum key window in real time based on a communication state and a flow load, and dynamically expanding the updating period and the size of the key window according to the change of throughput; and finally, setting an attack response strategy, automatically shortening an update period and enhancing key strength when an anomaly is detected, and improving the security of a power wireless communication scene. According to the quantum key dynamic management method disclosed by the invention, the problem of security risk caused by the fact that a traditional fixed quantum key update period cannot meet the communication state of a power wireless communication network and the real-time change of traffic load is solved.

The invention discloses a cloud side-end cooperative multi-scene adaptive network intrusion detection method, and solves the problems of poor scene adaptation, weak dynamic processing, privacy-precision imbalance and the like in the prior art. The method is realized through four steps: 1, multi-scene traffic collection and hierarchical preprocessing, terminal sensing layer optimization frame processing and traffic classification, edge layer screening of high-value traffic, and cloud fragmentation scheduling; 2, multi-scene adaptive feature fusion is carried out, scene exclusive features and general features are extracted, and 50-dimensional feature vectors are generated; 3, a cloud edge-end collaborative detection model and an edge lightweight model are preliminarily screened, a cloud federal fusion model is finely detected, and dynamic weight and differential privacy are combined; 4, dynamic attack response and model iteration are carried out, attacks are responded in a scene mode, and the stability of the model is guaranteed through anti-forgetting optimization. According to the method, multiple scenes are covered, the detection precision is larger than or equal to 98.5%, the edge delay is smaller than or equal to 40 ms, the privacy leakage risk is reduced by 90%, the renaturation is high, and the robustness is high.

The invention provides a link flooding attack cross-layer cooperative defense method and system based on weighted ensemble learning, and belongs to the technical field of link flooding attack (LFA) defens.Metadata obtained through dynamic sampling telemetering is converted into a three-dimensional tensor to serve as input of an LFA prediction model based on weighted ensemble learning, and the LFA prediction model is subjected to LFA prediction; the attack intention is perceived and the attack node is positioned by fusing the multi-view feature learning ability of the diversified base model; according to an LFA prediction result, an LFA attack detection mechanism based on online clustering reasoning is activated in advance, nominal and ordinal number features are extracted, similar data packets are aggregated into a traffic cluster by adopting a Manhattan distance, and an adaptive LFA mitigation strategy is generated by analyzing the aggregation degree of the traffic cluster and evaluating the attack traffic cluster. According to the method, the attack intention can be dynamically perceived and accurately predicted, the contradiction between the limited data plane resource overhead and the attack response timeliness is balanced, the linear speed detection of the attack traffic is realized, and the adaptive defense strategy for different attack modes is generated.

The invention relates to the technical field of network security, and discloses an SDN (Software Defined Network)-based large-scale host vulnerability identification and attack response simulation method, which comprises the following steps of: 1, creating a network topology through a Mininet script; the method comprises the following steps of: 1, acquiring a host vulnerability identifier, 2, configuring vulnerability attributes for the host by using a JSON format in an SDN network environment, and 3, based on the host vulnerability identifier, selecting a corresponding attack strategy and executing a simulation attack, monitoring network flow and a host state in real time through an SDN controller, identifying an abnormal behavior and triggering a response mechanism. According to the method, the vulnerability attribute in the JSON format is configured for each host node, and an attacker is supported to detect and position the target host based on specific vulnerability characteristics by utilizing the centralized analysis capability of the SDN controller, so that the simulation capability of a network security simulation environment to a real attack scene is remarkably improved; the limitation that a traditional method is difficult to reflect vulnerability details is solved.

The invention relates to an attack detection and elastic control method for a multi-vehicle cooperative system. The method comprises the following steps: step 1, initializing; step 2, prediction: at the moment t, according to the state ellipsoid set epsilon t and the shape matrix Qt, solving a prediction ellipsoid set epsilon t + 1t; step 3, inter-vehicle communication attack detection: judging whether inter-vehicle communication is attacked at the moment t, if not, executing the step 4, and otherwise, executing the step 6; step 4, measurement updating: at the t + 1 moment, solving a minimum ellipsoid set # imgabs0 # and measuring and updating an ellipsoid set epsilon t + 1; step 5, sensor attack detection: at the t + 1 moment, judging whether the sensor is attacked according to an intersection set of epsilon t + 1t and # imgabs1 #, if the intersection set is empty, executing the step 6, otherwise, executing the step 2; step 6, elastic control: according to the attack response, respectively replacing the attacked ellipsoid sets, and respectively carrying out measurement updating and prediction processes at the t + 1 moment; and step 7, repeating the steps 2-6 until the end. Compared with the prior art, the method has the advantages of reducing network attack influence and the like.

The invention discloses an intelligent protection switching method, system and device for DDoS attacks and a medium, and the method specifically comprises the steps: obtaining DDoS attack alarm information through a multi-source data collection interface, and constructing a multi-dimensional attack knowledge graph based on a graph database; based on the multi-dimensional attack knowledge graph, verifying the causal relationship between protection actions and business indexes by adopting a double difference method, calculating the contribution degree of each protection measure to business recovery through a Bayesian network, and constructing a protection effect attribution model; generating a protection strategy set in a three-dimensional decision space by adopting a multi-objective optimization algorithm based on a confidence evaluation result of the protection effect attribution model; and based on the protection strategy set, docking a multi-cloud platform protection resource API interface, dynamically scheduling high-defense packet resources based on a Q-learning reinforcement learning algorithm, and executing cross-cloud traffic traction and cleaning service switching. According to the method, the timeliness and effectiveness of DDoS attack response are improved, the protection response speed is increased, and the influence of attacks on services is effectively reduced.

A method for providing ransomware training includes conducting a skill assessment for a user to determine a user performance level of the user; determining user attributes associated with the user, and user attributes include a user type, a user role, and a list of providers associated with the user; generating a training exercise including a simulated attack, and generating the simulated attack includes identifying a real-world ransomware attack, determining attack attributes of the real-world ransomware attack, and generating the simulated attack based on the attack attributes, the user attributes, and the user performance level; conducting the training exercise by sending the simulated attack to the user; receiving an attack response from the user, where the attack response includes the user's response to the simulated attack; and providing feedback to the user based on the attack response, the user attributes, and the user performance level.

The invention provides a honeypot attack response method and device based on a large model, and the method comprises the steps: constructing an attack response prompt word based on a current attack command, and a historical attack interaction data set and a historical honeypot system state set under a current attack round; and generating an attack response result based on the large model application attack response cue word, and updating to obtain a historical attack interaction data set and a historical honeypot system state set of the next attack round based on the attack response result of the current attack round. According to the method provided by the invention, through the current attack command, the historical attack interaction data set and the historical honeypot system state set, the attack response cue word is constructed, the attack response cue word is applied based on the large model, and the attack response result is generated, so that the traditional attack-response processing operation is converted into'question and answer 'text interaction based on the large model; the intelligence and verisimilitude of the attack response result are greatly improved, so that the honeypot can be more suitable for the current complex attack technique.

The invention discloses a network security attack coping method based on a generative large model, and relates to the technical field of network security, and the method comprises the steps: obtaining metadata: automatically obtaining network security basic knowledge and network security attack technique data, and forming a knowledge base; classifying and labeling the metadata, namely automatically classifying and labeling network security basic knowledge and network security attack technique data; establishing a security model: constructing a network security analysis model, and cleaning malicious data and error data; model training is executed, wherein training and fine tuning are carried out on network security data; and performing evaluation feedback for coping with network security attacks. According to the method, the automation level and efficiency of network security analysis are improved, the manual analysis cost is reduced, the model can adapt to continuously evolved network security threats through continuous learning and optimization, and more intelligent and reliable technical support is provided for network security protection of a power system.

The invention relates to a computer-implemented method of evaluating an attack on a first large language model (LLM). The method comprises the following steps: inputting attack data into the first LLM; receiving attack response data in response to the input attack data from the first LLM; inputting the attack response data to a second LLM configured to evaluate LLM attack response data; and receiving an evaluation of the attack response data from the second LLM.

The invention relates to the technical field of power information physical system security, and discloses a power transmission system attack scene identification method considering information physical interaction. Constructing a DAD attack and defense model, generating a plurality of typical attack scenes, and collecting historical load data, attack schemes and defense schemes; training is carried out through a classification network, and a mapping relation from a system operation state to a corresponding worst attack response is learned; optimizing network parameters by adopting a gradient descent method, and introducing a Lagrange function and an information physical coupling penalty term; after training is completed, attack scene prediction is carried out; taking the minimum expected loss of the system as an optimization target, and passing through the Camp; and carrying out iterative solution on the CG to obtain an optimized defense resource configuration scheme. According to the method, through a multi-stage collaborative optimization strategy, TCPS toughness improvement under the cyber-physical collaborative attack is realized, it is ensured that the system can quickly respond and recover when facing a dynamic attack environment, and the stability and security of the whole system are enhanced.

The invention relates to the technical field of network security, in particular to an IPv6 network DDoS attack detection and defense system based on deep learning, which comprises a flow monitoring and data acquisition module, a preprocessing and feature extraction module, a deep learning attack detection module, an attack response and decision module and a defense execution and feedback module, the method comprises the following specific steps: S1, monitoring traffic in an IPv6 network in real time through a traffic monitoring and data acquisition module, and capturing traffic characteristics; s2, cleaning and preprocessing the collected original traffic data by a preprocessing and feature extraction module, and extracting key features related to the DDoS attack; according to the IPv6 network DDoS attack detection and defense system based on deep learning, abnormal traffic can be rapidly identified through the deep learning model in the system, timely response can be ensured when a DDoS attack occurs, real-time performance is ensured, a defense strategy can be automatically adjusted through the defense execution and feedback module, manual intervention is not needed, and the intelligent degree of defense is improved.

The present application relates to the field of network security technology, and in particular to a network attack defense method, apparatus, device and storage medium, which are used to solve the problem of poor network attack response and defense in related technologies. The method is: collecting data to be detected through multiple honeypot nodes deployed in a target network, a single honeypot node is a protection device deployed for a business server or business equipment in the target network, and a single data to be detected includes behavior data of an interacting party interacting with the corresponding honeypot node; based on the graph structure features of multiple honeypot nodes obtained by feature extraction of each data to be detected, malicious detection is performed on the behavior of the interacting party interacting with the multiple honeypot nodes, thereby effectively improving the accuracy of network attack detection. When maliciousness is detected, the first interacting party interacting with the honeypot node is determined to be the attacker, and a defense mechanism is activated to block the attacker's network attack, effectively improving the attack response speed and defense efficiency.

The invention provides a firewall policy generation method and device, equipment, a medium and a program product, and relates to the field of financial science and technology or the field of big data. The method comprises the steps that asset information and calling relation data of a service system are obtained, a network flow logic model is generated based on the asset information and the calling relation data, and the network flow logic model comprises a topological structure model used for describing the interior of the service system and a communication link between the service system and an external system, generating a firewall policy according to the network flow logic model; the firewall policy refuses access of all IPs to a specified port of the database by default, and the recorded specific IPs are released only through a white list; according to the method, the automation level of strategy configuration and the attack response speed are improved, so that the real-time defense requirement is efficiently met.

The invention provides a verification method of network security equipment, and relates to the technical field of computer software, in particular to the technical field of security verification of network security, traffic detection and network traffic analysis. According to the specific implementation scheme, an attack request script and an attack response script are generated according to alarm data of network security equipment, and the attack response script is sent to an attack response simulator; an attack request is constructed based on the attack request script, the attack request is sent to an attack response simulator, and the attack response simulator is configured to receive the attack request, perform matching with the received attack response script according to the attack request, construct an attack response according to a matching result and return the attack response; obtaining attack simulation time sequence data according to the received attack request and the received attack response; and verifying the validity of the network security equipment based on the alarm data and the attack simulation time sequence data.

The present invention proposes a method and system for priority asynchronous processing in network security. By integrating multiple data sources, it can evaluate the threat level of each data packet in real time and dynamically adjust its processing priority accordingly. Different from traditional static methods, the present invention utilizes advanced machine learning algorithms to conduct dynamic evaluations in multiple dimensions, promptly identify high-risk data packets and process them with priority. This mechanism significantly improves the system's response ability to new and complex attacks. At the same time, the present invention also introduces a multi-node collaborative attack response mechanism. When an abnormal traffic is detected by a certain node, it can automatically notify other nodes and share threat scenario information, so as to achieve a rapid collaborative response. This integrated innovation not only enhances the overall security of the network, but also optimizes the data packet processing efficiency, effectively solving the main defects in traditional network security systems and providing new ideas for building a more secure and flexible network environment.

This invention discloses a network threat response system based on multi-agent cooperation, comprising: a trace configuration agent for generating behavioral configuration chains; a configuration aggregation module for generating threat configuration clusters; a trajectory inference agent for generating a threat trajectory grid; a resonance modeling module for executing a pulse-constrained resonance aggregation algorithm to form a threat intent resonance network; a probe pulse agent for executing cooperative probe pulses to form a cooperative probe pulse record set; a response graph generation module for generating an attack response graph; a resonance adjudication agent for constructing an attack relationship graph and executing an improved Tarjan algorithm, introducing a pulse resonance adjudication mechanism to identify strongly connected attack units and determine the minimum blocking node set; and a response execution module for executing network threat response based on the minimum blocking node set. This invention achieves efficient network threat response through the pulse-constrained resonance aggregation algorithm and the improved Tarjan algorithm.

This invention discloses a device terminal identification method for RIS phased array network deployment, relating to the field of terminal detection. The method includes: Step S1: collecting an initial feature set of the target identification terminal and monitoring abnormal attack behaviors suffered by the target identification terminal; Step S2: constructing a local outlier method to screen out effective attack behaviors and labeling a composite feature set; Step S3: constructing a machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set, and labeling the final result as a correlation scalar; Step S4: setting a dynamic threshold strategy for the correlation scalar to determine whether the target identification terminal needs to be re-identified. This invention, by continuing to monitor potential abnormal attack behaviors during the initial attack response lag period and introducing a local outlier detection method to capture dynamic changes in real time, has the advantages of ensuring that RIS phased array network terminals are only re-identified for influential attack behaviors and improving the accuracy of identifying potential secondary attacks.

The invention discloses a dynamic HQoS-driven deterministic network potential safety hazard real-time response method and system, and belongs to the technical field of data communication networks, and the method comprises the steps: obtaining flow data, and building a deterministic service baseline; and selecting the flow data exceeding the deterministic service baseline for analysis, and outputting and marking a threat level. And monitoring the marked flow data, and after the data is recovered, recovering the original resource configuration according to the gradient and marking. And constructing a dynamic HQoS strategy and synchronously executing attack response and service recovery based on the dynamic HQoS strategy. According to the method, the traffic data are detected and analyzed, when a security problem occurs in a deterministic network, potential safety hazards can be detected in real time, degradation, speed limiting and isolation processing are carried out according to the detected threat level, and the service quality of key services is ensured. The dynamic HQoS can directly trigger the adjustment of the resource scheduling strategy according to the security detection result, so that the network adaptability is enhanced while the limitation of static resources is overcome.

To provide a cyber attack countermeasure support system, method and program for designing an appropriate countermeasure against a cyber attack.SOLUTION: A cyber attack countermeasure support system 1000 designs countermeasures against a cyber attack on a predetermined target system. The cyber attack countermeasure support system comprises: a storage unit 120 that stores one or more attacker profiles 122 including an attack purpose and attack technique of an attacker performing the cyber attack, and one or more defender profiles 123 including a defense purpose and defense technique of a defender performing defense against the cyber attack; and a countermeasure design unit 111 that uses a system model 121 for reproducing a state of the target system and outputting index values of one or more indices indicating a performance of the target system corresponding to the state of the target system to design a countermeasure for each of combinations of the attacker profiles 122 and the defender profiles 123.SELECTED DRAWING: Figure 1

The application provides a bank transaction message attack processing method and device, comprising: obtaining bank transaction message data, using a first pulse time coding method to encode the bank transaction message data into a bank transaction message pulse sequence; inputting the bank transaction message pulse sequence into an attack detection model to obtain an attack detection result; performing threat modeling based on the attack detection result to obtain a threat modeling result; and determining a defense strategy through a bank transaction message large language model according to the attack detection result and the threat modeling result; the application captures the timing correlation anomaly of the transaction message through the pulse neural network of the first pulse time coding, and then analyzes the attack semantics through the bank transaction message large language model to complete the threat modeling and generate the defense strategy, thereby solving the problems of high false negative rate and large response delay in the prior art, and achieving efficient transaction message attack response, accurate identification of hidden message attacks and analysis of attack intentions.

An access permission determination unit (40) determines whether the target server (12) can be accessed from the target access source based on a blacklist (34) indicating access sources prohibited from accessing the target server (12) or a whitelist (36) indicating access sources permitted to access the target server (12). If it is determined that the target server (12) cannot be accessed by the target access source, the access control unit (44) prevents the target access source from accessing the target server (12) but allows the target access source to access a virtual server (14) that simulates the target server (12).

The present application relates to the technical field of digital twinning, in particular to a disease control center network elasticity evaluation and attack adaptive response system based on digital twinning. It comprises: a digital twinning modeling unit for constructing a digital twinning model containing a business-network correlation matrix and a business tolerance threshold; an elasticity evaluation unit for generating the elasticity coefficient of each network node or link; an attack detection unit for monitoring attacks and generating an alarm containing the attack type; a response strategy generation unit for generating a candidate response strategy according to the attack type and the elasticity coefficient; a strategy evaluation and admission unit for simulating the execution of the candidate strategy in the twinning model, calculating the business interruption risk index, and allowing deployment to the physical network when the preset risk threshold condition is met. The system realizes multi-dimensional quantitative evaluation of network elasticity through a digital twinning model, and guarantees the continuous operation of disease control business during the attack response process through a strategy simulation admission mechanism.

A deception as a service (DaaS) system configures a decoy to generate a decoy instance, and projects the decoy instance into a user network. The DaaS system receives, by the decoy in the deception system, from an edge point in the user network, an attack request on the decoy instance by an attacker, generates an attack response by the decoy based at least in part on the attack request; and sends the attack response to the attacker. The attack response may include erroneous information, such as a lure file or lure credentials.

Command line inputs to a system by a user or automated script can comprise a number of legitimate commands but, as a series, reveal a reconnaissance attack, such as to gain knowledge of a system without a legitimate reason to do so. A trained artificial intelligence monitors the command line inputs to the system, as a series, and determines therefrom whether a match exists to a reconnaissance attack. The match may be a non-exact match, such as a match determined by a long short-term memory (LSTM) machine learning model. A reconnaissance attack response may then be initiated upon determining a match is present.

The invention relates to a diagnosis service attack test method and system based on a vehicle control local area network. The method comprises the following steps: sending a specified diagnosis message to at least two physical identities based on a vehicle control local area network, and effectively screening out a target identity capable of executing a diagnosis protocol based on all specified response messages corresponding to the specified diagnosis message; sending attack messages corresponding to the basic diagnosis service to the target identity label according to a preset frequency based on the whole vehicle control local area network, and determining attack response messages and attack delay time corresponding to the attack messages so as to expect to find possible vulnerabilities of the vehicle in advance; according to the method, the attack score of the target identity label is determined based on all the attack messages, all the attack response messages and all the attack delay time, and the attack test result of the target identity label is obtained based on the attack score, so that the vehicle can be rectified in time based on the attack test result, and the safety and stability of the whole vehicle are guaranteed.