252 results about "Attack signature" patented technology

The invention discloses a cloud desktop security access control method based on a zero-trust architecture, belongs to the technical field of network security, and is used for solving the problems of difficulty in hidden attack detection, cross-cloud attack chain breakage and conflict between security control and service continuity in a multi-cloud environment. Firstly, user identity attributes, session metadata and service call logs are aggregated, an identity-resource-behavior triple dynamic graph is constructed, cross-session association features are extracted, and a multi-dimensional behavior baseline is generated. And quantifying the access deviation degree based on the behavior baseline, triggering sensitive operation traceability analysis, constructing a time sequence risk propagation model, identifying latent attack features, predicting a penetration path and outputting a risk propagation coefficient. And finally, dynamically generating a process-level micro-isolation strategy according to a risk result, gradually adjusting the authority through a nonlinear authority attenuation function, inserting a secondary authentication node when unexpected resource jump is detected, reconstructing a communication white list, and realizing collaborative optimization of security protection and service continuity.

The invention discloses a network security defense method and system based on incremental network attack analysis learning. The method comprises the following steps: collecting initial network flow data, and extracting a feature vector; and collecting real-time network flow data, performing segmentation processing based on a sliding time window, extracting time sequence association features from the segmented data, and matching the time sequence association features with the feature library to identify potential attacks or abnormal behaviors. And when the time sequence correlation feature is not matched with the feature library, marking the time sequence correlation feature as a candidate novel attack feature, calculating a mahalanobis distance between the time sequence correlation feature and a known attack feature to determine the attack variability, and dynamically adjusting the weight of the time sequence correlation feature. And inputting the adjusted feature weight and the real-time flow feature into a deep reinforcement learning detection model, and generating and updating a network security defense strategy. The scheme of the invention can effectively identify novel attack behaviors, dynamically respond and optimize defense strategies, and improve network security.

The invention discloses a network attack AI detection analysis method and system based on the smart Internet, and belongs to the technical field of network security protection, and the method comprises the steps: building an attack feature library through distributed edge nodes in a cooperative manner, generating feature parameters of each node based on a local attack event, and transmitting the feature parameters to a central server for dynamic fusion through encryption; constructing a multi-modal interaction graph, identifying a potential attack link based on association strength among graph nodes, and deducing an attack intention to generate a defense strategy; deploying a virtualized network environment, dynamically injecting induction characteristics, and adjusting an induction strategy in real time according to the interaction behavior of an attacker; and monitoring an abnormal mode of the user behavior sequence, triggering an AI interaction verification process and storing a defense strategy. According to the method, rapid collection and fusion of network attack features are realized, the detection delay of network attacks is reduced, the accuracy of attack prediction is improved, the flexibility and effectiveness of network attack confrontation are enhanced, and the defense intelligence and adaptive ability of the whole network are improved.

The invention provides a dynamic security risk assessment and intelligent response system and method based on AI, relates to the field of dynamic security risk assessment and intelligent response, and improves the accuracy and response speed of security protection. The method comprises the following steps: firstly, collecting multi-dimensional security data, carrying out data preprocessing by utilizing an AI technology, and outputting a structured security data stream; then analyzing the data flow based on an AI model, identifying cross-dimension attack features, generating real-time threat intelligence, updating a risk judgment threshold value, generating a security assessment report, automatically generating and executing hierarchical response measures according to the assessment report, feeding back a response execution effect, performing dynamic adjustment, and generating a new security assessment report; and finally, automatically selecting a data transmission mode and rate according to the new security assessment report, and adjusting the acquisition frequency of the sensor. According to the method, through dynamic optimization and an intelligent response mechanism, the recognition and defense capability on complex attacks is remarkably improved.

The invention discloses a multi-dimensional security data threat detection method and device based on a large model and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining multi-dimensional heterogeneous security data, and generating a plurality of basic event descriptions; performing semantic processing on the basic event description to obtain a standardized event description, inputting a pre-trained large language model to perform single-point threat research and judgment, and outputting an event threat evaluation result; splicing the standardized event descriptions of the same target entity into a behavior sequence text, inputting the behavior sequence text into a large language model for multi-stage attack feature analysis, and outputting an attack chain integrity evaluation result; determining a comprehensive threat level based on the event threat assessment result, the attack chain integrity assessment result and the affected asset attribute; and generating a security event analysis report, and extracting the security entities and the association relationships thereof from the report to update the security knowledge graph. The technical breakthrough from traditional'event seeing 'to real'event understanding' is realized.

The invention relates to the technical field of traffic filtering, and discloses a CC attack feature-based traffic filtering method and device. The method comprises the following steps: performing feature extraction and Laplacian feature mapping dimensionality reduction on a historical HTTP request traffic sample to obtain a dimensionality-reduced feature vector set; cC attack feature analysis is carried out based on the dimension reduction feature vector set, and a CC attack feature parameter set is obtained; performing attack risk assessment on the real-time HTTP request to be filtered based on the CC attack feature parameter set to obtain an attack possibility score; performing time-varying parameter defense analysis based on the attack possibility score to obtain an adaptive defense rule set; and performing hierarchical filtering processing on the real-time HTTP request to be filtered according to the self-adaptive defense rule set to obtain filtered security traffic. According to the method, the defense parameters can be dynamically adjusted according to the attack situation, compared with a static defense rule, the method is more flexible and adaptive, and the resource utilization efficiency can be optimized while safety is guaranteed.

The invention provides a network information security adaptive threat intelligence analysis and response method and system. The method comprises the following steps: acquiring an encrypted traffic load byte stream, and segmenting the encrypted traffic load byte stream into a time sequence traffic matrix according to a time window; and analyzing the communication metadata, matching the features of the threat intelligence library, and generating a dynamic threat fingerprint based on protocol compliance and behavior abnormality. And performing multi-stage wavelet packet decomposition on the matrix, extracting the energy spectrum density, the information entropy and the time-frequency variable coefficient of the high-frequency component, and performing weighted fusion to generate a frequency-domain composite abnormal index representing heartbeat signal characteristics. And identifying hidden heartbeat periodicity and protocol violation modes through a multi-mode fusion mechanism in combination with the frequency domain index and the threat fingerprint, and outputting a threat score. And if the attack exceeds the threshold value, intercepting the flow, verifying a new attack feature, and then reversely updating the threat intelligence library to form a defense self-evolution closed loop. According to the method, automatic interception and closed-loop updating of the threat intelligence library are realized, and the defense adaptability is remarkably improved.

The invention discloses a computer network security situation awareness system and method, and relates to the technical field of computer network security, and the method comprises the steps: generating a dynamic gene pool through an antigen-antibody matching algorithm based on an initial quantum trust vector, and building a mapping relation table of an antigen feature vector and an antibody defense strategy; triggering a quantum alarm according to an entanglement entropy mutation event in the real-time quantum state flow data, matching a biological antibody strategy corresponding to a current network attack feature based on a mapping relation table, and fusing the quantum alarm and the biological alarm to generate an attack path topological graph; the network security situation is perceived by analyzing the quantum state change of the abnormal node ID and combining an attack path topological graph and a dynamic gene pool. Quantum entanglement pairs are distributed to network nodes through the quantum key distribution center, and initial quantum trust vectors are generated, so that the unknown attack resisting capability of the network is remarkably improved, and efficient and accurate network security situation awareness is realized.

The embodiment of the invention provides a network attack research and judgment method and system, a program product, equipment and a medium, the system deploys a plurality of agents, and the method comprises the following steps: inputting an attack sample into an attack feature extraction agent, and constructing an attack feature library based on the extracted attack features; inputting the network security log into a field extraction agent to obtain an extracted attack related field; inputting the attack feature library and the attack related fields into an attack analysis module, and obtaining attack analysis data of the attack analysis module on the attack related fields based on the attack feature library; inputting the threat intelligence data, the asset data and the attack analysis data into a comprehensive analysis report agent to obtain an analysis report including an attack result, an attack severity degree, an influence range and an attack technology; and inputting the analysis report into an attack processing module to obtain an attack processing plan. Attack research and judgment process automation is realized by utilizing the intelligent agent, the analysis, research and judgment capability on known attacks can be improved, unknown attack behaviors can be identified, and closed-loop protection measures are formed.

The invention relates to an AI-based network security system construction, operation and maintenance method, device and system and a medium. The method comprises the following steps: firstly, acquiring a multi-dimensional data stream, performing feature extraction on the multi-dimensional data stream, and performing dimension reduction by using an algorithm to obtain a low-dimensional feature vector set; fusing an adaptive clustering algorithm according to the vector set to obtain clustering model parameters; extracting novel attack features from the clustering model parameters, and integrating the novel attack features and the clustering model parameters by means of a Bayesian network algorithm to generate a threat situation analysis chart; simulating a multi-scene attack path by utilizing a generative adversarial network algorithm based on the analysis graph, generating a virtual attack data stream and obtaining a defense response result; and finally, aiming at a defense response result, applying a reinforcement learning algorithm to optimize defense strategy parameters, and generating a real-time updated threat situation report after multiple rounds of verification. According to the method, novel attack features can be accurately identified, the accuracy and real-time performance of threat situation awareness are effectively improved, and the ability of a network security system to deal with various complex threats is greatly enhanced.

The invention discloses an electric power industrial control flow application layer message anomaly detection method and device and electronic equipment. The method comprises the steps of collecting industrial control network full messages of an electric power system in real time; based on a preset industrial control protocol behavior characteristic spectrum, screening out suspicious traffic fragments deviating from a normal communication normal form from the industrial control network total message to generate a suspicious traffic event chain; performing protocol field regularization processing on the suspicious traffic event chain to extract a cross-level attack feature set; inputting the cross-level attack feature set into an attack identification model subjected to federal learning training for multiple rounds of verification to obtain a determined attack sample of which the attack confidence meets a preset standard; and determining an attack category and a propagation path based on attack sample traceability through the attack characteristic pedigree. According to the method, unknown attacks are captured through a protocol behavior characteristic spectrum, the recognition capability is improved through cross-level characteristic extraction, error and missing report are reduced through federated learning and multi-round verification, and the whole attack process is tracked through event chain and pedigree tracing.

The invention relates to the technical field of the Internet of Things, and discloses a wireless sensor network environment monitoring system and a safety protection method based on the Internet of Things, and the system method comprises the steps: collecting sensing node environment data to generate a multi-dimensional feature matrix, and constructing a safety protection strategy set; setting threat parameter types, and establishing a security threat association model by using historical data; extracting real-time attack features and flow parameters, and generating a dynamic protection instruction set and an optimization scheme in combination with the model; and reconstructing a network node control mechanism to generate a target protection scheme, and dynamically and synchronously calibrating an instruction time sequence. The system comprises a node data acquisition module, a security policy generation module, a threat parameter analysis module, a threat modeling module, a risk assessment module, a protection mechanism reconstruction module and a time sequence synchronization module. Through multi-dimensional feature analysis, dynamic threat modeling, adaptive risk assessment and time sequence encryption synchronization, the security protection capability of the wireless sensor network in a complex environment is improved, and the method is suitable for security protection requirements in the field of Internet of Things environment monitoring.

The invention relates to the technical field of network security, and discloses a network attack tracing and evidence fixing method and system based on full-link data, and the method comprises the steps: collecting multi-source heterogeneous data; cleaning and standardizing the collected data, and extracting attack feature information; constructing a full-link data association model, and connecting scattered attack behaviors in series into a complete attack chain through time sequence analysis and node relation graph technologies; based on the attack chain, determining an attack source and a potential motivation thereof by using a multi-level threat intelligence matching algorithm; and the traceability result is in butt joint with an evidence fixing module, a network attack electronic evidence file is generated, and the evidence is stored in a non-tampering manner through a block chain technology. The system corresponds to the method. The method and the system have remarkable technical advantages in the aspects of data integration, traceability precision, evidence fixation, storage optimization, visual display and the like, and can effectively cope with security challenges in a complex network environment.

The invention discloses a data processing method and device, equipment and a medium. The method comprises the steps that a detection threshold value is determined based on a first access traffic log; determining an access behavior for the service domain name based on the number of domain name requests determined by the access traffic indicated by the second access traffic log and a detection threshold; when the access behavior aiming at the service domain name belongs to the abnormal access behavior, taking a behavior determination time point corresponding to the abnormal access behavior as a critical time point, and taking a third access traffic log obtained based on the critical time point as an abnormal access traffic log; when a normal traffic feature determined based on the first access traffic log is obtained, determining an abnormal traffic feature of the service domain name based on the abnormal access traffic log, and performing feature comparison on the abnormal traffic feature and the normal traffic feature to obtain an attack feature of the service domain name; a protection policy for the service domain name is determined based on the attack feature. According to the invention, the security and stability of the business server can be maintained.

The invention relates to an artificial intelligence-based network and data security monitoring and compliance analysis method and system, and the method comprises the steps: analyzing a security compliance standard inputted by a user based on artificial intelligence, automatically generating a corresponding judgment rule for each check item, and adjusting the judgment rule in cooperation with an interaction port. The adjusted rule is used for network and data security compliance analysis; the system based on the method collects and integrates data with a data collection layer, an analysis engine identifies attacks and performs compliance verification, and an output end outputs attack features and risk scores. According to the method, online learning and intelligent iteration of security policies are realized, dynamic change of network topology is adapted, policy optimization is dynamically executed, and perspectiveness and effectiveness of security defense are ensured; manual intervention is greatly reduced, the efficiency and accuracy of compliance management are improved, and automatic compliance is basically achieved; a firm privacy protection barrier is built for cross-domain data sharing, and the safety and privacy of data in the sharing process are ensured.

The invention relates to the field of industrial internet safety monitoring, and particularly discloses an industrial internet safety monitoring control system which comprises a network safety monitoring module, a control logic monitoring module, a traceability analysis module and an early warning execution module. The network security monitoring module analyzes a network attack risk level and an illegal access risk level through traffic baseline comparison, attack feature matching and risk model assessment; the control logic monitoring module identifies control logic abnormity based on the equipment operation state data and triggers a verification alarm; the traceability analysis module adopts a decision tree algorithm, combines the operation log, the behavior track and the version updating record, and judges that the tampering reason is misoperation, malicious tampering or system updating; and the early warning execution module triggers differentiated grading early warning according to the risk grade and tampering reason classification. The system can effectively identify external attacks, illegal access and logic tampering behaviors, and the security protection capability of the industrial internet is improved.

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Anomalous events may be classified based on the monitored network traffic and attack models such that the classification determines that targets of the anomalous events may be currently subject to attacks by entities communicating on the networks. A honeypot trap may be provided in the networks based on the classified events such that the honeypot trap mimics characteristics of the targets. The portions of the network traffic associated with the honeypot trap may be monitored. Characteristics of the attacks may be determined based on the monitored portions of network traffic. Reports that include information based on the characteristics of the attacks may be generated.

The invention belongs to the technical field of network information security, and discloses an information security management system based on network operation and maintenance. The method comprises the following steps: periodically acquiring multi-dimensional traffic data of a network node through a traffic acquisition module, and constructing and labeling a network security situation map by means of an asset labeling module; the authority distribution module automatically adjusts the authority of the abnormal access node by analyzing the node access behavior; the threat detection module analyzes the flow in real time, drives the self-adaptive isolation module to quickly isolate threat nodes according to the generated temporary strategy, and updates the joint defense model for cooperative defense; the attack evolution prediction module performs attack path prediction by extracting attack features and optimizes an isolation strategy accordingly; and information leakage is effectively prevented.

The invention provides a network attack detection method and device, and a protection system, and belongs to the field of network security. After the protection equipment receives network traffic, whether the network traffic is suspicious traffic or not is judged through a traffic detection model on the basis of traffic characteristics of the network traffic, and after the network traffic is determined to be suspicious traffic, the traffic characteristics of the network traffic are further matched with attack characteristics in a characteristic library; and determining whether the network traffic is normal traffic or attack traffic based on a matching result. According to the method and the device, the network traffic is preliminarily screened through the traffic detection model, so that the number of the network traffic needing to be subjected to attack detection based on the feature library is reduced, and the detection efficiency of the protection equipment is improved. Besides, the protection device can allocate more processing resources for the detection of the single network traffic, so that the single network traffic can be detected more comprehensively based on the feature library, and the detection accuracy is improved.

The invention discloses an encrypted malicious traffic detection method based on deep learning, and the method comprises the steps: extracting time sequence features of network traffic data through an LSTM model, further extracting semantic features of the traffic data through a BERT model, and finally forming comprehensive feature representation; clustering the comprehensive feature representation by using a DBSCAN algorithm; optimizing sample labels in each cluster according to a defined naming rule, and classifying traffic types with similar attack characteristics into uniform labels; constructing a graph structure, performing edge connection on the optimized traffic sample labels and the comprehensive feature representation thereof, and establishing edge connection among different clusters according to cosine similarity; and constructing a GraphSAGE graph neural network model, performing information aggregation on nodes of a graph structure and neighbor nodes thereof to obtain an updated feature vector of each node, performing classification processing by using updated node features, and identifying whether the traffic is malicious encrypted traffic. According to the invention, the detection precision and robustness are improved.

An attack detection and source tracing method includes acquiring entities in a target network environment and interaction event information between the entities and constructing a network event graph with the entities and the interaction event information; determining a graph embedding vector of each interaction event information in the network event graph as feature information based on a preset attack feature recognition model and determining an attack event in the network event graph according to the feature information; determining dependencies between the attack event and remaining interaction event information in the network event graph and searching for a corresponding interaction event information as source tracing information of the attack event according to the dependencies.

The invention relates to the technical field of federated learning security, and discloses a federated learning poisoning defense method based on time-frequency spectrogram and comparative learning, which comprises the following steps: receiving model update uploaded by each client, grouping and vectorizing parameters according to model layers, and generating a time-frequency spectrogram by applying short-time Fourier transform to parameter vectors of each layer; based on the time-frequency spectrogram, constructing a positive sample pair through data enhancement, carrying out difficult negative sample mining, and training an encoder by using a contrast loss function to extract an embedded vector with high discriminant power; and performing unsupervised clustering on the embedded vector by using a DBSCAN clustering algorithm, judging the maximum cluster as a benign client, performing final judgment in combination with historical malicious records, and only aggregating model parameters of the benign client to update a global model. According to the invention, high-precision detection of attack features can be realized, and a more universal, more efficient and more practical federal learning poisoning attack defense method is realized.

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

A system and a method to detect an attack on an IoT network is disclosed. The IoT network includes interconnection of multiple IoT devices. The method includes receiving, by a network connection device, multiple ICMPv6 network packets from IoT devices and outputting multiple output packets; and matching, by a routing device, a network traffic pattern to attack signatures structured as a taxonomy according to which part of a packet is misused. The taxonomy includes a branch to a data plane attack and a control plane attack, respectively. When an IPv6 RPL packet is detected, the method includes checking for generating, modifying, and replaying attacks by an attacker. When a non-RPL packet is detected, the method includes checking for dropping and leaking packet attacks by the attacker. When the attack is detected, the method includes invoking a solution to the attack. The solution includes mitigation of the attack by the attacker.

The invention belongs to the technical field of computer security, and relates to a dynamic detection architecture, strategy, system and method for attack variants, and the multi-layer risk detection architecture is composed of a behavior change detection layer, a code structure detection layer and a data flow detection layer. The dynamic adjustment detection strategy is formed by respectively introducing a behavior change detection layer, a code structure detection layer and a data flow detection layer in a multi-layer risk detection architecture into a self-learning model; the dynamic detection system comprises a system interface module, a risk preliminary screening module and a variation detection module; the dynamic detection method comprises the following steps: primarily screening data input through the system interface module by using the risk primary screening module; inputting the primarily screened data into a variation detection module for detection and analysis, and configuring the access authority of the input data according to an output result; according to the method, the comprehensiveness of variation feature detection is improved, and the detection performance of the model is improved so as to adapt to continuously changing attack features.

The invention discloses a security detection system and method, relates to the technical field of network security, and aims to solve the problem of improving the security of data included in an oil-gas pipe network system. Comprising an acquisition unit configured to acquire network flow data in unit time and determine a detection period according to the network flow data; the judgment unit is configured to map the network flow data in the detection period into a two-dimensional matrix and determine a network attack judgment mode according to the detection period; a processing unit configured to determine an overall difference score and calculate a detection residual; the adjusting unit is configured to adjust the detection period according to the overall difference score or the detection residual when the network attack is judged to exist; the recognition unit is configured to extract attack features of the abnormal data, perform clustering analysis on the attack features and historical attack features, and determine attack types; and the early warning unit is configured to perform early warning according to the attack type.

The invention discloses a non-file attack detection method, system and device based on multi-view behavior modeling and frequency domain enhancement contrast learning and a medium, and belongs to the technical field of network security, and the method comprises the steps: collecting and coding multi-source behavior data of a target system during operation, and carrying out the unified coding; performing time sequence division on the multi-source behavior data, and constructing a corresponding behavior graph; inputting the divided time sequence into a self-attention mechanism neural network, extracting time domain representation of behaviors, inputting the constructed behavior graph into a graph structure neural network, and extracting structure representation; respectively performing fast Fourier transform on the time domain representation and the structure representation to generate frequency domain representation; constructing a joint contrast learning loss function, and training a consistency detection model; and judging whether the behavior is a file-free attack behavior based on the consistency deviation in combination with an anomaly detection judgment mechanism. According to the method, the non-file-attack characteristic behaviors are accurately identified, and the capability of detecting the non-file-attack in the advanced persistent threats is effectively improved.

The embodiment of the invention discloses a cooperative security protection method and device for a vehicle-mounted communication link, a medium and a product. The method comprises the following steps: when a communication link of a vehicle is attacked, collecting attack characteristics; acquiring a comprehensive score of an attacked communication link, determining a target strategy template according to the comprehensive score, and uploading an attack feature and the target strategy template to a cloud; when the comparison between the attack feature and the cloud historical attack feature fails, determining that the attack feature is a novel attack feature and performing depersonalization processing to obtain a general attack feature; obtaining result data that the novel attack feature discovery vehicle uses the target strategy template to protect the novel attack feature so as to obtain a general protection strategy; and synchronizing the general attack feature and the general protection strategy to an associated vehicle to perform safety protection. According to the method, identification and depersonalization of novel attacks and generation of universal protection strategies can be realized, and the strategies are synchronized to associated vehicles, so that various attacks can be timely and effectively handled, and the overall protection capability is improved.

The invention discloses a power industry software supply chain risk management method and system, a medium and a processor. The method comprises the following steps: acquiring code data of a power information system and a supply chain attack feature library; extracting text features of the data, and generating a code feature vector sequence; performing clustering analysis on the code feature vectors to generate a target feature measurement set oriented to different stages; on the basis of constructing a multi-stage dynamic weight correlation model, calculating a weighted correlation coefficient between the target feature measurement and a preset attack stage, and judging the affiliation of the attack stage; analyzing target feature measurement based on a heterogeneous knowledge graph and a graph attention network, and identifying a potential attack technique type; a self-adaptive attack vector is generated through an attack simulation engine driven by reinforcement learning, response data in the attack simulation process are collected, and a test strategy is dynamically optimized. According to the method, correlation coefficients are calculated for different attack stages, feature measurement of each stage is considered, and the accuracy of attack stage attribution judgment is improved.

The invention discloses a command detection and processing method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: carrying out the global identifier adding operation of an original operation log of target detection equipment, and obtaining an identified operation log; processing the identified operation log to obtain structured data, and establishing a threat knowledge graph based on an attack command of attack feature description information obtained from a preset vulnerability library and the sensitive path; generating detection rules by using a command mode obtained by analyzing the command information based on the threat knowledge graph and a historical attack frequency of the command information, and screening the detection rules to obtain an effective rule set; processing the command information to obtain a syntax tree, and obtaining a target risk score based on a preset risk scoring rule and the structured data scoring syntax tree; and determining a response rule in the effective rule set based on the risk score grade of the target risk score, and processing the command of the command information by using the response rule. Therefore, the command detection and processing efficiency can be improved.