179 results about "Attack strategy" patented technology

The invention relates to the technical field of platform management, and discloses an internet-based financial service platform management method, which comprises the following steps: collecting static identity data, dynamic behavior data, biological characteristics and environmental parameters of a user in real time, and generating a multi-dimensional dynamic identity chain after desensitization aggregation; the attack-defense engine simulates an attack strategy by using a diffusion model, analyzes causal contradictions and topology aggregation coefficients in combination with a space-time diagram convolutional network, marks high-risk nodes, and iteratively optimizes model parameters everyday through reinforcement learning; quantum signature and alliance chain verification are adopted in the transaction link, transactions involving high-risk countries or transactions with the fund abnormal transfer probability exceeding 95% are automatically frozen, and compliance channels are switched; the biological monitoring module analyzes the physiological signal in real time and triggers a multi-mode challenge; and aggregating edge node data through a federated learning framework, and automatically rolling back to a historical optimal version when the false alarm rate of the updated global risk control model exceeds the standard. According to the invention, efficient management of the financial service platform can be realized.

The invention provides a honey array defense resource allocation optimization method based on self-game reinforcement learning, and relates to the technical field of network security defense. The optimization method comprises the following steps: deploying defense resources based on network topology, and establishing a mapping relationship between a host and the defense resources; performing attack and defense confrontation simulation based on the mapping relation to obtain an initial attack strategy and an initial defense strategy; constructing a Markov game model based on the initial attack strategy and the initial defense strategy; performing self-game reinforcement learning on attack and defense training of the Markov game model based on a depth deterministic strategy gradient algorithm; and carrying out value evaluation on the attack and defense training based on an Actor-Critic algorithm to obtain an optimal defense resource allocation strategy. By implementing the optimization method provided by the invention, the defense party and the attack party can perform self-game reinforcement learning, the defense strategy is dynamically adjusted in confrontation, and the defense effect is improved.

The invention requests to protect a supply chain network toughness evaluation method based on a complex network theory, and aims to evaluate and optimize the toughness of a supply chain network under different attack strategies (such as random attack and deliberate attack) by establishing an evolution model of the supply chain network. According to the method, a network model with enterprises as nodes and cooperation relations as edges is established, key parameters (such as node degree, shortest path length and clustering coefficient) in a network structure are analyzed, and the stability and recovery capability of a supply chain under external impact are evaluated. By simulating different risk scenes, the structural performance, the efficiency performance and the recovery capability of the network are calculated and evaluated. The toughness evaluation method provides a new theoretical basis and technical means for supply chain risk management, and is helpful for improving the toughness of the supply chain network.

The invention discloses an energy internet intelligent key node identification and elasticity enhancement method and system, and the method comprises the steps: 1, constructing and dynamically maintaining a semantic enhanced energy internet digital twin super network and a multi-modal knowledge graph, fusing multi-dimensional information, and achieving the self-evolution and dynamic reasoning capability; 2, based on the model, fusing multi-time scale prediction data, and adaptively evaluating the dynamic comprehensive criticality of the node through an intention-function-resource-vulnerability four-layer penetrating traceability model; 3, aiming at the key nodes, generating an intelligent attack strategy by utilizing a generative adversarial network, deducing an information physical cascade failure process by combining multi-agent deep reinforcement learning, and quantitatively evaluating the system elasticity; and step 4, based on an evaluation result, generating a self-adaptive security reinforcement and dynamic reconstruction decision oriented to active immunity and elastic optimization. According to the method, the accuracy and the dynamism of key node identification can be remarkably improved.

A computer implemented security method security method is described, for detecting attacks on a system or network. The method comprises defining a sequence of attack tactics, each attack tactic representing a generalisation of a set of attack techniques, associating one or more attack detection rules with each of the attack techniques, detecting attack events based on the attack detection rules, correlating the detected attack events with the attack tactics based on the attack technique associated with the attack detection rule used to detect the attack events, linking the detected attack events based on one or more criteria, and identifying one or more paths of attack techniques through the sequence in dependence on the linked attack events. The identified paths of attack techniques represent kill chains. The present technique makes it possible to identify new kill chains of known techniques, as well as making it possible to identify high-risk kill chains.

The invention discloses an emergency lane changing dangerous scene generation method and system based on behavior guidance and a medium. The method comprises the following steps: constructing a track data set of vehicle emergency lane changing behaviors; training a behavior learning module with short sequence learning ability according to the trajectory data set; training an active attack strategy model through guidance of a behavior learning module; outputting a reference track point of the active attack vehicle through the active attack strategy model, and obtaining an optimal control input in a future time domain according to the reference track point and a preset prediction control model; and controlling the active attack vehicle to interact with the simulation platform according to the optimal control input, and generating an emergency lane changing dangerous scene. The method improves the generation efficiency of the emergency lane changing dangerous scene, thereby improving the efficiency of the automatic driving test, and can be applied to the technical field of automatic driving.

The invention provides an oil and gas production system virtual-real fusion attack and defense drilling system and method, a medium and equipment, and the system comprises a virtual-real simulation module which is used for simulating a field operation environment of an oil and gas production system, and maintaining a communication control relation between a regulation and control center and station equipment; receiving an attack instruction, and simulating the physical influence of the station yard equipment of the oil and gas production system under the attack condition; the local attack module is used for monitoring a network risk area of the oil and gas production system and calling an attack strategy instruction to initiate an attack instruction to a communication link or a control node in the network risk area; and the safety protection module is used for detecting the system abnormity of the station yard equipment in the simulation module, calling a protection strategy matched with the system abnormity to perform linkage protection and generating an attack and defense drill report. According to the invention, a high-fidelity experiment environment can be provided for attack penetration, active defense and emergency response faced by the oil and gas production system in a real scene, and the safety protection capability of the oil and gas production system is effectively guaranteed.

The invention discloses a virtual simulation and security evaluation method and system based on a network security target range, and the method comprises the steps: constructing a network asset knowledge graph for describing a virtualized target range environment through information collection; secondly, based on an attack strategy grammar rule base, adopting a Monte Carlo Tree Search (MCTS) algorithm to carry out intelligent attack simulation on the knowledge graph so as to discover a nonlinear and multi-stage attack path; thirdly, constructing a Bayesian attack graph (BAG) based on the knowledge graph, and performing probabilistic and systematic quantitative evaluation on the security risk of each asset node in the network through Bayesian reasoning; and finally, integrating the attack path and the quantitative risk value, and generating a comprehensive assessment report containing a visual path, a risk sequence and a reinforcement suggestion. According to the target range simulation method and device, the problems that existing target range simulation is insufficient in confrontation authenticity, one-sided in safety evaluation and lack of predictability are solved by combining the strategy simulation of the MCTS and the global quantitative analysis of the BAG.

The embodiment of the invention provides an information system security evaluation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evaluation index model corresponding to a security evaluation request, and obtaining a simulation system corresponding to a target information system; performing vulnerability scanning on the simulation system based on the scanning missing tool and the MDATA knowledge base to obtain a corresponding first scanning result and a corresponding second scanning result, and performing scanning result fusion analysis based on the MDATA knowledge base to obtain a system risk assessment result of the simulation system; obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and the expert knowledge base; the attack and defense test is performed on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test result, and the security evaluation result of the target information system is obtained based on the evaluation index model and the attack and defense test result, so that the accuracy of evaluating the information system is improved.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

The invention discloses a defense strategy self-generation method and system for an intelligent device cluster, and belongs to the technical field of intelligent device cluster network security. The system comprises a network modeling module, an attack strategy integration module and a defense strategy dynamic generation module. The method comprises the following steps: constructing a network attack and defense game model to represent a network attack and defense scene of a current intelligent equipment cluster; acquiring a network topology of the intelligent device cluster, and selecting an attack strategy and an action path according to the network topology; and executing an attack behavior on the intelligent equipment cluster according to the attack strategy, obtaining a defense matrix of the current intelligent equipment cluster and the quantized detection capability of each network node cluster by a defense strategy dynamic generation module, and generating a defense strategy by adopting a deep reinforcement learning model. According to the invention, the problems of poor adaptability, insufficient collaboration, unreasonable resource scheduling and the like in the traditional defense technology of the intelligent equipment cluster network are solved, and the overall efficiency of network security defense is greatly improved.

The invention relates to an unmanned aerial vehicle threat intention prediction method and device and a storage medium, and is applied to the technical field of anti-unmanned aerial vehicles. The method specifically comprises the steps that through multi-modal deep feature fusion and deep adversarial learning, the system can extract deeper and more abstract unmanned aerial vehicle behavior mode features from multi-source heterogeneous data, so that accurate prediction of the real threat intention of the unmanned aerial vehicle is achieved, the limitation that a traditional method is only based on surface feature judgment is overcome, and the accuracy of the unmanned aerial vehicle threatening intention prediction is improved. The transformation of threat assessment from post-event analysis to pre-event prediction is realized; in the deep adversarial learning framework, various complex unmanned aerial vehicle threat behavior modes including disguise, interference and novel attack strategies can be simulated, and meanwhile, the recognition capability is continuously improved in adversarial training, so that the system can still keep high accuracy and low false alarm rate when facing unknown or variable threats, and the safety of the system is improved. And the robustness and adaptability of the system are obviously enhanced.

The invention provides a random game-based host scanning and defense strategy collaborative optimization method, and relates to the technical field of network security. The host scanning and defense strategy collaborative optimization method comprises the following steps: defining an attack action space and an attack strategy of an attacker; defining a defense action space and a defense strategy of a defender; defining a game state and a state transition rule of each time step of the attacker and the defender; calculating instantaneous rewards of the attacker and the defender based on the game state; initializing Q tables of attacking and defending parties; solving the Nash equilibrium of each time step by using a Lemke-Howson algorithm, and determining the optimal action of the attack and defense parties; calculating the total income of the attacker and the defender based on the instantaneous rewards of the attacker and the defender, and selecting an optimal strategy; and solving based on Nash Q-Learning to obtain an equilibrium strategy of the whole game process. According to the method, strategies of attackers and defenders are updated in real time through the game state, a balance strategy is finally obtained, and response efficiency and detection accuracy are effectively improved.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

A black box code search model backdoor attack method based on learnable discrete code transformation comprises the steps that a learnable backdoor generator is constructed, and malicious codes with backdoors are generated on the premise that internal parameters of a damaged model are not accessed through the learnable discrete code transformation. Firstly, an agent model capable of simulating victim model behaviors is trained through query-response data; secondly, on the proxy model, a discrete selection process is differentiable by using a re-parameterization sampling technology, and a backdoor generator is trained in combination with a multi-objective loss function so as to realize effectiveness and concealment of backdoor implantation; according to the method, the limitation of a black box is successfully bypassed by constructing the proxy model, and a new possibility is provided for an attacker. A backdoor generation process is integrated into a differentiable training framework through learnable discrete transformation, so that end-to-end learnability is realized, and an attack strategy can be automatically optimized.

The invention relates to the technical field of network security, and discloses an SDN (Software Defined Network)-based large-scale host vulnerability identification and attack response simulation method, which comprises the following steps of: 1, creating a network topology through a Mininet script; the method comprises the following steps of: 1, acquiring a host vulnerability identifier, 2, configuring vulnerability attributes for the host by using a JSON format in an SDN network environment, and 3, based on the host vulnerability identifier, selecting a corresponding attack strategy and executing a simulation attack, monitoring network flow and a host state in real time through an SDN controller, identifying an abnormal behavior and triggering a response mechanism. According to the method, the vulnerability attribute in the JSON format is configured for each host node, and an attacker is supported to detect and position the target host based on specific vulnerability characteristics by utilizing the centralized analysis capability of the SDN controller, so that the simulation capability of a network security simulation environment to a real attack scene is remarkably improved; the limitation that a traditional method is difficult to reflect vulnerability details is solved.

Methods for securing cyber-physical systems include attack generation systems, methods, and devices configured to assess vulnerabilities of cyber-physical systems include an example method of training an attack generative model using an attack policy to generate an attack dataset, training discriminators using a random attack dataset and generated attack dataset and training a generator using the trained discriminators.

A system and method for collaborative cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and creates a virtual network space that provides a virtual reality environment for collaborative insights into network dynamics during a cyberattack. makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a virtual network space model of the networked system created using a virtual network space manager. A simulation interaction server can facilitate secure sharing of virtual network spaces and simulations between and among various real and virtual actors to provide a collaborative space where one or more organization's network can be tested for resilience and mitigation. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

The invention discloses a large model output data security detection method and system based on adversarial attacks. The method comprises the following steps: constructing and optimizing a strategy space containing a plurality of attack strategies, and grading and sorting the strategies to improve the attack efficiency; generating a single-strategy antagonism prompt by the attack model according to the optimized strategy space, and performing effectiveness evaluation and feedback correction on the prompt by the judgment model; inputting a prompt passing the evaluation into the target large model to obtain a response, and performing malicious degree scoring on the response by the judgment model; and if the single-strategy attack is not successful, introducing an optimization mechanism based on a genetic algorithm, generating a more complex multi-strategy antagonism prompt through strategy variation and crossover, and carrying out iterative attack until the target large model is successfully broken into the prison. According to the method, the security defects of the large model can be efficiently and comprehensively detected in a self-adaptive and multi-strategy attack mode.

The invention provides a multi-mode adaptive attack test method and system for an automatic driving model, and the method comprises the steps: obtaining a to-be-tested automatic driving perception model uploaded by a user, and adapting the to-be-tested automatic driving perception model to a test environment through an automatic analysis technology; according to a test data set and an attack strategy selected by a user, generating a diversified test scene, and performing a multi-modal attack test on the to-be-tested automatic driving perception model; executing the multi-modal attack test by adopting a distributed computing architecture, and dynamically allocating computing resources to process a test task; and monitoring the process of the multi-modal attack test in real time, analyzing a test result, and generating a test report containing vulnerability analysis and optimization suggestions. According to the method, an intelligent and automatic test platform is constructed by aiming at a comprehensive robustness test of an automatic driving perception model and fusing style migration data enhancement, a self-adaptive multi-modal attack strategy and a distributed concurrent test technology.

The invention provides an attack and defense integrated method for large model prompt injection attacks, which comprises the following steps of: performing large model prompt injection attacks on user instructions by using an attack strategy based on emotion enhancement and control output to form malicious contents; the method comprises the following steps of: firstly, carrying out defense on malicious content, then fusing prevention strategies Sandwich and Instruction with a detection method Knowanswing, constructing a multi-level defense strategy UnD for cooperative work to carry out prompt injection defense on the malicious content to obtain an output result, and finally, carrying out effect evaluation by using an attack interference rate, an attack misleading rate, a METEOR score, a defense success rate and a known answer matching rate. According to the method, the prompt injection attack with higher attack efficiency is realized in the aspect of attack, the cooperation of detection and prevention is realized in the aspect of defense, the security of the large model facing the prompt injection attack is improved, and the large language model is ensured to safely and reliably run in various application scenes.

The invention relates to an optimal data transmission method for an unmanned ground vehicle, belongs to the technical field of unmanned vehicle control, and solves the problems of limitation of a static defense strategy and insufficient resource optimization of the unmanned ground vehicle in the aspect of safety protection. The method comprises the steps that a Stackelberg dynamic game model with an unmanned ground vehicle as a leader and an attacker as a follower is constructed, a defense target function and an attack target function are constructed respectively, iterative optimization is carried out, and when Stackelberg equilibrium is achieved, an optimal attack and defense strategy structural form is obtained; based on the optimal attack and defense strategy structural form, after the unmanned ground vehicle executes the optimal defense strategy at the current moment for data transmission, an attacker obtains the optimal attack strategy at the current moment based on the optimal defense strategy; and the unmanned ground vehicle adjusts the defense strategy of the unmanned ground vehicle according to the optimal attack strategy at the current moment, and obtains the optimal defense strategy at the next moment for data transmission.

The invention relates to the technical field of industrial control system network security, and discloses an industrial network attack strategy prediction and defense decision-making system, which comprises a semantic modeling module used for analyzing a configuration and communication file construction function and variable coupling hypergraph, and describing causal mapping from a network instruction to a physical variable; the dynamic evolution module is used for reconstructing a phase space based on the physical time sequence data, identifying an implicit coupling relationship and updating a hypergraph structure; the strategy prediction module is used for deducing a physical trajectory after instruction execution by combining the hypergraph and the phase space model, and judging a destructive attack strategy according to the maximum Lyapunov index; and the defense decision module triggers a virtual-real state bifurcation mechanism, generates an inertia compensation signal to maintain physical stability, and generates and constructs feedback data to cheat an attacker. According to the method, through cross-domain coupling modeling and dynamic deduction, physical destructiveness is accurately predicted, production maintenance and attack spoofing are considered through virtual-real bifurcation, and the reliability of defense decision making is effectively improved.

The invention relates to a big language model security detection system, device and equipment based on double-model adversarial evaluation, and the method comprises the steps: carrying out the variation of sensitive vocabularies through a dynamic load variation technology based on user configuration and an attack strategy template, generating diversified attack loads, and carrying out the recognition of a big language model according to the generated attack loads. Attack testing is carried out through a double-model adversarial evaluation architecture, model response content and a security judgment result are obtained, a risk score is calculated through a multi-dimensional quantitative scoring method according to the security judgment result, and a comprehensive security risk evaluation report is generated. According to the method, diversified hidden attacks are generated through a plug-in strategy library and a dynamic load variation technology; a double-model adversarial architecture is adopted, attack and detection roles are separated, an unbiased test closed loop is realized, multi-dimensional indexes are fused based on an information entropy-analytic hierarchy process, a risk assessment value is calculated, a report is generated, and scientific and accurate quantitative assessment of the security of the large language model is realized.

The present application relates to the technical field of neural networks, and discloses a model training method and apparatus, an electronic device and a storage medium. The model training method comprises: according to a determined attack strategy, controlling an attack network model to output an attack vector to an LLM model, wherein the attack vector is used for simulating an attack behavior for the LLM model; controlling a defense network model to be trained on the basis of the attack vector and response data to obtain an updated defense network model; and updating the LLM model on the basis of the updated defense network model.

The invention provides an attack data generation and large model training method and device, equipment and a storage medium, and belongs to the technical field of artificial intelligence, and the method comprises the steps: inputting guide content into an attack language model to obtain an attack prompt, determining the attack prompt with the highest attack success rate as a target attack, and collecting attack data related to the target attack prompt. According to the method, the attack language model is excited by the initial guide content to generate diversified attack prompts, and the most effective attack prompt is screened out based on the attack success rate to serve as the target attack prompt for data collection, so that various attack prompts can be automatically generated, and the workload of manually designing the attack prompts is reduced; in addition, the validity and quality of the collected attack data can be ensured through a screening mechanism, and a rich and accurate data basis is provided for subsequent model security evaluation and attack strategy optimization, so that potential vulnerabilities of the target language model can be found more comprehensively, and the security and reliability of the model are improved.

The invention discloses an survivability evaluation method, device and equipment of an SPN (Shortest Path Network) and a readable medium. Constructing an SPN network initialization model based on the actual SPN network operation state of the to-be-evaluated area, wherein the SPN network initialization model comprises network nodes corresponding to actually deployed transmission network elements and a network structure of IP routing connection relationships of the network nodes; setting node load and node capacity of each network node; setting at least one simulation attack strategy aiming at the SPN network initialization model; attacking the network nodes in the SPN network initialization model based on a simulation attack strategy, distributing the node load of the network node which fails after attack to other network nodes, and monitoring whether the redistributed network node is overloaded and fails until no new network node fails; and determining a survivability index based on the number of non-invalid nodes in the SPN network initialization model and the number of total network nodes, and performing survivability evaluation. According to the scheme of the invention, survivability evaluation for SPN network characteristics can be realized.

The invention relates to the technical field of Internet of Things data management, and discloses an intelligent Internet of Things visual centralized control system platform and method based on a digital twinborn technology, and the platform comprises a multi-source data collection module which outputs a physical equipment heterogeneous data stream with a timestamp; the data storage and management module is used for receiving the heterogeneous data stream and outputting a standardized data packet; the quantum edge processing module is used for performing cross-modal feature compression on the standardized data packet and outputting a dimension reduction feature flow; the causal fusion engine module is used for constructing a dynamic causal topology network based on the dimension reduction feature flow; an adversarial evolution twinborn body module; and a visual centralized control module. A three-level attack strategy of sensor spoofing, parameter tampering and cascading failure is optimized through a generative adversarial network, an attack vector is generated under the constraint of an equipment physical rule, the physical feasibility of an attack is verified through a discriminator, a conduction path of the attack in a causal topology is simulated, dynamic optimization and risk conduction deduction of the attack strategy are realized, and the risk conduction deduction of the attack strategy is realized. And the risk pre-judgment capability is improved.

A method and system for attack and defense based on dynamic simulation in chemical engineering includes: constructing an adversarial training environment for chemical equipment and processes using dynamic simulation units; setting attack and defense training parameters through a task configuration unit and generating corresponding fault interference test cases from a fault interference mode library; the attacker selecting a fault interference test case, adjusting the fault interference parameters using an attack strategy, and injecting it into the adversarial training environment; the defender receiving alarm information from the fault interference test cases and performing handling operations on them; and an evaluation unit performing real-time evaluation and display. This invention, through the deep integration of dynamic simulation technology and attack and defense mechanisms, upgrades chemical skills training from static procedure drills to dynamic engineering practice, providing core technical support for the cultivation of highly skilled personnel in the process industry, and has significant economic and social value.

The application discloses a failure analysis method and related device, electronic equipment and storage medium, wherein the failure analysis method comprises: detecting based on the description document of the target agent to obtain the design elements of the target agent; analyzing based on the failure mode knowledge base and each design element to determine the first element suspected of existing failure risk and the first risk degree of the first element in each design element; selecting the first element as the second element based on the first risk degree of each first element; generating the test session and the adjudication rule of the second element based on the attack strategy knowledge base and the second element; determining the test reply of the second element based on the adjudication rule of the second element to obtain the second risk degree of the second element. The above scheme can identify the failure risk of the agent in advance before the agent goes online, and quantize the failure risk.