223 results about "Attack strategy" patented technology

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

The invention discloses an automatic penetration test method, system and device based on deep reinforcement learning, and a medium, and the method comprises the steps: carrying out the vulnerability scanning and baseline verification of a device through employing a vulnerability scanning and baseline verification tool, and obtaining the vulnerability information of a tested system; generating an attack graph according to the obtained vulnerability information, determining a vulnerability utilization probability according to the vulnerability information, and assigning values to edges of the attack graph to obtain a Bayesian attack graph; designing an attacker target node reward value on the generated Bayesian attack graph, simulating a possible attack behavior of an attacker, and calculating an attack strategy of the attacker by using a deep reinforcement learning method; simulating potential attack behaviors of an attacker in the attack graph according to an attack strategy, and generating a penetration attack path which is most likely to be adopted by the attacker; and performing an automatic penetration test to generate a penetration test report. According to the invention, the penetration test scheme can be intelligently generated according to the vulnerability of the system, and the precision and efficiency of network security evaluation are greatly improved.

The invention discloses a data security dynamic protection method based on artificial intelligence, and relates to the field of network security, and the method comprises the steps: employing an anomaly detection algorithm to recognize malicious data streams and attack features according to a data stream log; according to the identified malicious data flow, a multi-agent reinforcement learning algorithm is adopted, and a protection strategy is adjusted through multiple agents according to the current environment state and attack characteristics; constructing a simulation environment, and training and evaluating an anomaly detection algorithm and a multi-agent reinforcement learning algorithm by generating a confrontation sample and a confrontation strategy; wherein the adversarial sample is generated by performing feature transformation on the malicious data stream and the normal data stream, and the adversarial strategy is generated by performing random disturbance on the existing attack strategy. In view of poor adaptability of a protection strategy for malicious data streams in the prior art, the malicious data streams and attack features are identified through an anomaly detection algorithm, and multi-agent reinforcement learning, collaborative optimization of flow control and a honeypot deployment strategy are adopted, so that the adaptability is improved.

The invention relates to the technical field of platform management, and discloses an internet-based financial service platform management method, which comprises the following steps: collecting static identity data, dynamic behavior data, biological characteristics and environmental parameters of a user in real time, and generating a multi-dimensional dynamic identity chain after desensitization aggregation; the attack-defense engine simulates an attack strategy by using a diffusion model, analyzes causal contradictions and topology aggregation coefficients in combination with a space-time diagram convolutional network, marks high-risk nodes, and iteratively optimizes model parameters everyday through reinforcement learning; quantum signature and alliance chain verification are adopted in the transaction link, transactions involving high-risk countries or transactions with the fund abnormal transfer probability exceeding 95% are automatically frozen, and compliance channels are switched; the biological monitoring module analyzes the physiological signal in real time and triggers a multi-mode challenge; and aggregating edge node data through a federated learning framework, and automatically rolling back to a historical optimal version when the false alarm rate of the updated global risk control model exceeds the standard. According to the invention, efficient management of the financial service platform can be realized.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

The invention provides a honey array defense resource allocation optimization method based on self-game reinforcement learning, and relates to the technical field of network security defense. The optimization method comprises the following steps: deploying defense resources based on network topology, and establishing a mapping relationship between a host and the defense resources; performing attack and defense confrontation simulation based on the mapping relation to obtain an initial attack strategy and an initial defense strategy; constructing a Markov game model based on the initial attack strategy and the initial defense strategy; performing self-game reinforcement learning on attack and defense training of the Markov game model based on a depth deterministic strategy gradient algorithm; and carrying out value evaluation on the attack and defense training based on an Actor-Critic algorithm to obtain an optimal defense resource allocation strategy. By implementing the optimization method provided by the invention, the defense party and the attack party can perform self-game reinforcement learning, the defense strategy is dynamically adjusted in confrontation, and the defense effect is improved.

Implementations include a computer-implemented method for mitigating cyber security risk of an enterprise network, the method comprising: receiving an analytical attack graph (AAG) representing paths within the enterprise network with respect to at least one target asset, the AAG defining a digital twin of the enterprise network and comprising a set of rule nodes, each rule node representing an attack tactic that can be used to move along a path of the AAG; integrating the AAG with a knowledge graph comprising a set of asset nodes, each asset node representing a digital asset that can be affected by one or more of the attack tactics; determining, based on integrating the AAG with the knowledge graph, a plurality of security controls, each security control having an assigned priority value; and selectively implementing the security controls in the enterprise network based on the assigned priority values of the security controls.

The invention provides a multi-mode black box attack method and device for a large visual language model, and the method is characterized in that the method comprises the steps: S1, constructing a corresponding system cue word and a dialogue template; s2, generating a first round of attack text prompt and attack image prompt for each attack strategy according to a jail break target structure and a visual language model; s3, generating a corresponding attack image according to the attack image prompt; s4, respectively inputting the attack image-text pairs into the target model to obtain corresponding response replies; s5, adding the corresponding attack image-text pairs and response replies to historical data; s6, judging whether the jailbreak attack succeeds or not, if yes, obtaining jailbreak image-text pairs, and if not, executing the step S7; and S7, generating a next round of attack text prompt and attack image prompt for the attack strategy of prison break failure, and executing the step S3. In a word, the method can generate the prison break image-text pairs and detect the safety performance of the visual language model.

The invention requests to protect a supply chain network toughness evaluation method based on a complex network theory, and aims to evaluate and optimize the toughness of a supply chain network under different attack strategies (such as random attack and deliberate attack) by establishing an evolution model of the supply chain network. According to the method, a network model with enterprises as nodes and cooperation relations as edges is established, key parameters (such as node degree, shortest path length and clustering coefficient) in a network structure are analyzed, and the stability and recovery capability of a supply chain under external impact are evaluated. By simulating different risk scenes, the structural performance, the efficiency performance and the recovery capability of the network are calculated and evaluated. The toughness evaluation method provides a new theoretical basis and technical means for supply chain risk management, and is helpful for improving the toughness of the supply chain network.

The invention discloses an energy internet intelligent key node identification and elasticity enhancement method and system, and the method comprises the steps: 1, constructing and dynamically maintaining a semantic enhanced energy internet digital twin super network and a multi-modal knowledge graph, fusing multi-dimensional information, and achieving the self-evolution and dynamic reasoning capability; 2, based on the model, fusing multi-time scale prediction data, and adaptively evaluating the dynamic comprehensive criticality of the node through an intention-function-resource-vulnerability four-layer penetrating traceability model; 3, aiming at the key nodes, generating an intelligent attack strategy by utilizing a generative adversarial network, deducing an information physical cascade failure process by combining multi-agent deep reinforcement learning, and quantitatively evaluating the system elasticity; and step 4, based on an evaluation result, generating a self-adaptive security reinforcement and dynamic reconstruction decision oriented to active immunity and elastic optimization. According to the method, the accuracy and the dynamism of key node identification can be remarkably improved.

A computer implemented security method security method is described, for detecting attacks on a system or network. The method comprises defining a sequence of attack tactics, each attack tactic representing a generalisation of a set of attack techniques, associating one or more attack detection rules with each of the attack techniques, detecting attack events based on the attack detection rules, correlating the detected attack events with the attack tactics based on the attack technique associated with the attack detection rule used to detect the attack events, linking the detected attack events based on one or more criteria, and identifying one or more paths of attack techniques through the sequence in dependence on the linked attack events. The identified paths of attack techniques represent kill chains. The present technique makes it possible to identify new kill chains of known techniques, as well as making it possible to identify high-risk kill chains.

The invention discloses an emergency lane changing dangerous scene generation method and system based on behavior guidance and a medium. The method comprises the following steps: constructing a track data set of vehicle emergency lane changing behaviors; training a behavior learning module with short sequence learning ability according to the trajectory data set; training an active attack strategy model through guidance of a behavior learning module; outputting a reference track point of the active attack vehicle through the active attack strategy model, and obtaining an optimal control input in a future time domain according to the reference track point and a preset prediction control model; and controlling the active attack vehicle to interact with the simulation platform according to the optimal control input, and generating an emergency lane changing dangerous scene. The method improves the generation efficiency of the emergency lane changing dangerous scene, thereby improving the efficiency of the automatic driving test, and can be applied to the technical field of automatic driving.

The invention provides an oil and gas production system virtual-real fusion attack and defense drilling system and method, a medium and equipment, and the system comprises a virtual-real simulation module which is used for simulating a field operation environment of an oil and gas production system, and maintaining a communication control relation between a regulation and control center and station equipment; receiving an attack instruction, and simulating the physical influence of the station yard equipment of the oil and gas production system under the attack condition; the local attack module is used for monitoring a network risk area of the oil and gas production system and calling an attack strategy instruction to initiate an attack instruction to a communication link or a control node in the network risk area; and the safety protection module is used for detecting the system abnormity of the station yard equipment in the simulation module, calling a protection strategy matched with the system abnormity to perform linkage protection and generating an attack and defense drill report. According to the invention, a high-fidelity experiment environment can be provided for attack penetration, active defense and emergency response faced by the oil and gas production system in a real scene, and the safety protection capability of the oil and gas production system is effectively guaranteed.

The invention discloses a virtual simulation and security evaluation method and system based on a network security target range, and the method comprises the steps: constructing a network asset knowledge graph for describing a virtualized target range environment through information collection; secondly, based on an attack strategy grammar rule base, adopting a Monte Carlo Tree Search (MCTS) algorithm to carry out intelligent attack simulation on the knowledge graph so as to discover a nonlinear and multi-stage attack path; thirdly, constructing a Bayesian attack graph (BAG) based on the knowledge graph, and performing probabilistic and systematic quantitative evaluation on the security risk of each asset node in the network through Bayesian reasoning; and finally, integrating the attack path and the quantitative risk value, and generating a comprehensive assessment report containing a visual path, a risk sequence and a reinforcement suggestion. According to the target range simulation method and device, the problems that existing target range simulation is insufficient in confrontation authenticity, one-sided in safety evaluation and lack of predictability are solved by combining the strategy simulation of the MCTS and the global quantitative analysis of the BAG.

The embodiment of the invention provides an information system security evaluation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evaluation index model corresponding to a security evaluation request, and obtaining a simulation system corresponding to a target information system; performing vulnerability scanning on the simulation system based on the scanning missing tool and the MDATA knowledge base to obtain a corresponding first scanning result and a corresponding second scanning result, and performing scanning result fusion analysis based on the MDATA knowledge base to obtain a system risk assessment result of the simulation system; obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and the expert knowledge base; the attack and defense test is performed on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test result, and the security evaluation result of the target information system is obtained based on the evaluation index model and the attack and defense test result, so that the accuracy of evaluating the information system is improved.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

The invention provides an Internet of Vehicles virus propagation defense strategy optimization method based on differential game, and belongs to the field of computer information security. The method comprises the following steps of: 1, establishing a node-level dynamic model according to a network topology structure of the Internet of Vehicles; 2, establishing a differential equation model for describing virus transmission according to states (a low-susceptibility state, a high-susceptibility state, an infection state and a recovery state) of nodes; 3, based on the game theory, analyzing the income and loss of attackers and defenders, and constructing a differential game model; and 4, solving an optimal strategy (Nash equilibrium) of the attack and defense parties by utilizing a Hamiltonian function and combining a Pontryagin optimal value principle. And 5, through experiments, comparing the proposed method with a uniform strategy and an uncertain attack strategy, and verifying the effectiveness and superiority of the model in an actual Internet of Vehicles environment.

The invention discloses a defense strategy self-generation method and system for an intelligent device cluster, and belongs to the technical field of intelligent device cluster network security. The system comprises a network modeling module, an attack strategy integration module and a defense strategy dynamic generation module. The method comprises the following steps: constructing a network attack and defense game model to represent a network attack and defense scene of a current intelligent equipment cluster; acquiring a network topology of the intelligent device cluster, and selecting an attack strategy and an action path according to the network topology; and executing an attack behavior on the intelligent equipment cluster according to the attack strategy, obtaining a defense matrix of the current intelligent equipment cluster and the quantized detection capability of each network node cluster by a defense strategy dynamic generation module, and generating a defense strategy by adopting a deep reinforcement learning model. According to the invention, the problems of poor adaptability, insufficient collaboration, unreasonable resource scheduling and the like in the traditional defense technology of the intelligent equipment cluster network are solved, and the overall efficiency of network security defense is greatly improved.

The invention relates to an unmanned aerial vehicle threat intention prediction method and device and a storage medium, and is applied to the technical field of anti-unmanned aerial vehicles. The method specifically comprises the steps that through multi-modal deep feature fusion and deep adversarial learning, the system can extract deeper and more abstract unmanned aerial vehicle behavior mode features from multi-source heterogeneous data, so that accurate prediction of the real threat intention of the unmanned aerial vehicle is achieved, the limitation that a traditional method is only based on surface feature judgment is overcome, and the accuracy of the unmanned aerial vehicle threatening intention prediction is improved. The transformation of threat assessment from post-event analysis to pre-event prediction is realized; in the deep adversarial learning framework, various complex unmanned aerial vehicle threat behavior modes including disguise, interference and novel attack strategies can be simulated, and meanwhile, the recognition capability is continuously improved in adversarial training, so that the system can still keep high accuracy and low false alarm rate when facing unknown or variable threats, and the safety of the system is improved. And the robustness and adaptability of the system are obviously enhanced.

The invention provides a network attack defense method and device and electronic equipment. The method comprises the following steps: constructing a camouflage network; obtaining an attack strategy and a defense strategy; resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies are obtained; constructing constraint conditions of strong epsilon equilibrium of the Stackelberg game based on the camouflage network, the attack strategies, the defense strategies, resource costs corresponding to different attack strategies and defense strategies and attack and defense benefits; respectively calculating and determining strong epsilon equilibrium corresponding to different attack strategies and defense strategies by combining constraint conditions for different attack strategies and defense strategies; establishing a matching relationship between an attack strategy and a defense strategy corresponding to strong epsilon equalization meeting a preset requirement; and when the target attack strategy attacks, determining a target defense strategy based on the matching relationship, and executing the target defense strategy. According to the method, effective defense can be carried out when an attacker in any condition issues an attack, and the defense effect is improved.

The invention provides a random game-based host scanning and defense strategy collaborative optimization method, and relates to the technical field of network security. The host scanning and defense strategy collaborative optimization method comprises the following steps: defining an attack action space and an attack strategy of an attacker; defining a defense action space and a defense strategy of a defender; defining a game state and a state transition rule of each time step of the attacker and the defender; calculating instantaneous rewards of the attacker and the defender based on the game state; initializing Q tables of attacking and defending parties; solving the Nash equilibrium of each time step by using a Lemke-Howson algorithm, and determining the optimal action of the attack and defense parties; calculating the total income of the attacker and the defender based on the instantaneous rewards of the attacker and the defender, and selecting an optimal strategy; and solving based on Nash Q-Learning to obtain an equilibrium strategy of the whole game process. According to the method, strategies of attackers and defenders are updated in real time through the game state, a balance strategy is finally obtained, and response efficiency and detection accuracy are effectively improved.

The invention discloses a smart power grid false data injection identification method based on deep reinforcement learning. The intelligent power grid false data injection identification method based on deep reinforcement learning comprises the following steps that a preset node in a power grid is selected as a reference node, a system node state set is obtained, and the system state set comprises a phase angle of a system at a detection moment and a measurement value of a detector at the detection moment; constructing a direct-current power grid system model based on the system node state set, and defining an attack strategy in the direct-current power grid system model; randomly selecting the system node state set as initial sample data, inputting the initial sample data into the direct-current power grid system model, and obtaining a countermeasure sample in combination with a deep Q learning algorithm; and building a multi-layer attack detection algorithm framework to train the adversarial sample to obtain a power grid hostile attack recognition model. According to the method, the problem of low false data attack detection precision is solved through adversarial sample generation and a multi-level attack detection algorithm framework.

The invention discloses an unmanned aerial vehicle collision countering method and system, and relates to the technical field of unmanned aerial vehicles, and the method comprises the following steps: obtaining the position coordinates of a target vehicle, controlling a collision unmanned aerial vehicle to fly to the region of the target according to the position coordinates of the target vehicle, and searching the target vehicle after reaching the region of the target, after the target machine is found, the position information of the target machine is locked; the unmanned aerial vehicle locks and tracks a target and then calculates an optimal attack path, and the unmanned aerial vehicle starts to execute an attack strategy according to the optimal attack path; after the task is executed, whether task execution succeeds is judged, if yes, self-inspection is conducted on the self state, whether the next task can continue to be completed or not is confirmed, if yes, the task continues to be executed, and if not, automatic homeward voyage is conducted; if the task fails, repeating the previous step until the task is completed; according to the invention, the interception system gives consideration to automatic search, automatic identification, automatic locking, automatic attack, self-adaptive attack strategy and long endurance.

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost / benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost / benefit indicators.

A black box code search model backdoor attack method based on learnable discrete code transformation comprises the steps that a learnable backdoor generator is constructed, and malicious codes with backdoors are generated on the premise that internal parameters of a damaged model are not accessed through the learnable discrete code transformation. Firstly, an agent model capable of simulating victim model behaviors is trained through query-response data; secondly, on the proxy model, a discrete selection process is differentiable by using a re-parameterization sampling technology, and a backdoor generator is trained in combination with a multi-objective loss function so as to realize effectiveness and concealment of backdoor implantation; according to the method, the limitation of a black box is successfully bypassed by constructing the proxy model, and a new possibility is provided for an attacker. A backdoor generation process is integrated into a differentiable training framework through learnable discrete transformation, so that end-to-end learnability is realized, and an attack strategy can be automatically optimized.

The invention relates to the technical field of network security, and discloses an SDN (Software Defined Network)-based large-scale host vulnerability identification and attack response simulation method, which comprises the following steps of: 1, creating a network topology through a Mininet script; the method comprises the following steps of: 1, acquiring a host vulnerability identifier, 2, configuring vulnerability attributes for the host by using a JSON format in an SDN network environment, and 3, based on the host vulnerability identifier, selecting a corresponding attack strategy and executing a simulation attack, monitoring network flow and a host state in real time through an SDN controller, identifying an abnormal behavior and triggering a response mechanism. According to the method, the vulnerability attribute in the JSON format is configured for each host node, and an attacker is supported to detect and position the target host based on specific vulnerability characteristics by utilizing the centralized analysis capability of the SDN controller, so that the simulation capability of a network security simulation environment to a real attack scene is remarkably improved; the limitation that a traditional method is difficult to reflect vulnerability details is solved.

The invention belongs to the field of machine learning, and discloses a delay attack confrontation sample generation method of a visual perception system and a related device, and the method comprises the steps: obtaining an original image set and target tracker parameters of the visual perception system; according to target tracker parameters of the visual perception system, obtaining an attack strategy based on the original image set by taking maximization of delay time of a target tracker of the visual perception system as an optimization target; with minimization of a loss function value of a target detection model of the visual perception system as an optimization target, generating general adversarial disturbances of which the number is the same as the number of attack areas of the attack strategy; and adding general adversarial disturbance into the original image set according to an attack strategy to obtain a visual perception system delay attack adversarial sample set. The high attack success rate of the delayed attack confrontation sample to the visual perception system is realized, and the method can be used as a basis for evaluating the safety and effectiveness of the visual perception system and can be used for perfecting and optimizing the visual perception system.

Methods for securing cyber-physical systems include attack generation systems, methods, and devices configured to assess vulnerabilities of cyber-physical systems include an example method of training an attack generative model using an attack policy to generate an attack dataset, training discriminators using a random attack dataset and generated attack dataset and training a generator using the trained discriminators.

The invention discloses a method for defending Chinese text adversarial attacks based on a soft hint tuning model, which comprises the following steps of: 1) generating target domain data by using five Chinese-specific text attack strategies, and introducing a source domain and a target domain to simulate an original text and an adversarial text; 2) training an initial soft prompt tuning model based on a small amount of source domain data, and distributing a pseudo tag for a target domain instance; 3) dividing the target domain instance into n subsets, obtaining n tags of the target domain instance through multiple iterations, and analyzing syntactic features in combination with a graph attention model; and 4) selecting consistent labels in multiple iterations through a voting mechanism to serve as final training data for model training, and realizing classification prediction of the Chinese adversarial text. According to the method, an initial model is trained through a small amount of source domain data, real label information of a target domain is revealed, and accurate classification is realized through a voting mechanism and a soft prompt tuning model of graph attention enhanced Chinese grammar features.