176 results about "Attack surface" patented technology

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

The invention relates to the technical field of automobile network security, in particular to an intelligent networked automobile penetration test path generation method and system based on a knowledge graph, and the method comprises the steps: constructing an intelligent networked automobile intranet penetration test security knowledge graph through fusing multi-source heterogeneous data based on an intranet E / E architecture; generating a potential attack path based on the knowledge graph by using a depth-first search algorithm of dynamic pruning optimization; a multi-dimensional space-time risk assessment framework is utilized to quantify path threat intensity and execution feasibility, and quantitative assessment on the generated attack path is realized; and according to an evaluation result, selecting a high-risk and feasible attack path to carry out an actual penetration test, and discovering security vulnerabilities and weaknesses in the system. According to the method, the attack surface is fully covered, the high-value attack path is efficiently generated, the threat intensity and the execution feasibility are accurately and quantitatively evaluated, and the safety test efficiency and accuracy of the intelligent network connection automobile intranet are remarkably improved.

The invention discloses a network risk assessment model construction method and system based on an AI large model, and relates to the technical field of artificial intelligence and network security, and the method comprises the following steps: S1, a participating node splits a large model into a plurality of semantic independent fragmentation units through a dynamic fragmentation mechanism based on local multi-source heterogeneous data; according to the network risk assessment model construction method and system based on the AI large model, through a dynamic fragmentation federated distillation learning framework, the inherent contradiction between data privacy protection and AI large model training efficiency in cross-mechanism cooperation is effectively solved. A ten-billion-level parameter model is disassembled into semantic independent units by adopting a self-adaptive parameter fragmentation mechanism, the communication overhead is reduced on the premise of ensuring physical isolation of sensitive data in combination with a local differential privacy and parameter confusion technology, and meanwhile, cross-domain fusion of threat features and attack surface blind spot detection are realized through a layered distillation verification system. And the APT attack detection rate is improved.

The invention relates to an intelligent network attack surface prediction method and system based on deep learning, and belongs to the technical field of network security and information, and the method comprises the steps: obtaining network asset information, vulnerability distribution information and external threat intelligence data in a target network environment, and carrying out the preprocessing to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a feature vector related to the network attack; reasoning and analyzing a potential attack link based on the feature vector and the knowledge graph, and combining an association relationship among a network asset node, a vulnerability node and a threat intelligence node in the knowledge graph; and finally, according to a reasoning analysis result, evaluating an intrusion path possibly utilized by an attacker, outputting an attack surface prediction result, and presenting the attack surface prediction result in the form of an attack path list. According to the scheme, a potential attack link can be subjected to deep reasoning analysis, an intrusion path possibly utilized by an attacker can be accurately predicted, and the effectiveness of network security protection is improved.

The invention discloses a security event traceability system and method based on attack chain analysis, relates to the technical field of data security protection, and is used for realizing multi-level perception of attack activities by building a multi-modal killing chain probe matrix as a structured data basis. Modeling analysis is carried out on attack behaviors of different levels through a deep heterogeneous feature extraction architecture, multi-dimensional features are fused into a cross-layer joint feature vector, a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector, the propagation path and probability of APT attack are simulated, a high-dimensional attack curved surface is drawn, and a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector. And key path nodes and potential transverse diffusion directions are identified, and a defense strategy knowledge graph is constructed according to a modeling result. The traceability system breaks through barriers among threat detection, attack understanding and defense response through a stage linkage mode of'probe sensing-intention recognition-path modeling-defense deduction ', and realizes accurate traceability and efficient disposal of security events.

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.

The invention provides an efficient multi-dimensional network penetration testing method based on RAG, which comprises the following steps: firstly, identifying sub-domain names possibly existing in a target website, and sequentially expanding attack surfaces of penetration testing to obtain vulnerability information pairs; secondly, a design model generated based on retrieval enhancement is adopted, vulnerability information pairs are extracted from the queue to be utilized, knowledge items related to local knowledge base retrieval and network intelligent search retrieval are utilized, and finally, a large model generates vulnerability utilization information according to the knowledge items; acquiring target machine permission for the previously acquired vulnerability information pair construction command injector, and further scanning other hosts of the intranet accessed by the target skipping machine; finally, combining vulnerability information obtained by penetration testing, utilizing a large model to sort vulnerabilities existing in different assets, and outputting penetration testing reports for different assets. According to the method and the system, comprehensive penetration testing of cross-network and cross-system is realized, security experts are helped to quickly identify, verify and repair vulnerabilities in a complex and changeable network environment, and high-efficiency and low-cost network security maintenance is realized.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

A system and method for detecting persistent digital assets in an attack surface of a networked computing environment is disclosed. The method includes: continuously detecting digital asset information from a networked computing environment; updating a representation of a digital asset in response to determining that the digital asset information corresponds to a previously detected digital asset; and generating a representation of a digital asset in response to determining that the digital asset information corresponds to a new digital asset.

A cloud-based, external attack surface management (or EASM) service identifies computers, servers, smartphones, and other devices that are exposed to the public Internet. Any device that can connect to the public Internet may be vulnerable to cybersecurity attacks. The EASM service identifies a device exposed to the public Internet by comparing connection notifications to an address scan of the entire Internet. The connection notifications are sent by cybersecurity sensory agents installed at client devices. When a connection notification and the address scan of the entire Internet references a matching IP address and / or a matching port within a timeframe, the corresponding device is identified as being exposed to the public Internet.

The invention discloses a dynamic attack surface transformation active defense system for a production system, and relates to the field of network security, the active defense system comprises a system support module, an interface interpreter module, a moving target construction module, a dynamic arrangement module, a management module, an information processing module and a threat monitoring module; the system support module provides network service, file system and user account camouflage functions and converts the functions into standard interfaces through the interface interpreter module to be called by the upper layer module, and the moving target construction module interacts with the system support module through an interface interpreter and supports dynamic arrangement of camouflage resources. The dynamic arrangement module adjusts attack surface features of system resources according to real-time threat information provided by the threat monitoring module, when the threat monitoring module finds potential attacks, threat information is transmitted to the management module, the dynamic arrangement module is triggered to carry out adjustment, and the information processing module records logs and displays system states and threat alarms. And administrators are assisted to make decisions.

The invention provides a vulnerability priority determination method and device and an attack surface management system, and relates to the technical field of vulnerability processing. According to the method, the vulnerability risk analysis model compatible with the service attribute, the vulnerability attribute and the protection attribute is designed, so that the vulnerability risk score of the system which is low in service value and already executes the security protection strategy is reduced, and the vulnerability repair priority of the system is later; according to the method, enterprises can focus on high-service-value and high-availability vulnerability repair for protecting missing assets, the accuracy of vulnerability risk assessment is improved, and the protection efficiency is improved. Furthermore, for the score of each vulnerability risk assessment index under the protection attribute, the security protection coverage condition is considered, whether a security protection failure point (such as strategy configuration failure) exists or not, namely whether security protection can take effect truly or not, is considered in a more refined manner, the accuracy and reliability of security protection are improved, and the security protection efficiency is improved. And vulnerability protection of the system is more accurate and effective.

The invention discloses a mimicry defense driven network endogenous security protection method, which solves the problems of fixed attack surface, high key management risk and insufficient self-healing capability of the traditional network static architecture. The method comprises the steps that hardware, a system and an application layer multilevel heterogeneous execution body are constructed, a unique identifier is distributed, and the state is monitored through heartbeat; the heterogeneous requests are stored in a red-black tree cache after being subjected to standardization processing; performing dynamic voting based on weighted majority in a 100-millisecond window, and isolating an executor and recording a block chain log when the executor is abnormal; the response integrity is verified through ECDSA signature, if the response is greater than or equal to half of the execution bodies, the response is consistent, and otherwise, a rollback mechanism is triggered; and periodically or event-driven dynamically reconstructing an executor pool, and combining a two-stage key alternation system of a transmission private key and a root public key. According to the method, the network endogenous security is improved through dynamic heterogeneous redundancy and automatic closed-loop protection.

Infrastructure for zero trust network access (ZTNA) is deployed as a cloud-based service remotely from a customer premises where user applications are hosted. By connecting an appliance on the customer premises to the cloud-based service through a secure tunnel or the like, an application hosted on the customer premises can then be accessed externally as a ZTNA application without the customer premises opening a firewall to public networks or otherwise exposing potential attack surfaces to the customer premises.

Techniques are disclosed for predicting cybersecurity vulnerabilities automatically in IT assets / targets based on known vulnerabilities of various available technologies / products. This is accomplished by loading and linking one or more ontologies in a graph database containing vulnerability information about the technologies. The assets / targets preferably belong to a bug-bounty program. An optional discovery tool maps the attack surface of each target. A profiler collects the various technologies or traits used by the target and links them to the target. Then the graph database is queried to predict the cybersecurity vulnerabilities associated with the traits and consequently with the targets. The system is preferably implemented with a service-oriented architecture (SOA) so feedback / predictions can be provided to the user in near / real-time.

A system and method for determining digital asset security from an external attack surface. The method includes: continuously detecting digital asset information from a networked computing environment; continuously determining a cybersecurity severity score for a digital asset based on the detected digital asset information; continuously determining an asset exposure score for the digital asset based on the detected digital asset information; continuously determining an asset importance score for the digital asset based on the detected digital asset information; generating a digital asset security score based on: the determined cybersecurity severity score, the asset exposure score, and the asset importance score.

The invention relates to the technical field of model construction, in particular to a construction method of an attack and defense model of a power system. The method comprises the following steps: acquiring structural data of a power system; performing structure topology modeling on the power system structure data to generate power system topology structure modeling data; carrying out attack surface identification on the modeling data of the topological structure of the power system to generate attack point data of the structure of the power system; performing power system network security modeling based on the power system structure attack point data and the power system topological structure modeling data to generate power system network security modeling data; acquiring historical intrusion data of the power system; and performing attack path analysis on the historical intrusion data of the power system to generate attack type path data of the power system. According to the method, through combination of electric power system structure modeling, historical intrusion data analysis, attack simulation, game analysis and vulnerability repair, the accuracy of attack and defense modeling and the dynamic performance of defense are improved.

The invention discloses an external field equipment trusted access method based on a non-addressable stealth gateway, which relates to the technical field of network security access, and comprises the following four steps: in a manufacturing period and first access, a certificate authorization machine binds equipment identity and trusted platform module measurement, policy decision point decision, policy execution point implementation and policy subset loading; initiating from the outside of the equipment, establishing an end-to-end trusted channel with the center, and performing inward isolation and transparent bearing on rear-end real services; updating strategies, algorithms and secret keys on line under the control of a unified strategy library; according to the method, the attack surface is reduced, the transformation cost is reduced, non-stop treatment is ensured, the encrypted traffic can be observed and audited, only trusted equipment can reach the center through a trusted channel, and event linkage right descending and certificate state linkage treatment are supported.

The invention relates to the technical field of computers, and discloses an ecological compensation data value-oriented hierarchical security policy and hierarchical cloud storage system.The method comprises the steps that firstly, security isolation of a virtual network is ensured, technologies such as a virtual network security group and a virtual firewall are adopted, and communication between virtual machines and communication between the virtual machines and an external network are limited; reducing potential attack surfaces, performing security detection on virtual machine images in a resource pool, including verifying integrity and credibility of the images, scanning malicious software, ensuring that image files do not contain known viruses, Trojan horses or malicious software, monitoring behaviors of virtual machines in the resource pool, and using an intrusion detection system (IDS) or a behavior analysis technology. Abnormal behavior, malicious activity or potential security threats are detected. According to the method, the particularity and the security requirement of a virtualization environment are considered specially for the construction requirement of the computing power network security resource pool. According to the method, security risks related to the computing power network can be detected and evaluated more accurately, and the comprehensiveness is high.

The invention discloses an Android attack surface exploration method based on AOSP static analysis, and belongs to the field of mobile terminal security analysis. Comprising an attack point list acquisition module, a file system traversal module and a service dependency relationship generation module. The attack point list acquisition module extracts an AIDL interface method list through a compilation command tracking technology, identifies Content Provider and Broadcast attack points by using a static analysis technology, and generates a detailed attack point information list; the file system traversal module traverses a complete file system through a root permission, and screens user-mode accessible files in combination with the file permission; and the service dependency relationship generation module constructs a dependency relationship graph between the service interfaces by combining the generation dependency relationship and the variable dependency relationship. According to the method, the potential attack points of the Android system can be comprehensively and systematically identified, the dependency relationship between the interface and the service is established, and support is provided for vulnerability mining, security audit and authority management optimization.

The invention provides a dynamic defense switching period optimization method and device, a medium and electronic equipment, and the method comprises the steps: initializing defense resources and attack surface reset time, and defining a strategy space constraint of a defense switching period; defining a game framework; constructing an attack and defense revenue function; initializing a particle swarm, calculating the fitness value of each particle, iteratively updating the speed and position of the particle, calculating the fitness value of the updated particle, and judging whether to update the individual optimal solution and the global optimal solution according to the updated particle fitness value, the original individual optimal solution and the global optimal solution; when a preset iteration termination condition is met, iteration is terminated, and a Nash equilibrium strategy of the attacker and the defender is obtained; and extracting a switching period from the Nash equilibrium strategy as an optimal dynamic defense switching period. By applying the method, the dynamic counterbalance relationship between attacker and defender strategies can be comprehensively analyzed, and the optimal dynamic defense switching period capable of giving consideration to the defense effect and the system stability can be obtained.

The invention relates to the technical field of network security and communication, in particular to a security communication platform and method constructed based on security control and trusted network connection. The security communication platform comprises a security management and control center platform, a trusted password service platform, a trusted network connection optimization architecture, a distributed network architecture, a security shared memory mechanism, an application cluster system and a trusted VPN function module, the security management and control center platform is deployed in a core network, and a trusted platform module is arranged in the security management and control center platform as a global trusted root. By constructing an integrated platform of the trusted security management and control system and the secure and trusted intelligent VPN, triple security assurance of trusted access terminal, trusted network connection and trusted data transmission can be realized, and the requirements of a key information system on high security, high reliability and high adaptation of network communication are met; the defects of the traditional VPN in the aspects of attack surface control, encryption capability, identity authentication, systematic defense and the like are overcome.

The invention discloses a power Internet of Things terminal attack path prediction method and system, and belongs to the technical field of power Internet of Things terminal security state evaluation. According to the power Internet of Things terminal attack path prediction method based on the state machine and the attack graph, the vulnerability recognition model, the attack graph generation model, the attack division model and the attack mapping model are constructed, and the attack path is predicted and simplified by using the finite state machine and the Bayesian attack graph; therefore, the complexity of predicting the attack path in a large-scale network environment can be effectively reduced, so that the requirement on the data processing capability of hardware can be effectively reduced, the processing time is greatly shortened, and the attack behavior can be quickly responded. According to the method, the identification and defense capabilities of potential network threats are improved, and the method is particularly suitable for processing a large-scale and high-complexity network environment, so that a security team can effectively quantify the security state of each attack surface when the attack surface is attacked, and adopts targeted defense measures.

Disclosed is a method for implementing a Zero Trust Architecture (ZTA) to secure network resources by eliminating lateral threat movement and minimizing attack surfaces. A zero trust policy engine, positioned inline between user devices and network resources, receives and evaluates access requests by verifying user and device identities along with context information. Based on dynamic risk scores derived from these evaluations, the engine enforces least-privileged, identity-based access policies, selectively granting access exclusively to authorized resources. Connections are terminated and re-established through secure proxy techniques, with continuous inspection of traffic for threats and data loss. Adaptive security measures, including isolation through pixel-streaming and context-aware access adjustments, further enhance protection. This architecture integrates seamlessly with cloud-based security service platforms, supporting workload-to-workload security, external entity integration, and comprehensive compliance reporting through audit trails and dashboards.

The invention belongs to the technical field of nuclear power, and particularly relates to an asset risk assessment method and device based on an attack surface and graph centrality. According to the method provided by the invention, on the basis of traditional vulnerability severity assessment, an asset attack surface measurement and graph centrality analysis method is introduced, and vulnerability availability, attack path transmissibility and structure importance of assets in a network are organically fused, so that an asset risk assessment mechanism closer to a real threat environment is formed. Through the method, high-risk vulnerability assets can be identified, nodes having key effects on attack diffusion in the network can be highlighted, and accurate quantification and sorting of risks are realized. The attack surface is closely combined with the network structure; the attack graph analysis fully embodies the key node effect; and the vulnerability severity and the utilization probability are fully fused. And the asset risk level in the network environment can be reflected more accurately.

Predicting attack paths using code analysis, including: detecting a vulnerability in code by performing a static code analysis of the code; identifying an attack surface for the vulnerability in a cloud deployment; and generating an alert for the vulnerability by assigning a priority to the alert based on the attack surface.

Methods, systems, and apparatus may be provided for a configuration integration component (CIC) that integrates security policies for security scanning of computing machines in a sequestered network of an entity using a proprietary security scanning application with the security scanning of computing machines in an enterprise network of the entity using a security scanning application of a third-party vendor. Controls, including parameters, for the proprietary security scanning application may be obtained by the CIC based on controls provided in a security scanning application of a third-party vendor. The CIC may use the obtained controls and a library that maps the same or similar controls from the vendor application to the proprietary application to generate a configuration file that may be exported, such as via the enterprise network, to the sequestered network to scan attack surfaces of the computing machines in the sequestered network.