228 results about "Attack surface" patented technology

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

The invention provides a firewall attacked surface carding and security reinforcing method, which comprises the following steps of: protecting sensitive data in each link of data flow in an identified supply chain, deploying a data leakage prevention gateway on a data flow link, and adopting deep packet detection of content awareness to carry out security reinforcement on the data flow link. Visualized presentation and security auditing of data flow behaviors are realized, and abnormal data flow is blocked and alarmed; the method comprises the following steps: constructing a security policy configuration knowledge base, mapping service description into a security policy component, automatically generating a fine-grained security policy matched with service semantics by adopting a policy generation engine based on combination of rules and deep learning, and realizing cross-scene policy conflict detection and correction by virtue of reasoning of a constructed knowledge graph.

Various embodiments include a system that discovers hidden Application Programming Interfaces (APIs) and detects security vulnerabilities in the hidden APIs. The system accesses Cloud Security Posture Management (CSPM) logs and discovers APIs based on the logs. The system identifies additional APIs that are not present in the CSPM logs. The system initiates API calls using modified addresses for the discovered APIs to discover hidden APIs. The system tests the discovered APIs to determine attack surfaces in the discovered APIs. The system generates a report that identifies the discovered APIs and that indicates the attack surfaces.

Techniques described herein pertain to prioritizing threats based on their potential effect on the specific enterprise network sought to be protected. In one example, this disclosure describes a method that includes collecting, by a computing system and from a plurality of external data sources, threat information; storing, by the computing system and in a threat registry, the threat information that includes information about a plurality of threats; collecting, by the computing system, information about an attack surface for an enterprise network; mapping, by the computing system, the threat information to the attack surface; analyzing, by the computing system and based on the mapping of the threat information to the attack surface, a threat included in the plurality of threats to identify a risk score associated with the threat, wherein the risk score represents an assessment of the vulnerability of the enterprise network to the threat.

The invention relates to the technical field of automobile network security, in particular to an intelligent networked automobile penetration test path generation method and system based on a knowledge graph, and the method comprises the steps: constructing an intelligent networked automobile intranet penetration test security knowledge graph through fusing multi-source heterogeneous data based on an intranet E / E architecture; generating a potential attack path based on the knowledge graph by using a depth-first search algorithm of dynamic pruning optimization; a multi-dimensional space-time risk assessment framework is utilized to quantify path threat intensity and execution feasibility, and quantitative assessment on the generated attack path is realized; and according to an evaluation result, selecting a high-risk and feasible attack path to carry out an actual penetration test, and discovering security vulnerabilities and weaknesses in the system. According to the method, the attack surface is fully covered, the high-value attack path is efficiently generated, the threat intensity and the execution feasibility are accurately and quantitatively evaluated, and the safety test efficiency and accuracy of the intelligent network connection automobile intranet are remarkably improved.

The invention discloses a network risk assessment model construction method and system based on an AI large model, and relates to the technical field of artificial intelligence and network security, and the method comprises the following steps: S1, a participating node splits a large model into a plurality of semantic independent fragmentation units through a dynamic fragmentation mechanism based on local multi-source heterogeneous data; according to the network risk assessment model construction method and system based on the AI large model, through a dynamic fragmentation federated distillation learning framework, the inherent contradiction between data privacy protection and AI large model training efficiency in cross-mechanism cooperation is effectively solved. A ten-billion-level parameter model is disassembled into semantic independent units by adopting a self-adaptive parameter fragmentation mechanism, the communication overhead is reduced on the premise of ensuring physical isolation of sensitive data in combination with a local differential privacy and parameter confusion technology, and meanwhile, cross-domain fusion of threat features and attack surface blind spot detection are realized through a layered distillation verification system. And the APT attack detection rate is improved.

The invention relates to an intelligent network attack surface prediction method and system based on deep learning, and belongs to the technical field of network security and information, and the method comprises the steps: obtaining network asset information, vulnerability distribution information and external threat intelligence data in a target network environment, and carrying out the preprocessing to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a feature vector related to the network attack; reasoning and analyzing a potential attack link based on the feature vector and the knowledge graph, and combining an association relationship among a network asset node, a vulnerability node and a threat intelligence node in the knowledge graph; and finally, according to a reasoning analysis result, evaluating an intrusion path possibly utilized by an attacker, outputting an attack surface prediction result, and presenting the attack surface prediction result in the form of an attack path list. According to the scheme, a potential attack link can be subjected to deep reasoning analysis, an intrusion path possibly utilized by an attacker can be accurately predicted, and the effectiveness of network security protection is improved.

The invention discloses a security event traceability system and method based on attack chain analysis, relates to the technical field of data security protection, and is used for realizing multi-level perception of attack activities by building a multi-modal killing chain probe matrix as a structured data basis. Modeling analysis is carried out on attack behaviors of different levels through a deep heterogeneous feature extraction architecture, multi-dimensional features are fused into a cross-layer joint feature vector, a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector, the propagation path and probability of APT attack are simulated, a high-dimensional attack curved surface is drawn, and a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector. And key path nodes and potential transverse diffusion directions are identified, and a defense strategy knowledge graph is constructed according to a modeling result. The traceability system breaks through barriers among threat detection, attack understanding and defense response through a stage linkage mode of'probe sensing-intention recognition-path modeling-defense deduction ', and realizes accurate traceability and efficient disposal of security events.

A system and method for dynamic authentication attack detection an enforcement at the network, application, and host level that enables zero trust network security principles when combined with stateful authentication object tracking, authentication object manipulation and forgery7 detection, and assessment of authentication and identity7 attack surface. The methodology involves gathering all authentication objects issued by a network, storing the authentication objects in a centralized location for use in stateful deterministic authentication object tracking, scoring the completeness of the authentication risk observations, and intervening in authentication processes when the potential risk is too great.

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.

The invention provides an efficient multi-dimensional network penetration testing method based on RAG, which comprises the following steps: firstly, identifying sub-domain names possibly existing in a target website, and sequentially expanding attack surfaces of penetration testing to obtain vulnerability information pairs; secondly, a design model generated based on retrieval enhancement is adopted, vulnerability information pairs are extracted from the queue to be utilized, knowledge items related to local knowledge base retrieval and network intelligent search retrieval are utilized, and finally, a large model generates vulnerability utilization information according to the knowledge items; acquiring target machine permission for the previously acquired vulnerability information pair construction command injector, and further scanning other hosts of the intranet accessed by the target skipping machine; finally, combining vulnerability information obtained by penetration testing, utilizing a large model to sort vulnerabilities existing in different assets, and outputting penetration testing reports for different assets. According to the method and the system, comprehensive penetration testing of cross-network and cross-system is realized, security experts are helped to quickly identify, verify and repair vulnerabilities in a complex and changeable network environment, and high-efficiency and low-cost network security maintenance is realized.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

A system and method for detecting persistent digital assets in an attack surface of a networked computing environment is disclosed. The method includes: continuously detecting digital asset information from a networked computing environment; updating a representation of a digital asset in response to determining that the digital asset information corresponds to a previously detected digital asset; and generating a representation of a digital asset in response to determining that the digital asset information corresponds to a new digital asset.

A cloud-based, external attack surface management (or EASM) service identifies computers, servers, smartphones, and other devices that are exposed to the public Internet. Any device that can connect to the public Internet may be vulnerable to cybersecurity attacks. The EASM service identifies a device exposed to the public Internet by comparing connection notifications to an address scan of the entire Internet. The connection notifications are sent by cybersecurity sensory agents installed at client devices. When a connection notification and the address scan of the entire Internet references a matching IP address and / or a matching port within a timeframe, the corresponding device is identified as being exposed to the public Internet.

The invention discloses a dynamic attack surface transformation active defense system for a production system, and relates to the field of network security, the active defense system comprises a system support module, an interface interpreter module, a moving target construction module, a dynamic arrangement module, a management module, an information processing module and a threat monitoring module; the system support module provides network service, file system and user account camouflage functions and converts the functions into standard interfaces through the interface interpreter module to be called by the upper layer module, and the moving target construction module interacts with the system support module through an interface interpreter and supports dynamic arrangement of camouflage resources. The dynamic arrangement module adjusts attack surface features of system resources according to real-time threat information provided by the threat monitoring module, when the threat monitoring module finds potential attacks, threat information is transmitted to the management module, the dynamic arrangement module is triggered to carry out adjustment, and the information processing module records logs and displays system states and threat alarms. And administrators are assisted to make decisions.

Techniques for identifying and managing an organization's remote attack surface that account for the fluid nature of the remote attack surface are described. Data collected from organization-issued endpoint devices are obtained and analyzed to determine public IP addresses used by the endpoint devices. The devices connected to external networks (i.e., non-organization networks) at various time windows are identified by distinguishing between public IP addresses that are associated with the organization and those that are not. Data obtained from ongoing global probing of public IP addresses, which at least indicate software instances hosted on networks corresponding to the public IP address, are correlated with each public IP address determined to be associated with an external network to which an endpoint device has connected. From these data, any security risks that connections to external networks may pose to the organization's network can be identified.

The invention provides a vulnerability priority determination method and device and an attack surface management system, and relates to the technical field of vulnerability processing. According to the method, the vulnerability risk analysis model compatible with the service attribute, the vulnerability attribute and the protection attribute is designed, so that the vulnerability risk score of the system which is low in service value and already executes the security protection strategy is reduced, and the vulnerability repair priority of the system is later; according to the method, enterprises can focus on high-service-value and high-availability vulnerability repair for protecting missing assets, the accuracy of vulnerability risk assessment is improved, and the protection efficiency is improved. Furthermore, for the score of each vulnerability risk assessment index under the protection attribute, the security protection coverage condition is considered, whether a security protection failure point (such as strategy configuration failure) exists or not, namely whether security protection can take effect truly or not, is considered in a more refined manner, the accuracy and reliability of security protection are improved, and the security protection efficiency is improved. And vulnerability protection of the system is more accurate and effective.

The invention discloses a mimicry defense driven network endogenous security protection method, which solves the problems of fixed attack surface, high key management risk and insufficient self-healing capability of the traditional network static architecture. The method comprises the steps that hardware, a system and an application layer multilevel heterogeneous execution body are constructed, a unique identifier is distributed, and the state is monitored through heartbeat; the heterogeneous requests are stored in a red-black tree cache after being subjected to standardization processing; performing dynamic voting based on weighted majority in a 100-millisecond window, and isolating an executor and recording a block chain log when the executor is abnormal; the response integrity is verified through ECDSA signature, if the response is greater than or equal to half of the execution bodies, the response is consistent, and otherwise, a rollback mechanism is triggered; and periodically or event-driven dynamically reconstructing an executor pool, and combining a two-stage key alternation system of a transmission private key and a root public key. According to the method, the network endogenous security is improved through dynamic heterogeneous redundancy and automatic closed-loop protection.

Infrastructure for zero trust network access (ZTNA) is deployed as a cloud-based service remotely from a customer premises where user applications are hosted. By connecting an appliance on the customer premises to the cloud-based service through a secure tunnel or the like, an application hosted on the customer premises can then be accessed externally as a ZTNA application without the customer premises opening a firewall to public networks or otherwise exposing potential attack surfaces to the customer premises.

Techniques are disclosed for predicting cybersecurity vulnerabilities automatically in IT assets / targets based on known vulnerabilities of various available technologies / products. This is accomplished by loading and linking one or more ontologies in a graph database containing vulnerability information about the technologies. The assets / targets preferably belong to a bug-bounty program. An optional discovery tool maps the attack surface of each target. A profiler collects the various technologies or traits used by the target and links them to the target. Then the graph database is queried to predict the cybersecurity vulnerabilities associated with the traits and consequently with the targets. The system is preferably implemented with a service-oriented architecture (SOA) so feedback / predictions can be provided to the user in near / real-time.

A system and method for determining digital asset security from an external attack surface. The method includes: continuously detecting digital asset information from a networked computing environment; continuously determining a cybersecurity severity score for a digital asset based on the detected digital asset information; continuously determining an asset exposure score for the digital asset based on the detected digital asset information; continuously determining an asset importance score for the digital asset based on the detected digital asset information; generating a digital asset security score based on: the determined cybersecurity severity score, the asset exposure score, and the asset importance score.

The invention relates to the technical field of model construction, in particular to a construction method of an attack and defense model of a power system. The method comprises the following steps: acquiring structural data of a power system; performing structure topology modeling on the power system structure data to generate power system topology structure modeling data; carrying out attack surface identification on the modeling data of the topological structure of the power system to generate attack point data of the structure of the power system; performing power system network security modeling based on the power system structure attack point data and the power system topological structure modeling data to generate power system network security modeling data; acquiring historical intrusion data of the power system; and performing attack path analysis on the historical intrusion data of the power system to generate attack type path data of the power system. According to the method, through combination of electric power system structure modeling, historical intrusion data analysis, attack simulation, game analysis and vulnerability repair, the accuracy of attack and defense modeling and the dynamic performance of defense are improved.

The invention discloses an external field equipment trusted access method based on a non-addressable stealth gateway, which relates to the technical field of network security access, and comprises the following four steps: in a manufacturing period and first access, a certificate authorization machine binds equipment identity and trusted platform module measurement, policy decision point decision, policy execution point implementation and policy subset loading; initiating from the outside of the equipment, establishing an end-to-end trusted channel with the center, and performing inward isolation and transparent bearing on rear-end real services; updating strategies, algorithms and secret keys on line under the control of a unified strategy library; according to the method, the attack surface is reduced, the transformation cost is reduced, non-stop treatment is ensured, the encrypted traffic can be observed and audited, only trusted equipment can reach the center through a trusted channel, and event linkage right descending and certificate state linkage treatment are supported.

The invention relates to the technical field of computers, and discloses an ecological compensation data value-oriented hierarchical security policy and hierarchical cloud storage system.The method comprises the steps that firstly, security isolation of a virtual network is ensured, technologies such as a virtual network security group and a virtual firewall are adopted, and communication between virtual machines and communication between the virtual machines and an external network are limited; reducing potential attack surfaces, performing security detection on virtual machine images in a resource pool, including verifying integrity and credibility of the images, scanning malicious software, ensuring that image files do not contain known viruses, Trojan horses or malicious software, monitoring behaviors of virtual machines in the resource pool, and using an intrusion detection system (IDS) or a behavior analysis technology. Abnormal behavior, malicious activity or potential security threats are detected. According to the method, the particularity and the security requirement of a virtualization environment are considered specially for the construction requirement of the computing power network security resource pool. According to the method, security risks related to the computing power network can be detected and evaluated more accurately, and the comprehensiveness is high.

The invention discloses an Android attack surface exploration method based on AOSP static analysis, and belongs to the field of mobile terminal security analysis. Comprising an attack point list acquisition module, a file system traversal module and a service dependency relationship generation module. The attack point list acquisition module extracts an AIDL interface method list through a compilation command tracking technology, identifies Content Provider and Broadcast attack points by using a static analysis technology, and generates a detailed attack point information list; the file system traversal module traverses a complete file system through a root permission, and screens user-mode accessible files in combination with the file permission; and the service dependency relationship generation module constructs a dependency relationship graph between the service interfaces by combining the generation dependency relationship and the variable dependency relationship. According to the method, the potential attack points of the Android system can be comprehensively and systematically identified, the dependency relationship between the interface and the service is established, and support is provided for vulnerability mining, security audit and authority management optimization.

The invention provides a dynamic defense switching period optimization method and device, a medium and electronic equipment, and the method comprises the steps: initializing defense resources and attack surface reset time, and defining a strategy space constraint of a defense switching period; defining a game framework; constructing an attack and defense revenue function; initializing a particle swarm, calculating the fitness value of each particle, iteratively updating the speed and position of the particle, calculating the fitness value of the updated particle, and judging whether to update the individual optimal solution and the global optimal solution according to the updated particle fitness value, the original individual optimal solution and the global optimal solution; when a preset iteration termination condition is met, iteration is terminated, and a Nash equilibrium strategy of the attacker and the defender is obtained; and extracting a switching period from the Nash equilibrium strategy as an optimal dynamic defense switching period. By applying the method, the dynamic counterbalance relationship between attacker and defender strategies can be comprehensively analyzed, and the optimal dynamic defense switching period capable of giving consideration to the defense effect and the system stability can be obtained.