15 results about "Behavior rule" patented technology

The invention relates to the technical field of network security and data protection, and discloses a data leakage prevention method and system based on user behavior perception, and the method comprises the steps: obtaining historical operation data, and constructing a personalized behavior reference library; monitoring a current access behavior in real time by sliding a time window, calculating a deviation degree and triggering anomaly detection; performing multi-level feature analysis on the abnormal behavior and calculating a comprehensive abnormal score; dynamically adjusting the access authority according to the score, recording an abnormal behavior and carrying out relevance matching; optimizing the reference model through feedback learning; and evaluating the credibility and the risk level based on an accurate modeling result, and adaptively adjusting permission configuration. According to the method, the user behavior rule can be accurately captured, the data leakage risk can be efficiently identified, the access permission can be dynamically adjusted, the false alarm rate can be reduced, adaptive protection can be realized, and data security and business smoothness can be guaranteed.

The invention provides a low-coupling simulation behavior rule resource construction method based on a reflection mechanism. The method comprises the following steps: constructing a rule mapping table; when a rule adding instruction triggered by a user is received, generating a header file of a new rule and a corresponding source file; in the rule resource registration program, adding a reference to a header file of the new rule to obtain a rule type of the new rule; adding a registration function of the new rule in the rule resource registration program; recompiling the rule resource registration program and a source file of the new rule; and based on the compiled rule resource registration program, according to the rule type and the rule identifier of the new rule, calling a registration function of the new rule to generate a mapping relationship corresponding to the new rule, and inserting the mapping relationship into the rule mapping table. According to the method, the rule resources and the codes of the simulation engine are decoupled, independent management and modification of the rule resources are allowed, the codes of the simulation engine do not need to be modified, and therefore change of the rules does not need to be recompiled and deployed by the simulation engine any more.

The system according to this embodiment aims for the AI ​​to comply with ethical guidelines and constraints and to exercise self-control. [Solution] The system according to the embodiment comprises a listing unit, a rule setting unit, a reward / penalty unit, a feedback unit, and an ethical judgment unit. The listing unit lists permitted and prohibited actions. The rule setting unit sets actions that are permitted only under specific circumstances. The reward / penalty unit rewards desirable actions and penalizes undesirable actions. The feedback unit adjusts the algorithm based on the AI's actions. The ethical judgment unit makes ethical judgments.

The application relates to the technical field of industrial control safety, in particular to a PLC runtime abnormal behavior identification method and system based on a behavior model, which comprises the following steps: S1, in the PLC program running process, a behavior monitoring module performs real-time monitoring and preliminarily judges abnormal behavior; S2, normal behavior and abnormal behavior are filtered out respectively according to the monitoring results of the behavior monitoring module, and behavior rule extraction is performed on the behavior monitoring module; and S3, behavior modeling is performed based on the extracted behavior rules, normal behavior model generation or update of behavior rule information files is performed on the detected normal behavior, and abnormal behavior model learning of abnormal characteristics, rapid abnormal identification and measure processing are performed on the detected abnormal behavior. The application uses a data model to describe the normal behavior model of the control behavior and the process behavior through the dependent relationship of the normal input and output data of the control and controlled process, so that the intrusion behavior can be accurately identified, and active defense can be performed.

The invention discloses an interface display method and device, relates to the field of data processing, and is used for solving the problem that a traditional interface updating mechanism depends on cloud decision and needs frequent interaction between a mobile terminal and a cloud. The method comprises the following steps: collecting real-time behavior data of operating an application program by a user; determining a user intention vector represented by the real-time behavior data through a behavior rule base; wherein the user intention vector comprises at least one intention and a corresponding weight; the behavior rule base comprises a first behavior rule base obtained from a cloud end and a second behavior rule base obtained from a mobile end; the first behavior rule base is formed by the cloud based on behavior data of multiple users, and the second behavior rule base is formed by the mobile terminal based on behavior data of respective users; and generating a first control instruction according to the user intention vector, and updating a display interface of the application program through the first control instruction. Through the scheme, the content displayed on the interface can be decided and dynamically adjusted at the mobile terminal.

The invention relates to the technical field of network security, in particular to a Web authentication enhancement method and system based on user behavior analysis, and the method comprises the following steps: collecting multi-dimensional behavior data of a user, including login behavior data, access behavior data, operation behavior data and equipment fingerprint data; predefining a behavior rule base comprising a login time limit rule, an equipment fingerprint matching rule, an access frequency threshold rule and an operation path compliance rule; the method has the beneficial effects that the system can timely discover and prevent potential security threats, such as cross-site script attack, SQL injection attack, unauthorized access and the like, through predefined behavior rules and real-time comparison of user behaviors. The collection and analysis of the multi-dimensional behavior data enable the system to more comprehensively understand the behavior characteristics of the user, thereby improving the accuracy of authentication.

The present invention provides a multi-agent collaborative task planning method, system, device and storage medium, including: constructing an asynchronous communication framework, responding to task events through an event-driven model, and decoupling the production and consumption of task events by using a message buffer queue; performing conditional matching on task events based on predefined behavior rules, if the matching is successful, commanding the agent to execute the action corresponding to the rule, otherwise marking the task event as an unmatched task and transmitting it to the LLM language model; loading the historical process data of the unmatched task into the historical message context of the LLM language model, generating a task allocation decision in combination with a guiding template, and optimizing the task allocation decision through an exception re-decision mechanism to obtain a decision result; distributing the decision result to the corresponding agent for execution, and updating the context data of the task event and the predefined behavior rules in real time. The present invention can significantly improve the reliability, efficiency and flexibility of task execution, and is applicable to various complex business scenarios.

An information security monitoring system can import indicators of compromise (IOC) definitions in disparate formats from third-party source systems, convert them into editable security definitions in an internal system format, and provide a user interface for composing or editing these security definitions with enhancements, including complex security definitions such as those having a nested Boolean structure and / or those that reference one or more security definitions, a behavioral rule, and / or a vulnerability description. One or more whitelists can be added to handle exceptions. Each composed or modified security definition is then compiled into an executable rule. The executable rule, when evaluated, produces a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.

The invention discloses a conflict resolution method and device based on flow node hierarchical management and a medium, and relates to the technical field of software development, the method comprises the following steps: defining a behavior rule and a control rule of a low-code business form to obtain metadata definition data of the low-code business form; performing rule coverage of process nodes on the metadata definition data to determine a process rule set; obtaining a current running context, and performing rule configuration on the current running context based on the flow rule set to obtain a current multi-source flow rule; according to the current multi-source process rule, constructing a rule conflict dependency graph, and performing field pre-definition processing on the rule conflict dependency graph to determine a pre-definition resolution strategy; and based on a predefined resolution strategy, through rule influence degree prediction and resolution strategy recommendation processing, obtaining a conflict-free element state set. According to the method, the technical problem that in the prior art, a low-code platform cannot perform conflict resolution through context sensing capacity is solved.

The present invention discloses a method for constructing a malicious program behavior rule set, which includes steps of describing malicious program behaviors using an ontology; extracting malicious program behavior features; constructing a fine-grained malicious program behavior rule set; constructing a coarse-grained program behavior rule set; and constructing a behavior rule set for detectable program categories. The construction method of the present invention proposes a formalized extended description method based on the API call frequency of malicious programs, and realizes a complete description of program behaviors based on the ontology. The behavior rule set for detectable program categories jointly constructed by the fine-grained malicious program behavior rule set and the coarse-grained program behavior rule set is complete. By inputting the inference rules into an inference engine and binding the inference engine to the ontology, the behavior rule set can be used to perform inference detection on unknown samples, mark the categories of unknown programs, and comprehensively cover the inference detection of unknown samples.

The invention provides an authority authentication method, a user terminal, a learning platform, equipment, a medium and a program product, which can be applied to the technical fields of artificial intelligence technology and financial science and technology. The method is applied to a user terminal and comprises the following steps: performing feature extraction on a first interaction behavior of a target object to obtain a first behavior feature of the target object; according to the first behavior rule, performing compliance identification on the first behavior feature to obtain a first identification result; under the condition that the first behavior recognition result represents that the first behavior does not meet the first behavior rule, a second behavior feature determined based on a second interaction behavior of the target object is sent to the learning platform, and the learning platform performs compliance recognition on the second behavior feature according to the second behavior rule to obtain a second behavior recognition result; and receiving a second behavior recognition result sent by the learning platform, and determining an authority authentication result for the target object under the condition that the second behavior recognition result represents that the second interaction behavior meets the second behavior rule.

The invention discloses a behavior prediction method fusing behavior rules and deep learning, and the method comprises the steps: obtaining a behavior video in which human body plane coordinate position information is embedded, and carrying out the preprocessing of the behavior video, and obtaining a video frame; carrying out human body appearance and key point feature coding on the video frame in combination with a long-short-term memory neural network and a convolutional neural network; performing surrounding environment and human ring interaction feature coding on the behavior video frame by using a long short-term memory neural network; cascading all the feature codes to obtain a feature fusion code; generating a movement prediction track of a person by using a long-short-term memory neural network to obtain a movement track generation network of the person; converting the behavior rule model of the person, which is kept unchanged under time translation transformation, into a computable behavior rule model; integrating the computable behavior rule model into a human movement track generation network; and predicting a behavior category by using a full-connection neural network. According to the method, the model training data overhead can be reduced, and meanwhile, relatively high behavior prediction accuracy can be realized.

One or more embodiments of the present disclosure provide a business processing method and device, electronic equipment and storage medium. The method comprises: in response to receiving a rule invocation request, parsing scenario information and activity information according to the invocation request; invoking data rules and / or behavior rules corresponding to the scenario information and the activity information from a rule library to a rule engine; the data rules and the behavior rules are stored in the rule library in layers according to global common or regional difference attributes; determining a data object of the activity according to the data rules and the behavior rules, and invoking business data corresponding to the data rules and the behavior rules according to the data object; executing the data rules and the behavior rules based on the business data to obtain an execution result of the business.

The invention discloses a power grid information operation violation behavior intelligent identification question-answering system, and relates to the technical field of power grid operation violation behavior intelligent identification. According to the method, violation behavior judgment and coping rules are extracted from power grid operation records, industry standards and historical violation logs through a natural language processing technology, the intelligent recognition efficiency of violation behaviors is improved, manual intervention is reduced, and operation automation and precision are achieved; by constructing a plurality of sub-databases and combining a version control technology, dynamic update and timely supplement of illegal behavior rules are ensured, so that the system can continuously adapt to industry changes, and the accuracy and timeliness of illegal behavior recognition are improved; besides, the mapping relation between the illegal behavior ID and the coping rule ID is optimized by adopting the graph neural network, so that the automatic association capability of the system is improved, the most suitable coping measure can be recommended according to the illegal behavior type, and the safety and the high efficiency of the power grid operation are enhanced.

The invention discloses a detection and protection method for an enterprise intranet attack behavior, and the method comprises the steps: firstly constructing an attack behavior rule base, and mapping the attack behavior rule base into an inference rule of a Mulval tool; enterprise asset information and vulnerability information structured reports are obtained and mapped into a system information knowledge base of an enterprise with predicates; performing reasoning by using a Mulval tool in combination with the system information knowledge base and the reasoning rule to generate a logic attack graph of the enterprise; and finally, generating a mitigation measure graph based on the generated logic attack graph. According to the method, the attack behaviors are redefined to establish the standardized attack behavior model, so that the attack behaviors are recognized and analyzed more clearly and normatively; and ATTamp is combined; the CK knowledge base, the CAPEC attack mode base, the CWE weakness base and the CVE vulnerability base enrich classification and analysis modes of attack technologies, accurately capture and describe the attack technologies and potential attack paths thereof, and improve the efficiency and effect of attack detection, analysis and defense.