40 results about "Blacklist" patented technology

The application provides an illegal data flow interception method and device of an Internet of Things card, a network device and a storage medium. A first user plane function network element acquires a data flow from a terminal loaded with an Internet of Things card; the first user plane function network element determines a data flow distribution target of the data flow according to a distribution rule; wherein the distribution target comprises an Internet of Things special network and a basic network; the first user plane function network element calls a deep packet analysis engine to analyze whether the data flow with the basic network as the distribution target is an illegal data flow meeting an illegal condition, wherein the illegal condition comprises that the data flow is from a user of the Internet of Things card and has an application feature meeting a blacklist; and the illegal data flow is intercepted. Through the user plane function network element at the edge of the operator network, the illegal data flow can be identified and intercepted in real time, thereby solving the problem of lag in the related art.

The present disclosure provides a process-oriented whitelist / blacklist security detection method, device, equipment and medium, comprising: collecting static attributes of all executable files from a terminal device; performing global reputation learning on the executable files to obtain global reputation features of the executable files; constructing a context portrait of the executable files; generating a multi-level process knowledge base according to the static attributes of the executable files, the global reputation features of the executable files, and the context portrait of the executable files; intercepting a target process when a creation request of the target process is detected, and obtaining process file information corresponding to the target process; creating a process context according to the process file information corresponding to the target process; intelligently matching the process context according to the multi-level process knowledge base to obtain a real-time risk value corresponding to the target process; and determining a security detection result of the target process according to the real-time risk value corresponding to the target process. Thus, the security detection accuracy of the process is effectively improved.

The application relates to the technical field of artificial intelligence, and discloses a data processing method, device, equipment and storage medium to improve blacklist processing capability. The method part comprises the following steps: receiving a loan approval request sent by a target business system, the loan approval request carrying loan approval data, the loan approval data comprising a system type of the target business system and attribute information of an applicant; calling a blacklist interface corresponding to the system type to obtain a system blacklist; judging whether the applicant is a user in the system blacklist according to the attribute information of the applicant; when the applicant is not a user in the system blacklist, a platform blacklist of an automatic approval platform is called; judging whether the applicant is a user in the platform blacklist according to the attribute information of the applicant; when the applicant is a user in the platform blacklist, a loan service corresponding to the loan approval request is rejected, and rejection result information is generated and fed back to the target business system.

The application discloses a kind of big model output content compliance streaming detection method and system, on the basis of reserving big model streaming output advantage, the content of model output is judged in real time, timely intervention is carried out after discovering non-compliant content corresponding strategy;By segmenting output content blacklist and vectorization storage into vector database, similarity retrieval is executed in the process of receiving big model streaming output section by section, dynamically update the queue to be evaluated, and according to average score, it is blocked, so as to ensure user experience while realizing efficient compliance supervision with lower detection delay, ensure the compliance and real-time of model output.

This application provides a method for processing dynamic events in intelligent connected vehicles, a vehicle, and a medium. The method includes: a cloud server responding to a dynamic event reception request sent by a vehicle, retrieving at least one target event associated with the vehicle from a dynamic event information database; the dynamic event information database storing blacklists and whitelists of events based on map data; and sending the at least one target event to the vehicle, so that the vehicle formulates a control strategy based on the at least one target event. This method aims to improve the vehicle's response speed to sudden dynamic events, thereby improving overall traffic safety and smoothness.

This invention discloses a method and system for collaborative and secure interaction in the storage of optical components for heterogeneous systems, relating to the fields of industrial automation and information security. The method includes: Step 1, providing four standard interface methods—WebService, Socket, intermediate table, and QR code—through a protocol access gateway; Step 2, a security authentication center employs a unified identity authentication mechanism for each access request, combined with IP address blacklists and whitelists for access control, token authentication, and authorization; Step 3, a task scheduling engine decomposes received service access instructions into a sequence of executable tasks for the device and optimizes scheduling according to a pre-designed plan; Step 4, for systems that can directly establish a network connection, service access is performed directly; for systems that cannot directly establish a network connection, QR code encoding technology is used to achieve secure data transfer via a data transfer mechanism. This invention enables efficient collaborative control and data interaction among multiple heterogeneous systems while ensuring data security, improving system compatibility and integration efficiency.

The application discloses a multi-competition face searching system and method based on GPU parallel acceleration and Milvus, and relates to the technical field of face recognition and vector retrieval. The system is divided into an access layer, a service scheduling layer, a GPU inference engine layer and a three-level storage layer; GPU batch parallel face detection and 512-dimensional feature extraction are realized by relying on CUDA; video frame feature batch deduplication is completed by using high-speed operation of the GPU; Milvus adopts competition_id as a partition key to realize multi-competition data partition isolation, and is matched with Milvus-GPU to accelerate partition vector retrieval; the service scheduling layer dynamically divides GPU computing power priority, and preferentially guarantees real-time retrieval resources; the system configures hierarchical API keys and IP white lists to realize safety management and control, and is compatible with watermark storage and extra_data parameter transparent transmission functions. The application overcomes the defects of low efficiency of traditional CPU serial processing, large video storage redundancy and high full-database retrieval delay, has the advantages of fast processing speed, high hardware utilization rate, small storage cost and strong safety, and is suitable for competition personnel verification, park visitor retrieval, security blacklist control and other scenes.

Virtual number, which is not reachable directly so its impossible to bypass the system. □ Incoming calls Intercepted by the platform for processing, on the basis of: o Blocking by Time of day □ Subscriber can specify a time schedule to shutdown their Virtual Number for a specific times period. Ex: 5pm to 8am. Everyday o Blocking by MS1SDN- Black Listing □ Specific MSISDN can be blocked so no incoming callsipr sms are received from these MSISDNs on the Virtual Number o Turn Off / pn-The Virtual Number can be turned offioroh at anytime by calling the configuratiori IVR. □ Calls are routed to an actual phone of the . subscriber based on his / her preferences □ Subscriber gets call from original CUD with special prefix for identification □ Front end for subscriber to manage his preferences and rules, based on: o lVR o SMS o More in optional features. □ For outgoing calls the userjust has to make a call with the same prefix as mentioned earlier for incoming calls. The call hackworks the same way. □ Call conferencing with unlimited parties. □ The system does not interfere with other services such as Call waiting / conferencing.

The application discloses an Internet risk prediction method and device based on domain name analysis, equipment and medium, relates to the technical field of artificial intelligence, can be applied to the field of finance and medical health, and mainly aims to solve the problem of poor prediction accuracy of the existing Internet domain name risk. Including: in response to an Internet data access request, calling a monitoring thread; determining the risk level of the user access domain name based on at least one of the blacklist rules, the whitelist rules and the risk classification rules in the monitoring thread; if the risk level is low risk or medium risk, a risk prediction model corresponding to the risk level is called, and the domain name reputation, historical behavior and IP address associated with the user access domain name are predicted based on the risk prediction model to obtain a risk prediction result, and the risk prediction model is constructed based on a convolutional neural network and a recurrent neural network.

The application discloses a kind of intelligent anti-tailing access control systems, methods and electronic equipment based on multiple verifications, which realizes multi-modal identity verification by identity verification control module and verifies identity in combination with visitor authority and blacklist information, determines the current number of passers-by and pass identification result by pressure distribution detection and infrared light curtain detection on target access channel through pass detection module, determines tailing identification result in combination with current number of passers-by and pass identification result through tailing control module, and starts access control strategy corresponding to tailing identification result.The application can solve the technical problems that traditional access control lacks tailing identification means and implements single identity verification, leading to decreased security, achieve accurate identity verification, efficient tailing behavior identification, effectively prevent identity fraud and tailing illegal entry risk, improve access control security and intelligent level, and can be widely applied in access management technical field.

The application relates to a method and device for detecting and warning fake accounts, electronic equipment and a storage medium. The method comprises the following steps: S1, obtaining feature information related to a user account; S2, generating a whitelist of normal website or application access of a user; S3, DPI (Deep Packet Inspection) is used to extract user behavior logs of domain names in the blacklist and the whitelist, wherein user behaviors meeting the feature information of the user account generate risk behavior records and trusted behavior records; S4, cosine similarity algorithm analysis, the cosine similarity algorithm is used to calculate the cosine value of the included angle of two vectors, and a fake account risk threshold is set for the cosine value; and S5, risk warning, implementing warning according to the information of a risk warning table. According to the method, more targeted and effective detection of fake user account behaviors can be initiated actively in the whole Internet range.

This application discloses a method, storage medium, and server for handling upgrade anomalies of smart devices, relating to the field of smart home technology. It aims to solve the problem of reducing the cost of handling upgrade anomalies of smart devices. The method includes: in response to a smart device upgrade anomaly, obtaining the upgrade anomaly code reported by the smart device; determining whether the upgrade anomaly code meets a first preset condition; if it does, adding the smart device to a device upgrade blacklist; and setting removal conditions to determine whether the smart device can be removed from the device upgrade blacklist under the preset conditions. In this way, the specific reason for the upgrade anomaly can be understood based on the upgrade anomaly code, allowing for differentiated processing of the anomaly-affected smart devices. Simultaneously, setting removal conditions establishes a mechanism for automatically removing smart devices from the device upgrade blacklist, improving the intelligence level of upgrade anomaly handling, reducing the manual cost of device upgrade anomaly handling, and expanding the coverage of device upgrade services.

The present disclosure provides a method, an apparatus, an electronic device, a storage medium and a program product for protecting against malware encryption. The method comprises: receiving normal files and malware samples into a sandbox to obtain multiple blacklists and multiple whitelists of said malware samples; performing an operation on said blacklists and whitelists to obtain a list of unencrypted filename extensions of said malware samples; and performing a filename extension operation on said normal files in accordance with said list of unencrypted filename extensions; and receiving said normal files and said malware samples into said sandbox after the filename extension operation, and outputting said list of unencrypted filename extensions if said normal files are not encrypted by said malware samples. In this way, it is possible to obtain a list of filename extensions regarding the avoidance of malware encryption, and to avoid normal file from being encrypted by malware by adding said extensions after normal filenames, ensuring data security and information security.

The present disclosure provides a method (400) and a system (108) for routing one or more SMS in a network (106). The method includes a receiving module (208) configured to receive SMS messages from at least one source and extract message metadata, including source and destination addresses. A filtering module (210) performs message filtering based on predefined whitelist and blacklist rules to classify each SMS as allowed or blocked for routing. For each allowed SMS, a query module (212) executes a mobile number portability (MNP) query to determine the current network operator. A routing module (214) identifies at least one destination entity capable of delivering each allowed SMS, selects an optimal routing path from available paths based on routing rules, and forwards each allowed SMS to the identified destination entity. The method (400) and the system (108) achieve cost-efficient fault tolerance, optimal resource utilization, and reduced maintenance overhead.

This application discloses a method and related apparatus for reviewing iOS system application installation packages, relating to the field of application development. The method includes: obtaining the application's IPA package and parsing the Mach-O executable file, locating the static symbol table and dynamic symbol table; extracting undefined symbols from the static symbol table based on the dynamic symbol table, removing modifier symbols, and obtaining a binary fingerprint set including multiple undefined symbols; obtaining application review rules, converting them into an automaton, and performing state matching on the binary fingerprint set within the automaton; if a target undefined symbol causes the automaton to jump to a preset receiving state, determining that the target undefined symbol is a blacklist symbol, and recording its identifier and position; and outputting the identifiers and positions of all blacklist symbols in the binary fingerprint set. This application reduces the occurrence of application review failures by parsing the Mach-O executable file, extracting undefined symbols, converting application review rules into an automaton, and using the automaton to identify blacklist symbols.

This invention discloses a multi-model collaborative method and system for detecting hidden links in web pages based on confidence levels. The method for detecting hidden links in web pages includes: acquiring tags with hidden attributes from various tags within the web page; if the domain name of the link address in the tag is different from the domain name of the web page, then acquiring the link address; if the domain name of the link address is the same as a domain name pre-stored in a blacklist, then outputting the link address as the detection result of the hidden link. The device for detecting hidden links in web pages includes a first working module, a second working module, and a third working module, respectively used to perform the above steps. The method and device provided by this invention can automatically detect hidden links in web pages, effectively reducing the false positive rate while improving detection efficiency and accuracy.

This invention relates to a method, apparatus, and system for security evaluation of large language models based on dynamic custom logic encoding. It constructs a temporary logic mapping protocol for encoding; after acquiring malicious semantic text to be tested, it encodes the malicious semantic text into a sequence of logical instructions according to the temporary logic mapping protocol, constructs test prompts, inputs them into the large language model under test, and determines whether the large language model under test has been jailbroken based on the output. The apparatus includes an acquisition module, a protocol construction module, an encoding module, a construction module, an output acquisition module, and a judgment module; the system is implemented based on the method. This invention can bypass security protection mechanisms based on blacklists and fixed pattern recognition, achieving a high avoidance rate, breaking through static defense mechanisms, touching security vulnerabilities at the logical reasoning level, possessing high adaptability and scalability, ensuring the long-term effectiveness of the evaluation, accurately locating weak points in the model's security strategy, and performing targeted and refined reinforcement.

A method of tracking a command and control (C&C) server, which is performed by an apparatus for monitoring a process activity and a registry change of a host personal computer (PC), may comprise: storing a virtual private network (VPN) communication internet protocol (IP) when malware within the host PC attempts a VPN connection to an external server; monitoring or storing transmitted and received data between the host PC and the external server; analyzing the transmitted and received data; and registering the VPN communication IP on a blacklist when a suspicious activity is present in a result of the analysis of the transmitted and received data.

This invention belongs to, but is not limited to, the field of network security technology, and particularly relates to a DDoS cross-chain collaborative defense method, system, device, medium, and terminal, comprising: a source chain node: used to monitor external traffic, perform local rapid detection, construct cross-chain verification requests, and adjust defense strategies based on the feedback results from the target chain; a target chain node: used to receive verification requests, perform blacklist matching on suspicious IPs, generate ZKP proofs, and return the results to the source chain; a relay chain module: serving as a cross-chain communication channel, responsible for forwarding verification requests and responses; a zero-knowledge proof module: embedded in the target chain and source chain nodes, used for ZKP circuit construction and verification, and performing privacy-preserving verification based on a Merkle Tree structure; and a local detection module: integrating a local lightweight machine learning model to achieve preliminary identification of unknown attack traffic.

This invention proposes a multi-model collaborative DDoS attack detection and mitigation method based on packet-level dual-dimensional features. While collecting flow-level features for each flow in the data plane, packet-level features are used to classify packets using an XGBoost model to prevent attack packets from being missed during flow feature calculation. The calculated flow-level features are uploaded to the control plane, where a deep neural network model is used to classify flows. Attack flows are added to a permanent blacklist, and packets from attack flows are dropped to mitigate the attack. Legitimate flows are added to a timed whitelist, pausing flow feature calculation and packet-level classification for those flows at fixed intervals to reduce model overhead. The proposed method achieves high attack detection accuracy with low deployment overhead and can quickly restore traffic to normal, making it an accurate and efficient DDoS attack detection and mitigation method.

A method for reducing network packet load is provided. The method is implemented by a device and includes receiving network packets from an Ethernet physical layer into a receiving slot. The method includes determining whether a packet count of the network packets in the receiving slot exceeds an intermediate threshold. The method includes filtering out first network packets from media access control addresses recorded in a blacklist according to the blacklist when the packet count exceeds the intermediate threshold value.

The present invention provides a method and apparatus for reducing network packet load, which is performed by an apparatus, and the method comprises the steps of: receiving network packets from an Ethernet physical layer into a receiving slot; determining whether a packet count value of the network packets in the receiving slot exceeds an intermediate threshold value; and filtering out first network packets from media access control addresses in a blacklist according to the blacklist when the packet count value exceeds the intermediate threshold value.

The present disclosure relates to a defense method and device for a flooding attack, a storage medium and an electronic device, and relates to the technical field of network and security technology. The method comprises: sampling real-time network card traffic of a network server based on a preset sampling frequency to obtain a to-be-processed sampling packet; calculating a real-time traffic rate of a current data flow according to a first byte number and a first flow time, and determining the current data flow as a target data flow when the real-time traffic rate of the current data flow is greater than a preset traffic threshold; extracting a target flow feature of the target data flow from the to-be-processed sampling packet, and generating an access control list rule corresponding to the target data flow according to the target flow feature; updating a current blacklist by using the access control list rule to obtain a target blacklist, and filtering a submitted packet based on the target blacklist to achieve defense against the flooding attack included in the submitted packet. The present disclosure improves the accuracy and timeliness of the defense.

The application discloses a cross-merchant green point settlement method and system based on distributed right confirmation, and belongs to the technical field of data processing. Specifically, based on the built-in hardware module of the system itself, a double-mode identity fingerprint is acquired, and confusion coding and parameter initialization processing are performed, and the processing result is chained and stored for evidence; by using a reverse solution challenge algorithm technology, double-end parameter transmission and checking are performed, and frozen points are used to ensure safety; merchant identifiers in the frozen record are parsed and compared with the current settlement merchant, and after confirmation by using a consensus mechanism, point transfer is completed and a settlement voucher is generated; a real-time exception monitoring module is deployed to monitor abnormal settlement behavior, a dynamic sandbox is constructed to trace attack sources, intrusion features are extracted to update a blacklist, and an audit log is generated. By introducing a bidirectional biological feature reverse solution engine and a dynamic point sandbox mechanism, the application solves the technical problems of identity verification in the cross-merchant point system, easy penetration and the fact that abnormal settlement cannot be traced.

This invention discloses a real-time monitoring method and system for live streaming content. The method involves a pre-screening server that performs compliance pre-screening on live stream addresses and establishes a dynamically updated blacklist / whitelist database. Before playing a target live stream, the display terminal queries the blacklist / whitelist database and pre-screening policy to determine whether to start playback. During live stream playback, a terminal monitoring agent collects and preprocesses audio and video data in real time and sends it to a content risk control server for real-time identification. A two-way early warning closed loop is established between the pre-screening server, the content risk control server, and the display terminal: when the display terminal or the content risk control server identifies illegal content, it immediately reports to trigger review and global blocking; when the pre-screening server discovers a new illegal address, it proactively pushes an alarm command to all display terminals on the network to update the local list and execute a playback ban. This invention improves the real-time performance of the review, reduces system resource consumption and operating costs, and enhances the accuracy and deployment flexibility of the review.

This invention relates to the fields of artificial intelligence and facial recognition technology, and discloses a method for personnel management and security early warning in smart parks based on facial recognition. The method constructs a three-tiered collaborative architecture: the intelligent camera terminal locally performs face detection, liveness detection, and initial feature extraction; the edge server cluster performs millisecond-level feature comparison, dynamically loads white / gray / black lists by region, and triggers tiered responses; the central cloud platform is responsible for global policy management and long-term behavior analysis. This solution significantly improves the real-time performance of recognition, system robustness, and resource utilization efficiency, reduces bandwidth consumption, and ensures security early warning capabilities under high concurrency and weak network environments.

The application provides an AI linkage anti-network-squatter method for routers, gateways and cameras in the technical field of Internet of Things security, which comprises the following steps: S1, collecting multi-dimensional features of devices requesting to access or having accessed the network; S2, inputting the multi-dimensional features into an AI recognition model to obtain a device type recognition result; S3, executing a hierarchical network permission control strategy corresponding to the device type according to the device type recognition result; S4, when the device is a visitor device, sending an authorization request to a user terminal; receiving an authorization feedback and configuring corresponding temporary network permissions for the visitor device according to the authorization feedback; and S5, when the device is a malicious network-squatter device, executing a network access blocking operation, adding the corresponding multi-dimensional features to a blacklist and issuing a linkage protection instruction to at least one camera in the network. The application has the advantage of greatly improving the in-depth recognition, active disposal and data protection capabilities for malicious devices having accessed the network.

This invention relates to a method for enabling, blocking, and testing blacklisted services based on protocol identification, belonging to the field of network security. The method includes: configuring multi-dimensional protocol layer identification rules and blacklist rule priorities; receiving blacklist rules through an automatic rule analysis engine, parsing the blacklist rules according to the multi-dimensional protocol layer identification rules, identifying the rule type, automatically assigning priority to the rule type, converting the blacklist rules into standardized rules, and automatically converting the standardized rules into dedicated configuration instructions adapted to 5G core network elements; automatically distributing the dedicated configuration instructions to the corresponding 5G core network elements through a standardized interface; actively generating simulated traffic, with the UPF intercepting the simulated traffic, comparing the actual interception results with the expected rules, and generating a verification report to achieve automatic verification of the interception effect. This method can improve service management efficiency and security.

The present application relates to the security monitoring technical field, specifically to a kind of automatic sound positioning security monitoring method, equipment and storage medium.It includes the following steps:S1, the sound signal in monitoring area is collected;S2, current time information is obtained, and current time slot is determined according to preset time slot division rule;S3, the white list sound category subset corresponding to current time slot is loaded;S4, the sound feature vector is input into sound recognition model;S5, the identification result is matched with current effective white list, preset blacklist and preset red signal category;S6, the statistical data of sound event in each time slot is recorded.Through the introduction of time slot mechanism, static white list is upgraded to dynamic white list matrix of time dimension, so that the system can automatically adapt to the background sound change in different time periods, effectively reduce the false alarm rate in night and other special periods.

The inputs and / or outputs of a generative artificial intelligence model are monitored to determine whether they contain or otherwise elicit undesired behavior by the model such as bypassing security measures, leaking sensitive information, or generating or consuming malicious content. This determination can be used to selectively trigger remediation processes to protect the model from malicious actions. Related apparatus, systems, techniques and articles are also described.