329 results about "Blacklist" patented technology

The invention provides a multi-tenant-based centralized authentication and authorization method, system, device and medium, and belongs to the technical field of security and identity management, and the system comprises a unified portal layer, an authentication layer, an authorization layer, a strategy center and an audit monitoring layer. The unified portal layer receives a user request, identifies and injects a tenant identifier, and executes WAF rule verification, JWT signature verification and Token blacklist check; the authentication layer performs user or client credential verification on different accessed identity sources, generates and issues a JWT, and monitors the life cycle of a token; the authorization layer extracts an authority statement in the JWT and a locally cached strategy snapshot; the strategy center provides centralized storage, version management and visual editing of multi-tenant strategies; through cooperative work of each layer, accurate identification, unified authentication, centralized strategy management and comprehensive audit monitoring of tenants are realized. And the security, the expandability and the management efficiency of the system are effectively improved.

The invention discloses a data processing method and system based on a business management platform, particularly relates to the technical field of advertisement putting business management, and is used for solving the problems of difficulty in abnormal attribution and low decision-making efficiency caused by dimension data isolation of an existing system. The method comprises the following steps: synchronously acquiring a channel dimension click rate and a contact dimension blacklist interception rate; when the channel click rate is abnormally reduced, extracting a blacklist interception log associated with the corresponding channel and a product dimension conversion rate; user behavior path topology distortion intensity and decision manifold compactness caused by a blacklist strategy are verified based on an interception log; when the distortion intensity exceeds a threshold value or the compactness is lower than a threshold value, backtracking an advertisement exposure user path of a corresponding channel product; analyzing time sequence association of blacklist interception nodes and product exposure nodes in the path, and generating a candidate root cause set; and detecting the product conversion rate fluctuation direction in the abnormal time period, thereby determining the root cause from the candidate set, and remarkably improving the operation decision-making efficiency and accuracy.

The invention provides a multi-level architecture-based cross-chain communication and privacy protection method, system and device, and a storage medium, and relates to the technical field of data processing, and the method comprises the steps that an application layer receives a cross-chain asset exchange request initiated by a user through a first block chain network, the request comprises source chain asset information, target chain asset information and a user identity identifier; the application layer executes KYC anti-money laundering verification based on the user identity identifier, and verifies whether a source chain asset address exists in a preset blacklist, so as to obtain a compliance verification passing result; and the protocol layer generates a cross-chain transaction proposal in response to a compliance verification passing result, and constructs a verifiable proof based on a zero-knowledge proof technology. According to the method, the natural contradiction between privacy protection and supervision compliance in a block chain cross-chain scene is solved.

The invention discloses a phishing mail detection method and system based on a large model, and relates to the technical field of network security, the system comprises a real-time detection system and an offline analysis system, and a mail content analysis module receives real-time mail data to form structured data; the detection rule center matches the structured data with a detection rule, directly intercepts a mail hitting a high-confidence blacklist rule, and transmits the structured data of a mail hitting a low-confidence blacklist rule into a phishing mail detection agent; the phishing mail detection agent sequentially performs mail header suspicious feature analysis, mail body semantic analysis, mail body structure analysis and attachment content analysis on the structured data to obtain a mail intention, a link and an attachment file; and performing corresponding analysis by combining a detection tool, and judging whether the mail is a phishing mail or not according to an analysis result. A large-model-driven phishing mail detection intelligent agent is utilized, and a detection path is dynamically planned to cope with endless phishing mail attack means.

The invention provides a fraud-related application detection method and device based on flow behavior analysis, a medium and a program product, and the method comprises the steps: carrying out the deep packet detection analysis of the current network downloading flow, comparing an application sample obtained through analysis with a preset white list and a black list, and screening out a missed to-be-detected sample; running a to-be-tested sample in a sandbox environment, collecting an interface image, extracting text features, and inputting a fraud-related classification model to judge whether the application program is a fraud-related application program or not; the method comprises the following steps: performing deep packet detection analysis on current network use traffic, extracting multi-dimensional behavior characteristics such as a terminal identifier, an application use frequency and an active time period, performing coding and scaling processing to form a fraud-related feature vector, and inputting a random forest detection model to judge whether a terminal has a fraud-related application use behavior or not. According to the method, through complementary fusion of content feature and behavior feature detection links, full-process identification of fraud-related applications in downloading and using stages is realized, and the coverage rate, the accuracy rate and the real-time performance of fraud-related detection are improved.

A method for classifying a digital certificate as malicious or non-malicious includes receiving the digital certificate from a network source and extracting textual fields from the certificate. The extracted text is embedded into a high-dimensional vector using a pretrained transformer-based encoder. The resulting test vector is queried against a vector data structure populated with reference vectors derived from known benign and malicious certificates. A similarity search is performed to identify a set of nearest reference vectors. A classification decision is made based on the labels of the most similar / nearest neighbors, using a voting mechanism. If a given set or number of them are labeled as malicious, the certificate is classified as malicious. If not, it is classified as benign. The classification result may trigger a network security action, such as blacklisting the associated IP address or identifying a botnet command and control server. The system may use various embedding techniques, including concatenating subject and issuer fields or embedding individual certificate attributes separately.

The invention discloses an Android instant messaging method and system based on dynamic key management and privacy protection. The system comprises an equipment fingerprint key generation module used for extracting equipment hardware fingerprints and generating a unique master key through a Hash algorithm; the dynamic session key rotation module is used for dynamically deriving a session key based on a timestamp confusion mechanism and a preset triggering condition; the key verification and synchronization module is used for realizing key legality verification through two-factor verification and a server blacklist mechanism; and the privacy protection module is used for protecting user data privacy by adopting an end-to-end encryption and local storage encryption technology, so that the technical problems in the background technology are solved, and the technical effects of remarkably improving the communication security and the privacy protection level through equipment fingerprint binding, dynamic key rotation and a two-factor verification mechanism are realized.

Systems and computer-implemented methods for freezing or unfreezing digital assets on a blockchain. A freeze administration service may send a signed freeze request to mining nodes, which maintain two blacklists of digital asset identifiers: a pending blacklist and a consensus blacklist. The digital asset identifiers may be transaction outpoints in some cases. If accepted by the mining node, the transaction outpoints in the freeze request are added to the pending blacklist, which causes rejection of any transactions using those outpoints, but does not cause rejection of any new blocks that include transactions using those outpoints. If a consensus threshold of acceptances is reached based on hash power, the request becomes an order and the outpoints are added to the consensus blacklist, which causes rejection of any transaction or block containing a transaction using those outpoints.

The invention relates to an exit-entry certificate authenticity identification method and system based on two-dimensional code identification, and a medium. The method comprises the following steps: constructing a cross verification rule base comprising logical relationship information between two-dimensional code information of the entry-exit certificate and signing and issuing information of the entry-exit certificate; acquiring a data page image of an entry-exit certificate to be detected; identifying a two-dimensional code in the preprocessed data page image by using a two-dimensional code identification engine; identifying signing and issuing information in the preprocessed data page image; according to the dynamic two-dimensional code verification library, the dynamic blacklist library and the identified signing and issuing information, uniqueness verification and legality verification are carried out on the identified two-dimensional code information; comparing the corresponding relationship between the identified two-dimensional code information and the identified signing and issuing information according to a cross verification rule base; and judging the authenticity of the entry-exit certificate and generating a report. According to the invention, true and false identification is carried out through three dimensions, the identification accuracy is high, and high-risk false and false situations such as same codes, different certificates and tampering fields can be accurately identified.

The invention discloses an authentication filtering method, system and device and a storage medium. The method comprises the following steps: determining an authentication mode of an access and mobility management function; according to the authentication mode, configuring black and white list parameters required by authentication; receiving an authentication request of a target object; the authentication request carries a user identification code and a user address; and according to the black and white list parameters and the authentication request, based on an authentication filtering strategy, determining to reject the authentication request, or sending the authentication request to an authentication server function. Through authentication filtering, the authentication workload of the authentication server function is reduced, the network load is reduced, and the communication efficiency is improved. The method can be widely applied to the technical field of wireless communication.

The invention provides an IPSecVPN encrypted traffic security detection method based on an FPGA, and the method comprises the following steps: S1, hardware analysis, S2, model construction, S3, rule updating, S4, intelligent recognition, S5, hardware acceleration, S6, dynamic encryption, and S7, joint defense and joint control. Through combined training of supervised learning, unsupervised learning and semi-supervised learning, the connection Camp can be identified; the C server hides malicious scenes such as heartbeat packets and host networking environment anomalies, can also dynamically trigger strategies according to attack types, and meanwhile utilizes a special hardware assembly line in FPGA hardware to map CNN reasoning layer convolution kernel calculation into a parallel logic unit, after acceleration, rule matching engine SPI blacklist retrieval delay is shortened, packet length distribution histogram generation speed is increased, and data transmission efficiency is improved. Threat score calculation and flow feature extraction are synchronized.

The invention provides a log burying point collection method and system, and the method comprises the steps: determining a log data source, collecting log burying point data from the log data source, and storing the log burying point data in a source data storage module; regularly reading the log burying point data in the source data storage module based on a preset reading period, and performing blacklist filtering on the log burying point data to obtain an effective event set and an effective field set; when a new field exists in the effective field set, constructing a new field statement, and packaging and storing the new field statement to a metadata storage table of the field; when newly added events exist in the effective event set, table building statements are built, packaged and stored in a metadata storage table of the table; and executing the new field statement and / or the table building statement. According to the method and the device, the change of the engineering log can be automatically sensed, the log is deeply analyzed, key information is accurately extracted, and a highly adaptive data model is automatically constructed, so that the modeling efficiency, accuracy and adaptability are greatly improved.

The invention relates to the technical field of Internet of Vehicles information security, and discloses an Internet of Vehicles-oriented Beidou signal spoofing detection and mitigation intelligent system and method, and the system comprises a multi-dimensional data sensing and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module. The method comprises the following steps: firstly, extracting a physical layer signal feature and a network flow stability feature and generating a multi-dimensional feature vector; secondly, performing feature compression and preliminary screening by using an auto-encoder, analyzing a time sequence evolution rule through a long-short-term memory network, and outputting a judgment probability; and finally, executing hierarchical defense according to the judgment probability, responding to local threats by dynamically adjusting a measurement noise covariance matrix or a hard isolation strategy, evaluating network node reputation based on a path damage index, and adding abnormal nodes into a dynamic blacklist. Through the multi-dimensional feature fusion and deep learning cascade architecture, the spoofing attack detection accuracy is improved, and the diffusion of false information in the Internet of Vehicles is effectively blocked.

The invention provides a malicious request interception system based on multi-dimensional behavior analysis and cloud-ground collaboration, relates to the technical field of network security, and analyzes normal equipment characteristics, a user behavior sequence and a cloud malicious equipment blacklist by collecting TCP / IP protocol stack characteristics and combining dynamic characteristics of the user behavior sequence. First interception is performed according to an analysis structure, deep identification is performed on a user behavior sequence after the first interception based on time sequence analysis and clustering analysis, and second interception is performed according to an identification result, so that the problems that a static rule cannot identify novel attacks and group attack features are difficult to capture are solved; and carrying out content verification on the user behavior sequence after the second interception, and carrying out third interception according to a verification result, thereby realizing dynamic adaptation of a service scene, solving the problem of poor static rule adaptability, carrying out whole system synchronization on all intercepted malicious logs, avoiding cross-node missed interception of malicious requests, and forming a defense iteration closed loop.

The invention relates to the technical field of artificial intelligence and the field of medical information security and financial services, in particular to a short message anti-fraud method and device based on artificial intelligence, equipment and a medium. According to the method, the to-be-sent short message is analyzed, the to-be-sent short message and the equipment information are subjected to feature classification extraction, for any feature category, the corresponding feature vector is evaluated according to the evaluation model, all evaluation results are fused, and the communication number is marked as the blacklist number. And receiving the short message of the communication number is blocked. The method can be applied to business scenes such as financial service and medical information security, the to-be-sent short message is analyzed by using the first anti-fraud model through the mobile terminal, if the short message is a problem short message and a user confirms sending, the short message is reported to the cloud, the result is evaluated and fused, and the global blacklist is updated to stop receiving the short message. Therefore, the short messages are comprehensively analyzed in the short message sending process of the mobile terminal, and the short messages meeting the conditions are accurately marked and blocked.

The invention provides an SQL (Structured Query Language) statement generation method and device and electronic equipment, and the method comprises the following steps: acquiring information input by a user, and retrieving the information input by the user based on a knowledge base generated by retrieval enhancement to obtain context information; preprocessing the information input by the user, and generating an SQL statement based on the preprocessed information and the context information; verifying the SQL statement based on a preset keyword black list, a table name white list and a mapping relationship between the fields and database fields; if the verification is passed, verifying whether the SQL statement is normally executed or not; and if the SQL statement is normally executed, performing complex calculation logic judgment, dynamic Python analysis and sandbox execution on the SQL statement, and determining a query result. The overall performance and practicability of the Text2SQL technology are effectively improved by enhancing the understanding ability of the model for complex queries and the accuracy of generating the SQL statements and ensuring the safety and compliance of generating the SQL statements at the same time.

A composite cryptographic data structure is described, and corresponding methods, systems, and computer readable media. The composite cryptographic data structure is instantiated based on an underlying set of cryptographic tokens (e.g., blockchain / distributed ledger tokens) that, in some embodiments, are transferrable through on-chain transactions established on one or more distributed ledger networks. Identity validation, in some embodiments, may occur at one of composite cryptographic data structure instantiation or composite cryptographic data structure redemption, or both, through the use of a whitelist or a blacklist data structure.

A computer system extracts product data from a website and correlates product records from multiple sources to one another as corresponding to the same product. A website is crawled efficiently by rendering webpages using a virtual browser that ignores blacklisted elements, extracts data from objects without rendering, and suppressing retrieval of remote resources. Data is extracted according to engine control statements including a selector and extractor. A website may be crawled repeatedly and changes in extracted data may be detected and flagged. Engine control statements may be automatically changed in response to detecting a change in the configuration of the website. Images of product records may be correlated with one another by first comparing text of the product records and selecting images for comparison based on composition. Images are compared using a machine learning model. Images determined to be similar may be presented to a human for a correlation decision.

The invention relates to an equipment black and white list management method and device, a storage medium and electronic equipment. The method comprises the following steps: receiving feedback information input by a user, and identifying a feedback identifier, an equipment problem type and a user appeal in the feedback information; obtaining business data of the target equipment from a business background according to the feedback identifier, and inputting the feedback information and the business data into a target large model, so that the target large model executes semantic understanding and rule reasoning according to the feedback information and the business data in combination with a business knowledge base, and generates a black and white list change suggestion; processing the original blacklist and whitelist of the target device based on the blacklist and whitelist change suggestion, and generating a new blacklist and whitelist meeting user demands; and uploading the new black and white list to a cloud storage platform, and feeding back a processing result of the downloading link containing the new black and white list to the user. The technical problems that equipment capability identification depends on manual editing of black and white lists, the process is tedious and inefficient, and errors are prone to occurring are solved.

The invention discloses a voice response processing method and device, electronic equipment and a storage medium. The method comprises the following steps: determining a first voiceprint feature of first voice data, wherein the first voice data comprises voice data generated by executing a first voice interaction task in an interactive voice response stage; determining voiceprint blacklist information, wherein the voiceprint blacklist information comprises a plurality of second voiceprint features and semantic features associated with the second voiceprint features; and according to the first voiceprint feature and the voiceprint blacklist information, determining a task processing resource matched with the first voice interaction task from a plurality of task processing resources, and using the task processing resource to assist in processing the first voice interaction task continuously executed after the end of an interactive voice response stage. According to the scheme, the efficiency of solving the customer demands can be improved, and unnecessary interference or loss to a customer service center is avoided.

The application discloses an IP governance method based on SAVA suitable for a cloud native system and belongs to the technical field of network security, and is characterized in that the method comprises the following steps: S1, a virtual SAVA device is used to abstract the function of the SAVA device into a capability in the cloud native system; S2, the capability is combined into a micro-service chain; S3, in a false source identification stage of source address identification, a false source address is identified; S4, in a real source identification stage of source address identification, an existing real source identification function is abstracted into a capability, and real source identification is performed; S5, in a black and white list generation stage, an IP address black and white list is generated according to intelligence of source address identification; S6, the cloud native system blocks a black list IP address according to the generated IP address black and white list; and S7, finally, intelligence is shared. The application can break through the restriction of an existing network structure, realize IP address governance based on SAVA in the cloud native system, and improve efficiency and flexibility.

The invention belongs to the technical field of data processing, and relates to a processing method and device for flow data, computer equipment and a storage medium, and the method comprises the steps: carrying out the remark extraction of the flow data if the obtained flow data does not exist in a blacklist; if the extracted remark information is not null, keyword information is extracted from the remark information, and the keyword information is matched with the order data to obtain a matched data set; performing logic processing on the matched data set to obtain a processing result; performing contract matching processing based on the processing result to obtain a contract matching number; if the contract matching number is 1, obtaining a corresponding target contract; if the target contract passes the verification, claiming the flow data to a corresponding attribution period in the target contract; and after the flow data passes the approval, carrying out verification processing on the flow data. In addition, the flow data can be stored in the block chain. The method and the device can be applied to a stream cancel-after-verification scene in the financial field, and processing efficiency and processing accuracy of stream cancel-after-verification are improved.

A communication system that performs communication among a plurality of nodes by a broker-less type publishing / subscribing model, includes: a computer including a memory and a processor configured to, in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list.

The invention discloses a url limiting method based on operation and maintenance auditing system application release, and relates to the technical field of operation and maintenance auditing systems.Before a session starts or during the session, a policy token subjected to trusted service digital signature is obtained from a trusted policy release service and loaded at an agent end; the policy token comprises a policy identifier, a version number, an effective starting and ending time, an allowable domain path template, a parameter blacklist, a rate limit and policy hash, and the agent verifies a signature and an effective period before the policy is loaded. Through short-time authorization of the policy signature, the agent only accepts the signed policy within the validity period locally, the policy is prevented from being tampered or forged halfway by the local or network, the defects of a static white list in long-term validity and trust proof are overcome, a temporary authorization scene is supported, the policy trust degree and security are improved, and the security of the policy is improved. And the risk of unauthorized access caused by strategy tampering is reduced, fine session-level authorization management is supported, and compliance proof and afterward traceability are facilitated.

The present invention belongs to the technical field of vehicle networking security, and discloses a multi-dimensional vehicle trust evaluation method for vehicle networking. The evaluation method mainly consists of two parts: in the vehicle-to-vehicle trust module, the evaluating vehicle analyzes the context and message quality of the target vehicle, and combines the recommendations of neighboring vehicles to establish the vehicle-to-vehicle trust value of the target vehicle, and decides whether to receive or discard the messages sent by it, which can effectively reduce the spread of malicious messages in the network; in the vehicle global reputation module, the RSU filters malicious feedback, calculates the feedback trust of the target vehicle using an asymmetric forgetting factor, can resist malicious slander attacks and impose heavier penalties on illegal behaviors, and the fog server calculates the global reputation value after considering its historical behavior and then decides whether to add it to the blacklist. The present invention can not only measure the reliability of vehicle nodes, but also measure the reliability of vehicle messages, and at the same time has a certain robustness against malicious attacks existing in the network.

The application discloses a threat intelligence automatic reasoning monitoring method based on a Bayesian network and relates to the field of network security.The method solves the problems of the existing network security protection technology, such as untimely attack detection, high false alarm rate and lack of dynamic adaptive capacity.The method comprises the following steps: collecting network flow data, pre-processing the network flow data and extracting feature information; constructing and compiling a neural network model, training the neural network model, generating a classification model for identifying malicious flow and a corresponding label encoder; inputting real-time network flow into the trained classification model for automatic classification, obtaining the determination results of normal flow and abnormal flow, and writing the determination results into a whitelist file and a blacklist file respectively; dynamically triggering a firewall strategy in combination with the results of the whitelist file and the blacklist file, and automatically blocking malicious IP addresses; constructing a Bayesian network model file; and realizing automatic reasoning of an attack chain and security situation monitoring.

The application provides an illegal data flow interception method and device of an Internet of Things card, a network device and a storage medium. A first user plane function network element acquires a data flow from a terminal loaded with an Internet of Things card; the first user plane function network element determines a data flow distribution target of the data flow according to a distribution rule; wherein the distribution target comprises an Internet of Things special network and a basic network; the first user plane function network element calls a deep packet analysis engine to analyze whether the data flow with the basic network as the distribution target is an illegal data flow meeting an illegal condition, wherein the illegal condition comprises that the data flow is from a user of the Internet of Things card and has an application feature meeting a blacklist; and the illegal data flow is intercepted. Through the user plane function network element at the edge of the operator network, the illegal data flow can be identified and intercepted in real time, thereby solving the problem of lag in the related art.

The present disclosure provides a process-oriented whitelist / blacklist security detection method, device, equipment and medium, comprising: collecting static attributes of all executable files from a terminal device; performing global reputation learning on the executable files to obtain global reputation features of the executable files; constructing a context portrait of the executable files; generating a multi-level process knowledge base according to the static attributes of the executable files, the global reputation features of the executable files, and the context portrait of the executable files; intercepting a target process when a creation request of the target process is detected, and obtaining process file information corresponding to the target process; creating a process context according to the process file information corresponding to the target process; intelligently matching the process context according to the multi-level process knowledge base to obtain a real-time risk value corresponding to the target process; and determining a security detection result of the target process according to the real-time risk value corresponding to the target process. Thus, the security detection accuracy of the process is effectively improved.

The invention discloses an intelligent door lock joint defense method and system based on repeated behavior recognition and community-level anonymous sharing and an intelligent door lock, and the method comprises the steps: collecting target data of strangers, extracting behavior abstract data, calculating the abnormal frequency of the strangers, and if the abnormal frequency exceeds an abnormal behavior threshold value, judging whether the strangers are abnormal or not; marking a stranger as a concerned object; refusing a remote unlocking instruction, starting a voice alarm, synchronizing a risk event to a user APP interface, prompting a risk score, starting a high-frequency video recording mode, and encrypting and storing behavior fragments; receiving a user feedback result, performing risk level labeling on the concerned object, and synchronously uploading the feedback result to the community sharing pool; when the concerned object appears in front of the door of the other resident again and the matching is successful, triggering a local high warning mode; and if the accumulated risk value of the concerned object exceeds a preset threshold value, bringing the concerned object into a community blacklist candidate pool. According to the invention, multi-user cooperative identification of risk personnel is realized, and the detection precision of potential risks is improved.

The present disclosure provides a method for generating, a method for identifying, and a device for a web crawler blacklist, which relate to big data and machine learning in the field of artificial intelligence technology. The scheme includes: obtaining network access traffic in a first time period, classifying and processing the network access traffic in the first time period based on the network access traffic in a second time period, and obtaining a classification result of the network access traffic in the first time period. The classification result of the network access traffic in the first time period indicates whether the network access traffic in the first time period is web crawler traffic. The second time period is a time period before the first time period. Based on the classification result of the network access traffic in the first time period and the classification result of the network access traffic in the second time period, a web crawler blacklist is generated, thereby avoiding the disadvantage of low accuracy caused by manually generating the web crawler blacklist and improving the accuracy and reliability of the generated web crawler blacklist.