607 results about "Blacklist" patented technology

A software bill of materials (SBOM) and vulnerability management system (“system”) disclosed herein extracts software component-related identifiers for Internet of Things (IoT) devices using deep packet inspection. The system filters the identifiers by removing identifiers that match a blacklist of identifiers known to not correspond to software components. The system then populates SBOM fields using a database storing the filtered identifiers with a schema that is uniform across SBOM file formats and queries a vulnerability database with software components indicated in the filtered identifiers to identify vulnerabilities for each IoT device for security risk assessment.

The invention provides an intelligent management method and system for a network attack blacklist, and relates to the technical field of network blacklists, and the method comprises the steps: carrying out the threat level evaluation of attack data through building a multi-level network attack feature library in combination with a decision tree and a dual-channel neural network model; implementing a differentiated blacklist strategy on the IP address according to the threat level; threat detection is carried out by adopting a distributed edge node network, and intelligent sharing and updating of a blacklist are realized by utilizing deep learning, a graph neural network and federal learning. According to the invention, accurate identification and dynamic protection of network attacks can be realized, the intelligent level of blacklist management is improved, and the network security protection effect is enhanced.

The invention relates to an access control method for a data request, and aims to construct a comprehensive security access control system. The method comprises the following steps: receiving a data request of an access client, wherein the data request comprises access identification information and a user identification; and evaluating a risk level based on the request information, and implementing a special control strategy on the high-risk request. The strategy comprises checking a preset access white list and a black list: the request in the white list is directly released, the request in the black list only initiates access authentication to an authorized user, the access is allowed if the authentication is passed, and otherwise, the access is rejected; in addition, access authentication is also carried out on requests which are not listed in a white list or a black list so as to enhance security. According to the method, a multi-level protection mechanism is formed by combining risk assessment, black and white list management and user identity authentication, malicious requests are effectively defended, different users and request characteristics are flexibly adapted, the user experience is guaranteed while the intranet data security is improved, and good expandability and adaptability are achieved.

The invention provides a multi-tenant-based centralized authentication and authorization method, system, device and medium, and belongs to the technical field of security and identity management, and the system comprises a unified portal layer, an authentication layer, an authorization layer, a strategy center and an audit monitoring layer. The unified portal layer receives a user request, identifies and injects a tenant identifier, and executes WAF rule verification, JWT signature verification and Token blacklist check; the authentication layer performs user or client credential verification on different accessed identity sources, generates and issues a JWT, and monitors the life cycle of a token; the authorization layer extracts an authority statement in the JWT and a locally cached strategy snapshot; the strategy center provides centralized storage, version management and visual editing of multi-tenant strategies; through cooperative work of each layer, accurate identification, unified authentication, centralized strategy management and comprehensive audit monitoring of tenants are realized. And the security, the expandability and the management efficiency of the system are effectively improved.

The invention relates to the technical field of cloud computing, in particular to a method and a system for realizing ARP (Address Resolution Protocol) attack prevention of a credential operating system without occupying CPU (Central Processing Unit) resources, which comprises the following steps of: directly taking over an RX direction data packet of a network card by utilizing an XDP (Extensible Data Processing) technology of an operating system kernel so as to filter the network data packet before a network protocol stack of the operating system kernel; a control interface is added, is used for controlling opening and closing of an ARP protection function and is responsible for issuing and deleting rules, and meanwhile, a time parameter T and the maximum message number Max within T time are configured; compared with the traditional ARP anti-attack technology, the method and the system for realizing the ARP anti-attack of the credential operation system without occupying the CPU resource have the beneficial effects that the ARP message is directly filtered at a network card drive inlet, so that the impact of the ARP attack message on the CPU is reduced; the operating system has an ARP anti-attack function, does not depend on a third-party application, and is safe and reliable; the self-adaptive ARP filtering technology can intelligently adjust an ARP blacklist, and when an attack source returns to normal, ARP learning can be automatically recovered.

The invention discloses a data processing method and system based on a business management platform, particularly relates to the technical field of advertisement putting business management, and is used for solving the problems of difficulty in abnormal attribution and low decision-making efficiency caused by dimension data isolation of an existing system. The method comprises the following steps: synchronously acquiring a channel dimension click rate and a contact dimension blacklist interception rate; when the channel click rate is abnormally reduced, extracting a blacklist interception log associated with the corresponding channel and a product dimension conversion rate; user behavior path topology distortion intensity and decision manifold compactness caused by a blacklist strategy are verified based on an interception log; when the distortion intensity exceeds a threshold value or the compactness is lower than a threshold value, backtracking an advertisement exposure user path of a corresponding channel product; analyzing time sequence association of blacklist interception nodes and product exposure nodes in the path, and generating a candidate root cause set; and detecting the product conversion rate fluctuation direction in the abnormal time period, thereby determining the root cause from the candidate set, and remarkably improving the operation decision-making efficiency and accuracy.

The exchange of resource allocation assistance information between a requester User Equipment (UE) and an assistant UE allows the requester to make better resource allocation decisions. The assistance information may include a blacklist, a whitelist, resource allocation information, a candidate resource set, and measurement information, for example. Both UEs may have an assistance configuration to assist in the exchange of resource allocation assistance information, that may be obtained from a third apparatus, such as a base station. The configuration may include information related to when to trigger assistance, identities of UEs, and types of assistance information, for example. The requester may, based on the assistance information received, modify a candidate resource set at a Medium Access Control (MAC) layer. The requester may, at the MAC layer, determine a configured sidelink grant for a selected destination using assistance information targeting this destination.

The invention provides a multi-level architecture-based cross-chain communication and privacy protection method, system and device, and a storage medium, and relates to the technical field of data processing, and the method comprises the steps that an application layer receives a cross-chain asset exchange request initiated by a user through a first block chain network, the request comprises source chain asset information, target chain asset information and a user identity identifier; the application layer executes KYC anti-money laundering verification based on the user identity identifier, and verifies whether a source chain asset address exists in a preset blacklist, so as to obtain a compliance verification passing result; and the protocol layer generates a cross-chain transaction proposal in response to a compliance verification passing result, and constructs a verifiable proof based on a zero-knowledge proof technology. According to the method, the natural contradiction between privacy protection and supervision compliance in a block chain cross-chain scene is solved.

The invention discloses an implementation method and device for an API gateway to protect CSRF attacks, and the method comprises the steps: S01, adding an API flag bit on the API gateway, marking whether the API relates to sensitive information, and configuring a threshold value of API request frequency, an IP blacklist, a Referer blacklist and a CORS strategy; s02, receiving an API request message, and intercepting an abnormal API request according to the configuration information of the API gateway; and S03, sending the API requests which are not intercepted to the big data platform, and further analyzing the API requests according to the detection model trained by the big data platform. According to the implementation method and device for protecting the CSRF attack by the API gateway, the current API request is detected, and the historical API request message is also combined, so that the detection conditions used for detecting the CSRF attack are more comprehensive; according to the method, the API request message of the user can be analyzed from different dimensions, data errors possibly occurring in the detection process are reduced, and therefore the accuracy of CSRF attack detection is improved.

The invention discloses a vulnerability information knowledge graph construction method and a vulnerability patch acquisition method, and belongs to the technical field of computer program detection. According to the method, the vulnerability information related to the current vulnerability is collected as much as possible through a vulnerability information collection method based on search and used for constructing the vulnerability information knowledge graph, and then one or more patch codes related to the current vulnerability are mined and submitted through a screening method based on a white list and a filtering method based on a black list. Finally, more patch code submission related to the current vulnerability is obtained through vulnerability repair code submission similarity analysis, the purpose of finding all vulnerability patches is achieved as much as possible, and finally a security patch code submission set of the vulnerability number is output. According to the method, the patch mining accuracy can be improved, meanwhile, the patch with the complete vulnerability can be efficiently mined under the conditions that single-code submission and multi-code submission exist in the vulnerability patch, and the limitation and defects of an existing vulnerability patch mining method are overcome.

The invention discloses a phishing mail detection method and system based on a large model, and relates to the technical field of network security, the system comprises a real-time detection system and an offline analysis system, and a mail content analysis module receives real-time mail data to form structured data; the detection rule center matches the structured data with a detection rule, directly intercepts a mail hitting a high-confidence blacklist rule, and transmits the structured data of a mail hitting a low-confidence blacklist rule into a phishing mail detection agent; the phishing mail detection agent sequentially performs mail header suspicious feature analysis, mail body semantic analysis, mail body structure analysis and attachment content analysis on the structured data to obtain a mail intention, a link and an attachment file; and performing corresponding analysis by combining a detection tool, and judging whether the mail is a phishing mail or not according to an analysis result. A large-model-driven phishing mail detection intelligent agent is utilized, and a detection path is dynamically planned to cope with endless phishing mail attack means.

The invention discloses a wireless ad hoc network secure communication method based on dynamic trust management, which comprises the following steps: setting initial trust values for all nodes, and detecting node interaction behaviors in real time; evaluating and dynamically adjusting a trust value according to a node interaction behavior; the source node communicates with the target node and interacts trust values of the nodes; in combination with a dynamic source routing protocol DSR, trust values of all nodes in the current path and a path average trust value are calculated; selecting a path meeting the dual trust threshold as a secure communication path; if the trust value of a certain node in the path is continuously lower than the threshold for three times, marking the node as a malicious node and adding the node into a blacklist for isolation; and if the trust value of the malicious node rises to be above the threshold value and lasts for 2 cycles, recovering the communication authority of the malicious node. According to the invention, the trust value can be adjusted according to the node interaction behavior, the secure communication path is screened, the malicious nodes are isolated, and the overall security of the network is improved.

The invention relates to an encrypted ransomware attack rapid detection method and system based on a semantic traceability graph, and the method comprises the steps: synchronously carrying out the high-speed detection and depth detection of a preprocessed mixed log stream, and obtaining a corresponding high-speed detection result and a corresponding depth detection result; wherein the priority of the high-speed detection result is greater than that of the depth detection result; the high-speed detection result is obtained by performing malicious command matching and blacklist keyword detection on the preprocessed mixed log stream; the depth detection result is related to a semantic traceability graph generated by using semantic information related to the encrypted ransomware attack behavior in the preprocessed mixed log stream; when the high-speed detection result is that the encrypted ransomware attack behavior exists, all detection is stopped, and an alarm is triggered; and under the condition that the high-speed detection result is that the encrypted ransomware attack behavior does not exist, continuing to execute deep detection so as to determine whether to trigger an alarm according to a deep detection result. The method can effectively improve the detection precision and reduce the detection hysteresis.

The invention discloses a kernel boot test method for enhancing startability and stability by using Ranconfig for an edge device, which comprises the following steps of: generating a random kernel configuration file by using a Ranconfig tool, carrying out compiling and startup test on the generated configuration file, repairing a non-startable configuration file by using a config-bias algorithm, and carrying out kernel boot test on the kernel configuration file by using the Ranconfig tool. Generating a configuration item difference set according to the difference between the minimum default configuration file and the to-be-repaired configuration file, iteratively positioning configuration items failed to start and recording the configuration items to a key configuration database; the repaired kernel is further subjected to a pressure test through a fuzzy test module, and a black list and a white list are generated in combination with equipment hardware resources, so that configuration items are optimized, and the test coverage rate is increased; according to the invention, the availability and the stability of the kernel boot test of the edge device are improved.

The invention belongs to the technical field of network security detection, and discloses an industrial network security intelligent detection system, which comprises the following steps of: summarizing log data in an industrial control network, and auditing user behaviors and security events; establishing an intrusion blacklist model, detecting an access behavior in real time, and identifying an attack behavior based on a white list rule; and recording detailed information of the attack behavior, and giving an alarm according to a severity rule. By comprehensively analyzing the log data in the industrial network, deep analysis of the network content is realized, and the compliance of the operation content and the access behavior can be effectively evaluated; meanwhile, the user behavior characteristics are extracted from the operation log, a set of behavior baselines is constructed, the user behaviors can be monitored in real time, abnormal behaviors can be found and marked in time, the identification capability of potential security threats is remarkably improved, and a powerful guarantee is provided for maintaining stable operation of an industrial network.

The invention relates to the technical field of communication, and discloses a short message interception processing method, a short message interception processing system and a server, and the method comprises the steps: obtaining first short message data, inputting the first short message data into a classification model to generate an interception strategy, judging whether a real-time short message is a junk short message or not based on the interception strategy, and if the real-time short message is the junk short message, sending the junk short message to the server; if the short messages are not spam short messages, the real-time short messages are added to the blacklist, and if the short messages are not spam short messages, the real-time short messages are pushed to the user, the corresponding interception strategy can be generated for the user based on the historical short message data of the user, so that the spam short message interception effect is improved, and the satisfaction degree of the user to short message communication is improved.

The invention provides a fraud-related application detection method and device based on flow behavior analysis, a medium and a program product, and the method comprises the steps: carrying out the deep packet detection analysis of the current network downloading flow, comparing an application sample obtained through analysis with a preset white list and a black list, and screening out a missed to-be-detected sample; running a to-be-tested sample in a sandbox environment, collecting an interface image, extracting text features, and inputting a fraud-related classification model to judge whether the application program is a fraud-related application program or not; the method comprises the following steps: performing deep packet detection analysis on current network use traffic, extracting multi-dimensional behavior characteristics such as a terminal identifier, an application use frequency and an active time period, performing coding and scaling processing to form a fraud-related feature vector, and inputting a random forest detection model to judge whether a terminal has a fraud-related application use behavior or not. According to the method, through complementary fusion of content feature and behavior feature detection links, full-process identification of fraud-related applications in downloading and using stages is realized, and the coverage rate, the accuracy rate and the real-time performance of fraud-related detection are improved.

The invention discloses a security protection system of communication equipment. According to the security protection system, an executable file directory is locked through a file system protection unit, a temporary file directory is scanned, configuration and sensitive files are encrypted, and key configuration files are locked; the network management login and operation protection unit is used for grading all accounts based on preset configuration permissions, limiting the number of login clients, executing a white list mechanism and recording login information; meanwhile, an access forbidding blacklist is periodically updated through the data center platform, and abnormity analysis is periodically carried out based on log information uploaded by communication equipment. Through linkage of file protection, login control and data center analysis, a'protection-monitoring-response 'closed loop is formed, and the fragmentation problem of a traditional scheme is solved. According to the invention, through a modular design and a collaborative mechanism, the comprehensive defense capability of the communication equipment to internal tampering, external attacks and unknown threats is remarkably improved, and the method can be widely applied to the technical field of data security.

The invention provides a cloud disk creation request scheduling method and device, electronic equipment and a storage medium, and belongs to the technical field of cloud storage. The method comprises the steps that based on historical disk creation records of a user account, a target disk creation type to which a target cloud disk creation request belongs is determined, different disk creation types have different disk creation rejection water levels, and the disk creation rejection water levels are the maximum water level when a cluster executes cloud disk creation operation; the water level is determined according to the real-time data link QPS capability and the snapshot loading capability of the cluster; obtaining a plurality of candidate clusters based on a target wound disk rejected water level corresponding to the target wound disk type, current water levels of the plurality of clusters and a cluster blacklist; determining a target cluster from the plurality of candidate clusters according to a cluster distribution mode corresponding to the target creation disk type; and sending the target cloud disk creation request to the target cluster. According to the method, the performance of the cluster in the distributed storage system is improved, the problems of read-write lagging and the like of the cluster are avoided, and the creation success rate of the cloud disk is improved.

A method for classifying a digital certificate as malicious or non-malicious includes receiving the digital certificate from a network source and extracting textual fields from the certificate. The extracted text is embedded into a high-dimensional vector using a pretrained transformer-based encoder. The resulting test vector is queried against a vector data structure populated with reference vectors derived from known benign and malicious certificates. A similarity search is performed to identify a set of nearest reference vectors. A classification decision is made based on the labels of the most similar / nearest neighbors, using a voting mechanism. If a given set or number of them are labeled as malicious, the certificate is classified as malicious. If not, it is classified as benign. The classification result may trigger a network security action, such as blacklisting the associated IP address or identifying a botnet command and control server. The system may use various embedding techniques, including concatenating subject and issuer fields or embedding individual certificate attributes separately.

A system and method for generating a virtual asset wallet address blacklist database based on a graph attention network (GAT) are disclosed. A GAT AI engine server is configured to train a GAT-based AI model using an index of a full node for each virtual asset pre-stored in an index database server, common transaction item information pre-stored in a virtual asset transaction analysis database server, and a main blacklist consisting of high-risk virtual asset wallet addresses pre-stored in a main blacklist server, to calculate GAT scores based on the trained AI model, to estimate high-risk virtual asset wallet addresses using the calculated GAT scores, and to generate a GAT blacklist consisting of the estimated high-risk virtual asset wallet addresses; and a GAT blacklist database server is configured to store the GAT blacklists generated by the GAT AI engine server.

The invention discloses an Android instant messaging method and system based on dynamic key management and privacy protection. The system comprises an equipment fingerprint key generation module used for extracting equipment hardware fingerprints and generating a unique master key through a Hash algorithm; the dynamic session key rotation module is used for dynamically deriving a session key based on a timestamp confusion mechanism and a preset triggering condition; the key verification and synchronization module is used for realizing key legality verification through two-factor verification and a server blacklist mechanism; and the privacy protection module is used for protecting user data privacy by adopting an end-to-end encryption and local storage encryption technology, so that the technical problems in the background technology are solved, and the technical effects of remarkably improving the communication security and the privacy protection level through equipment fingerprint binding, dynamic key rotation and a two-factor verification mechanism are realized.

A computer-implemented method of processing a blockchain transaction, wherein the method is performed by a receiving party and comprises: obtaining one or more probabilistic filters, wherein each probabilistic filter encodes one of i) one or more sets of whitelisted data items, or ii) one or more sets of blacklisted data items; obtaining a blockchain transaction, wherein the obtained blockchain transaction is associated with a candidate data item corresponding to i) one of the one or more sets of whitelisted data items, or ii) one on the one or more sets of blacklisted data items; and determining whether to process the obtained blockchain transaction based on whether the candidate data item is present in at least one of the one or more probabilistic filters.

Systems and computer-implemented methods for freezing or unfreezing digital assets on a blockchain. A freeze administration service may send a signed freeze request to mining nodes, which maintain two blacklists of digital asset identifiers: a pending blacklist and a consensus blacklist. The digital asset identifiers may be transaction outpoints in some cases. If accepted by the mining node, the transaction outpoints in the freeze request are added to the pending blacklist, which causes rejection of any transactions using those outpoints, but does not cause rejection of any new blocks that include transactions using those outpoints. If a consensus threshold of acceptances is reached based on hash power, the request becomes an order and the outpoints are added to the consensus blacklist, which causes rejection of any transaction or block containing a transaction using those outpoints.

A method for pre-processing information, performed by at least one processor, is provided. The method includes retrieving information from a social platform based on predetermined keywords defined by a system user, obtaining a blacklist of user accounts, the blacklist including user account information and a blacklist reason for adding the user account information to the blacklist; pre-processing the retrieved information, based on the blacklist, determining a sentiment value associated with the pre-processed information and assigning the pre-processed information to a sentiment category based on the sentiment value, and displaying a first graphical user interface (GUI) for receiving user input information to generate a ticket for the pre-processed information. A list of the retrieved information may be displayed, wherein the user accounts included in the blacklist are distinguishably displayed on the GUI.

The invention relates to an exit-entry certificate authenticity identification method and system based on two-dimensional code identification, and a medium. The method comprises the following steps: constructing a cross verification rule base comprising logical relationship information between two-dimensional code information of the entry-exit certificate and signing and issuing information of the entry-exit certificate; acquiring a data page image of an entry-exit certificate to be detected; identifying a two-dimensional code in the preprocessed data page image by using a two-dimensional code identification engine; identifying signing and issuing information in the preprocessed data page image; according to the dynamic two-dimensional code verification library, the dynamic blacklist library and the identified signing and issuing information, uniqueness verification and legality verification are carried out on the identified two-dimensional code information; comparing the corresponding relationship between the identified two-dimensional code information and the identified signing and issuing information according to a cross verification rule base; and judging the authenticity of the entry-exit certificate and generating a report. According to the invention, true and false identification is carried out through three dimensions, the identification accuracy is high, and high-risk false and false situations such as same codes, different certificates and tampering fields can be accurately identified.

The invention discloses an authentication filtering method, system and device and a storage medium. The method comprises the following steps: determining an authentication mode of an access and mobility management function; according to the authentication mode, configuring black and white list parameters required by authentication; receiving an authentication request of a target object; the authentication request carries a user identification code and a user address; and according to the black and white list parameters and the authentication request, based on an authentication filtering strategy, determining to reject the authentication request, or sending the authentication request to an authentication server function. Through authentication filtering, the authentication workload of the authentication server function is reduced, the network load is reduced, and the communication efficiency is improved. The method can be widely applied to the technical field of wireless communication.

The invention provides an IPSecVPN encrypted traffic security detection method based on an FPGA, and the method comprises the following steps: S1, hardware analysis, S2, model construction, S3, rule updating, S4, intelligent recognition, S5, hardware acceleration, S6, dynamic encryption, and S7, joint defense and joint control. Through combined training of supervised learning, unsupervised learning and semi-supervised learning, the connection Camp can be identified; the C server hides malicious scenes such as heartbeat packets and host networking environment anomalies, can also dynamically trigger strategies according to attack types, and meanwhile utilizes a special hardware assembly line in FPGA hardware to map CNN reasoning layer convolution kernel calculation into a parallel logic unit, after acceleration, rule matching engine SPI blacklist retrieval delay is shortened, packet length distribution histogram generation speed is increased, and data transmission efficiency is improved. Threat score calculation and flow feature extraction are synchronized.

The invention provides a log burying point collection method and system, and the method comprises the steps: determining a log data source, collecting log burying point data from the log data source, and storing the log burying point data in a source data storage module; regularly reading the log burying point data in the source data storage module based on a preset reading period, and performing blacklist filtering on the log burying point data to obtain an effective event set and an effective field set; when a new field exists in the effective field set, constructing a new field statement, and packaging and storing the new field statement to a metadata storage table of the field; when newly added events exist in the effective event set, table building statements are built, packaged and stored in a metadata storage table of the table; and executing the new field statement and / or the table building statement. According to the method and the device, the change of the engineering log can be automatically sensed, the log is deeply analyzed, key information is accurately extracted, and a highly adaptive data model is automatically constructed, so that the modeling efficiency, accuracy and adaptability are greatly improved.

The invention relates to the technical field of network security, in particular to a network security supervision system based on Internet of Things, which comprises a data acquisition module used for acquiring power consumption data and network data of Internet of Things equipment; the network analysis module is used for analyzing the network security of the Internet of Things equipment; the power consumption monitoring module is used for judging the power consumption state of the Internet of Things equipment; the bandwidth management module is used for managing the bandwidth of the next security management period; the risk early warning module is used for carrying out Internet of Things equipment network security risk early warning on the user according to the analysis result of the network security state of the Internet of Things equipment in the risk management period; and the communication analysis module is used for adjusting the network security risk early warning process of the Internet of Things equipment according to the white list communication proportion, the black list communication proportion and the unknown communication proportion of the Internet of Things equipment acquired in the risk management period. According to the invention, the network security supervision efficiency of the Internet of Things equipment is effectively improved.