248 results about "Blacklist" patented technology

The invention provides a multi-tenant-based centralized authentication and authorization method, system, device and medium, and belongs to the technical field of security and identity management, and the system comprises a unified portal layer, an authentication layer, an authorization layer, a strategy center and an audit monitoring layer. The unified portal layer receives a user request, identifies and injects a tenant identifier, and executes WAF rule verification, JWT signature verification and Token blacklist check; the authentication layer performs user or client credential verification on different accessed identity sources, generates and issues a JWT, and monitors the life cycle of a token; the authorization layer extracts an authority statement in the JWT and a locally cached strategy snapshot; the strategy center provides centralized storage, version management and visual editing of multi-tenant strategies; through cooperative work of each layer, accurate identification, unified authentication, centralized strategy management and comprehensive audit monitoring of tenants are realized. And the security, the expandability and the management efficiency of the system are effectively improved.

The invention discloses a data processing method and system based on a business management platform, particularly relates to the technical field of advertisement putting business management, and is used for solving the problems of difficulty in abnormal attribution and low decision-making efficiency caused by dimension data isolation of an existing system. The method comprises the following steps: synchronously acquiring a channel dimension click rate and a contact dimension blacklist interception rate; when the channel click rate is abnormally reduced, extracting a blacklist interception log associated with the corresponding channel and a product dimension conversion rate; user behavior path topology distortion intensity and decision manifold compactness caused by a blacklist strategy are verified based on an interception log; when the distortion intensity exceeds a threshold value or the compactness is lower than a threshold value, backtracking an advertisement exposure user path of a corresponding channel product; analyzing time sequence association of blacklist interception nodes and product exposure nodes in the path, and generating a candidate root cause set; and detecting the product conversion rate fluctuation direction in the abnormal time period, thereby determining the root cause from the candidate set, and remarkably improving the operation decision-making efficiency and accuracy.

The invention provides a multi-level architecture-based cross-chain communication and privacy protection method, system and device, and a storage medium, and relates to the technical field of data processing, and the method comprises the steps that an application layer receives a cross-chain asset exchange request initiated by a user through a first block chain network, the request comprises source chain asset information, target chain asset information and a user identity identifier; the application layer executes KYC anti-money laundering verification based on the user identity identifier, and verifies whether a source chain asset address exists in a preset blacklist, so as to obtain a compliance verification passing result; and the protocol layer generates a cross-chain transaction proposal in response to a compliance verification passing result, and constructs a verifiable proof based on a zero-knowledge proof technology. According to the method, the natural contradiction between privacy protection and supervision compliance in a block chain cross-chain scene is solved.

The invention discloses a phishing mail detection method and system based on a large model, and relates to the technical field of network security, the system comprises a real-time detection system and an offline analysis system, and a mail content analysis module receives real-time mail data to form structured data; the detection rule center matches the structured data with a detection rule, directly intercepts a mail hitting a high-confidence blacklist rule, and transmits the structured data of a mail hitting a low-confidence blacklist rule into a phishing mail detection agent; the phishing mail detection agent sequentially performs mail header suspicious feature analysis, mail body semantic analysis, mail body structure analysis and attachment content analysis on the structured data to obtain a mail intention, a link and an attachment file; and performing corresponding analysis by combining a detection tool, and judging whether the mail is a phishing mail or not according to an analysis result. A large-model-driven phishing mail detection intelligent agent is utilized, and a detection path is dynamically planned to cope with endless phishing mail attack means.

The invention provides a fraud-related application detection method and device based on flow behavior analysis, a medium and a program product, and the method comprises the steps: carrying out the deep packet detection analysis of the current network downloading flow, comparing an application sample obtained through analysis with a preset white list and a black list, and screening out a missed to-be-detected sample; running a to-be-tested sample in a sandbox environment, collecting an interface image, extracting text features, and inputting a fraud-related classification model to judge whether the application program is a fraud-related application program or not; the method comprises the following steps: performing deep packet detection analysis on current network use traffic, extracting multi-dimensional behavior characteristics such as a terminal identifier, an application use frequency and an active time period, performing coding and scaling processing to form a fraud-related feature vector, and inputting a random forest detection model to judge whether a terminal has a fraud-related application use behavior or not. According to the method, through complementary fusion of content feature and behavior feature detection links, full-process identification of fraud-related applications in downloading and using stages is realized, and the coverage rate, the accuracy rate and the real-time performance of fraud-related detection are improved.

A method for classifying a digital certificate as malicious or non-malicious includes receiving the digital certificate from a network source and extracting textual fields from the certificate. The extracted text is embedded into a high-dimensional vector using a pretrained transformer-based encoder. The resulting test vector is queried against a vector data structure populated with reference vectors derived from known benign and malicious certificates. A similarity search is performed to identify a set of nearest reference vectors. A classification decision is made based on the labels of the most similar / nearest neighbors, using a voting mechanism. If a given set or number of them are labeled as malicious, the certificate is classified as malicious. If not, it is classified as benign. The classification result may trigger a network security action, such as blacklisting the associated IP address or identifying a botnet command and control server. The system may use various embedding techniques, including concatenating subject and issuer fields or embedding individual certificate attributes separately.

Systems and computer-implemented methods for freezing or unfreezing digital assets on a blockchain. A freeze administration service may send a signed freeze request to mining nodes, which maintain two blacklists of digital asset identifiers: a pending blacklist and a consensus blacklist. The digital asset identifiers may be transaction outpoints in some cases. If accepted by the mining node, the transaction outpoints in the freeze request are added to the pending blacklist, which causes rejection of any transactions using those outpoints, but does not cause rejection of any new blocks that include transactions using those outpoints. If a consensus threshold of acceptances is reached based on hash power, the request becomes an order and the outpoints are added to the consensus blacklist, which causes rejection of any transaction or block containing a transaction using those outpoints.

The invention relates to an exit-entry certificate authenticity identification method and system based on two-dimensional code identification, and a medium. The method comprises the following steps: constructing a cross verification rule base comprising logical relationship information between two-dimensional code information of the entry-exit certificate and signing and issuing information of the entry-exit certificate; acquiring a data page image of an entry-exit certificate to be detected; identifying a two-dimensional code in the preprocessed data page image by using a two-dimensional code identification engine; identifying signing and issuing information in the preprocessed data page image; according to the dynamic two-dimensional code verification library, the dynamic blacklist library and the identified signing and issuing information, uniqueness verification and legality verification are carried out on the identified two-dimensional code information; comparing the corresponding relationship between the identified two-dimensional code information and the identified signing and issuing information according to a cross verification rule base; and judging the authenticity of the entry-exit certificate and generating a report. According to the invention, true and false identification is carried out through three dimensions, the identification accuracy is high, and high-risk false and false situations such as same codes, different certificates and tampering fields can be accurately identified.

The invention relates to the technical field of Internet of Vehicles information security, and discloses an Internet of Vehicles-oriented Beidou signal spoofing detection and mitigation intelligent system and method, and the system comprises a multi-dimensional data sensing and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module. The method comprises the following steps: firstly, extracting a physical layer signal feature and a network flow stability feature and generating a multi-dimensional feature vector; secondly, performing feature compression and preliminary screening by using an auto-encoder, analyzing a time sequence evolution rule through a long-short-term memory network, and outputting a judgment probability; and finally, executing hierarchical defense according to the judgment probability, responding to local threats by dynamically adjusting a measurement noise covariance matrix or a hard isolation strategy, evaluating network node reputation based on a path damage index, and adding abnormal nodes into a dynamic blacklist. Through the multi-dimensional feature fusion and deep learning cascade architecture, the spoofing attack detection accuracy is improved, and the diffusion of false information in the Internet of Vehicles is effectively blocked.

The invention provides a malicious request interception system based on multi-dimensional behavior analysis and cloud-ground collaboration, relates to the technical field of network security, and analyzes normal equipment characteristics, a user behavior sequence and a cloud malicious equipment blacklist by collecting TCP / IP protocol stack characteristics and combining dynamic characteristics of the user behavior sequence. First interception is performed according to an analysis structure, deep identification is performed on a user behavior sequence after the first interception based on time sequence analysis and clustering analysis, and second interception is performed according to an identification result, so that the problems that a static rule cannot identify novel attacks and group attack features are difficult to capture are solved; and carrying out content verification on the user behavior sequence after the second interception, and carrying out third interception according to a verification result, thereby realizing dynamic adaptation of a service scene, solving the problem of poor static rule adaptability, carrying out whole system synchronization on all intercepted malicious logs, avoiding cross-node missed interception of malicious requests, and forming a defense iteration closed loop.

The invention relates to the technical field of artificial intelligence and the field of medical information security and financial services, in particular to a short message anti-fraud method and device based on artificial intelligence, equipment and a medium. According to the method, the to-be-sent short message is analyzed, the to-be-sent short message and the equipment information are subjected to feature classification extraction, for any feature category, the corresponding feature vector is evaluated according to the evaluation model, all evaluation results are fused, and the communication number is marked as the blacklist number. And receiving the short message of the communication number is blocked. The method can be applied to business scenes such as financial service and medical information security, the to-be-sent short message is analyzed by using the first anti-fraud model through the mobile terminal, if the short message is a problem short message and a user confirms sending, the short message is reported to the cloud, the result is evaluated and fused, and the global blacklist is updated to stop receiving the short message. Therefore, the short messages are comprehensively analyzed in the short message sending process of the mobile terminal, and the short messages meeting the conditions are accurately marked and blocked.

The invention provides an SQL (Structured Query Language) statement generation method and device and electronic equipment, and the method comprises the following steps: acquiring information input by a user, and retrieving the information input by the user based on a knowledge base generated by retrieval enhancement to obtain context information; preprocessing the information input by the user, and generating an SQL statement based on the preprocessed information and the context information; verifying the SQL statement based on a preset keyword black list, a table name white list and a mapping relationship between the fields and database fields; if the verification is passed, verifying whether the SQL statement is normally executed or not; and if the SQL statement is normally executed, performing complex calculation logic judgment, dynamic Python analysis and sandbox execution on the SQL statement, and determining a query result. The overall performance and practicability of the Text2SQL technology are effectively improved by enhancing the understanding ability of the model for complex queries and the accuracy of generating the SQL statements and ensuring the safety and compliance of generating the SQL statements at the same time.

The invention relates to an equipment black and white list management method and device, a storage medium and electronic equipment. The method comprises the following steps: receiving feedback information input by a user, and identifying a feedback identifier, an equipment problem type and a user appeal in the feedback information; obtaining business data of the target equipment from a business background according to the feedback identifier, and inputting the feedback information and the business data into a target large model, so that the target large model executes semantic understanding and rule reasoning according to the feedback information and the business data in combination with a business knowledge base, and generates a black and white list change suggestion; processing the original blacklist and whitelist of the target device based on the blacklist and whitelist change suggestion, and generating a new blacklist and whitelist meeting user demands; and uploading the new black and white list to a cloud storage platform, and feeding back a processing result of the downloading link containing the new black and white list to the user. The technical problems that equipment capability identification depends on manual editing of black and white lists, the process is tedious and inefficient, and errors are prone to occurring are solved.

The application discloses an IP governance method based on SAVA suitable for a cloud native system and belongs to the technical field of network security, and is characterized in that the method comprises the following steps: S1, a virtual SAVA device is used to abstract the function of the SAVA device into a capability in the cloud native system; S2, the capability is combined into a micro-service chain; S3, in a false source identification stage of source address identification, a false source address is identified; S4, in a real source identification stage of source address identification, an existing real source identification function is abstracted into a capability, and real source identification is performed; S5, in a black and white list generation stage, an IP address black and white list is generated according to intelligence of source address identification; S6, the cloud native system blocks a black list IP address according to the generated IP address black and white list; and S7, finally, intelligence is shared. The application can break through the restriction of an existing network structure, realize IP address governance based on SAVA in the cloud native system, and improve efficiency and flexibility.

The invention belongs to the technical field of data processing, and relates to a processing method and device for flow data, computer equipment and a storage medium, and the method comprises the steps: carrying out the remark extraction of the flow data if the obtained flow data does not exist in a blacklist; if the extracted remark information is not null, keyword information is extracted from the remark information, and the keyword information is matched with the order data to obtain a matched data set; performing logic processing on the matched data set to obtain a processing result; performing contract matching processing based on the processing result to obtain a contract matching number; if the contract matching number is 1, obtaining a corresponding target contract; if the target contract passes the verification, claiming the flow data to a corresponding attribution period in the target contract; and after the flow data passes the approval, carrying out verification processing on the flow data. In addition, the flow data can be stored in the block chain. The method and the device can be applied to a stream cancel-after-verification scene in the financial field, and processing efficiency and processing accuracy of stream cancel-after-verification are improved.

A communication system that performs communication among a plurality of nodes by a broker-less type publishing / subscribing model, includes: a computer including a memory and a processor configured to, in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list.

The invention discloses a url limiting method based on operation and maintenance auditing system application release, and relates to the technical field of operation and maintenance auditing systems.Before a session starts or during the session, a policy token subjected to trusted service digital signature is obtained from a trusted policy release service and loaded at an agent end; the policy token comprises a policy identifier, a version number, an effective starting and ending time, an allowable domain path template, a parameter blacklist, a rate limit and policy hash, and the agent verifies a signature and an effective period before the policy is loaded. Through short-time authorization of the policy signature, the agent only accepts the signed policy within the validity period locally, the policy is prevented from being tampered or forged halfway by the local or network, the defects of a static white list in long-term validity and trust proof are overcome, a temporary authorization scene is supported, the policy trust degree and security are improved, and the security of the policy is improved. And the risk of unauthorized access caused by strategy tampering is reduced, fine session-level authorization management is supported, and compliance proof and afterward traceability are facilitated.

The application discloses a threat intelligence automatic reasoning monitoring method based on a Bayesian network and relates to the field of network security.The method solves the problems of the existing network security protection technology, such as untimely attack detection, high false alarm rate and lack of dynamic adaptive capacity.The method comprises the following steps: collecting network flow data, pre-processing the network flow data and extracting feature information; constructing and compiling a neural network model, training the neural network model, generating a classification model for identifying malicious flow and a corresponding label encoder; inputting real-time network flow into the trained classification model for automatic classification, obtaining the determination results of normal flow and abnormal flow, and writing the determination results into a whitelist file and a blacklist file respectively; dynamically triggering a firewall strategy in combination with the results of the whitelist file and the blacklist file, and automatically blocking malicious IP addresses; constructing a Bayesian network model file; and realizing automatic reasoning of an attack chain and security situation monitoring.

The application provides an illegal data flow interception method and device of an Internet of Things card, a network device and a storage medium. A first user plane function network element acquires a data flow from a terminal loaded with an Internet of Things card; the first user plane function network element determines a data flow distribution target of the data flow according to a distribution rule; wherein the distribution target comprises an Internet of Things special network and a basic network; the first user plane function network element calls a deep packet analysis engine to analyze whether the data flow with the basic network as the distribution target is an illegal data flow meeting an illegal condition, wherein the illegal condition comprises that the data flow is from a user of the Internet of Things card and has an application feature meeting a blacklist; and the illegal data flow is intercepted. Through the user plane function network element at the edge of the operator network, the illegal data flow can be identified and intercepted in real time, thereby solving the problem of lag in the related art.

The present disclosure provides a process-oriented whitelist / blacklist security detection method, device, equipment and medium, comprising: collecting static attributes of all executable files from a terminal device; performing global reputation learning on the executable files to obtain global reputation features of the executable files; constructing a context portrait of the executable files; generating a multi-level process knowledge base according to the static attributes of the executable files, the global reputation features of the executable files, and the context portrait of the executable files; intercepting a target process when a creation request of the target process is detected, and obtaining process file information corresponding to the target process; creating a process context according to the process file information corresponding to the target process; intelligently matching the process context according to the multi-level process knowledge base to obtain a real-time risk value corresponding to the target process; and determining a security detection result of the target process according to the real-time risk value corresponding to the target process. Thus, the security detection accuracy of the process is effectively improved.

The invention discloses an intelligent door lock joint defense method and system based on repeated behavior recognition and community-level anonymous sharing and an intelligent door lock, and the method comprises the steps: collecting target data of strangers, extracting behavior abstract data, calculating the abnormal frequency of the strangers, and if the abnormal frequency exceeds an abnormal behavior threshold value, judging whether the strangers are abnormal or not; marking a stranger as a concerned object; refusing a remote unlocking instruction, starting a voice alarm, synchronizing a risk event to a user APP interface, prompting a risk score, starting a high-frequency video recording mode, and encrypting and storing behavior fragments; receiving a user feedback result, performing risk level labeling on the concerned object, and synchronously uploading the feedback result to the community sharing pool; when the concerned object appears in front of the door of the other resident again and the matching is successful, triggering a local high warning mode; and if the accumulated risk value of the concerned object exceeds a preset threshold value, bringing the concerned object into a community blacklist candidate pool. According to the invention, multi-user cooperative identification of risk personnel is realized, and the detection precision of potential risks is improved.

The invention discloses a virtual machine peripheral secure mounting method based on deep fingerprints and dynamic risk control, which is applied to a host machine virtual machine environment. After the peripherals are accessed, a daemon process is triggered to obtain VID / PID, descriptors, class specific function information, instruction response time sequences and other characteristics, deep fingerprints are constructed, a strategy library is inquired, and the peripherals are divided into white lists, black lists or unknown devices; automatically mounting the white list, stopping mounting the black list and recording an event; and calculating a comprehensive risk value R for unknown equipment, comparing the comprehensive risk value R with a threshold value, and executing automatic mounting, secondary authentication or mounting prevention. And after mounting, continuously monitoring I / O behaviors, extracting throughput, an access mode, a burst time sequence and file semantic features to carry out anomaly detection, and carrying out transmission pause, alarm and disconnection treatment when the anomaly is detected, so that full-life-cycle safety management and control are realized.

The invention discloses a ticket credit management and control method and system. The method comprises the following steps: receiving a to-be-synchronized limit list and an associated routing identifier of a first ticket server; wherein the to-be-synchronized limit list comprises a grey list and a black list; the routing identifier comprises an identifier of a server needing to synchronize the to-be-synchronized limit list; pre-configured message subscription modes of a plurality of message queues are obtained, and each message queue is associated with one type of ticket service servers; the message subscription mode comprises a target server identifier; when the routing identifier is matched with the message subscription mode, distributing the to-be-synchronized limit list to a message queue of which the message subscription mode is matched with the routing identifier; and synchronizing the to-be-synchronized limit list in the message queue to a corresponding second ticketing server. Through a real-time synchronization mechanism based on the message queue, the risk user information (grey / black list) identified by any channel or venue can be synchronized to all ticket sales channels.

Disclosed herein are system, method, and computer-readable medium aspects for swapping faulty memory addresses in a microcontroller. An example aspect includes a fault detection circuitry, a blacklist register, a comparator, a control circuitry, a first memory, and a second memory. The fault detection circuitry detects a faulty memory address in the first memory. The blacklist register stores the faulty memory address detected by the fault detection circuitry. The comparator compares a target memory address for a requested operation with the faulty memory address stored in the blacklist register. In response to a match between the target memory address and the faulty memory address stored in the blacklist register, the control circuitry then directs the requested operation to a functional memory address in the second memory.

The invention provides an equipment management method and device, equipment and a computer storage medium. The equipment management method comprises the following steps: in response to a heartbeat request sent by target equipment every preset time, acquiring a target blacklist of equipment which is recorded to meet a preset abnormal rule; determining whether the target device is recorded in a target blacklist; when the target device is recorded in the target blacklist, a first instruction is sent to the target device through the heartbeat link, and the first instruction is used for indicating to disconnect all point-to-point connections corresponding to the target device. Through the device management method, the safety of the device after point-to-point connection between the device and the client is improved.

The invention discloses a snapshot attack identification and processing method, device and equipment and a medium, is applied to a processing node in a distributed cluster, and relates to the technical field of computers, and the method comprises the steps: adding a received to-be-processed snapshot operation of a first target client to a target snapshot operation queue in real time, judging whether the queue length is greater than a preset queue threshold value or not; if yes, the snapshot operation frequency of the first target client in the preset time interval is determined; determining whether the first target client is an abnormal client initiating a snapshot attack based on the snapshot operation frequency, and if yes, alarming the first target client and / or adding the first target client to a target blacklist; and if an exception handling request of the storage node to the second target client is received, correspondingly alarming the second target client or adding the second target client to the target blacklist. Therefore, real-time detection, alarm and blocking of the abnormal snapshot behavior can be realized, so that the risk of sudden increase of cluster load is effectively relieved.

The invention discloses an Android Monkey test blacklist control method and system based on a control source ID, and relates to the field of automated testing, the method comprises the following steps: S1, configuring a blacklist control source ID set: setting a specific control source ID to be eliminated in an Android Monkey test through a command line parameter or a text file to form the blacklist control source ID set; the resource ID provides a stable control identifier for the Android system; s2, generating a random event sequence: generating the random event sequence required by Monkey test based on a native Monkey test tool; s3, acquiring a current event to be executed and a target control resource ID: extracting the event to be executed at present in the random event sequence, and acquiring the target control resource ID for executing the event through an Accessibility API (Application Program Interface); extra authority is not needed in the acquisition process; s4, event filtering judgment: comparing the resource ID of the target control obtained in the step S3 with the resource ID set of the blacklist control configured in the step S1, and judging whether the target control belongs to a control to be excluded or not; the event filtering judgment link is completed before the event is distributed to the target control.

The invention discloses a block chain-based verification method and electronic equipment, and the method comprises the steps: carrying out the analysis of a transaction request, and obtaining identity certificate data carried by the transaction request; wherein the identity certificate data is generated based on the relationship between the transaction account and the account blacklist and the version information of the account blacklist; calculating the identity data according to a preset function to obtain to-be-verified data; generating first verification data according to a public key corresponding to the account blacklist and the to-be-verified data, and generating second verification data according to the public generator and the to-be-verified data; the public generator is a preset public parameter; and verifying the transaction request according to the identity proof data, the first verification value and the second verification value. According to the technical scheme, the volume of the verification data is compressed, the data transmission amount and the calculation amount of the block chain node in the verification process are reduced, and the verification speed of the transaction request can be remarkably improved.

The invention discloses a responsibility-traceable data retrieval system based on distributed detection, which comprises a system administrator KMC node, an Internet of Things terminal equipment IoT node, a cloud server CS node, a distributed verification server VS node and a user U node, the data processing process comprises a system initialization stage, a key generation and distribution stage, a data collection and encryption stage, a user query stage, a query detection and responsibility investigation stage, a search matching stage, a data decryption stage and a user updating stage. According to the method, a system administrator allocates identities and accessible data sets to users so as to dynamically control user permissions and responsibility investigation; during responsibility investigation, query information and user identity of a user are verified by using a distributed credible verification server and a blacklist technology, so that a search request is shunted, and message processing of a cloud server and a system administrator is greatly simplified; meanwhile, the integrity of the data, stored in the cloud server, of the Internet of Things equipment can be verified after a user inquires the data.

The application discloses a kind of seller autonomous auction system and method with bidding anonymity and bid privacy, system includes four entities of seller, bidder, auction platform and anonymous identity provider, and is divided into six stages of initialization, registration, auction release, bidding, winner calculation and transaction.The invention aims at the trade-off between seller autonomy and buyer privacy protection in anonymous auction, and designs a group signature variant-zero-knowledge screenable group signature.The signature combines zero-knowledge proof with group signature, ensuring that the black list screening mechanism defined by the seller does not destroy the anonymity of the bidder.At the same time, by using homomorphic encryption technology, the winning bid calculation of the auction is carried out entirely in ciphertext, realizing the bidding amount and ordering privacy of the bidder.In the final transaction stage, the winner opens the value by presenting the bidding commitment of the winning bid, enabling the seller to correctly identify the winner without revealing their identity, ensuring smooth transaction.