100 results about "Botnet" patented technology

The invention discloses a photovoltaic cell defect detection method, and the method comprises the steps: 1) adding an SPDConv convolution module in a backbone network Backbone of a YOLOv8 model, adding a BoTNet attention mechanism behind an SPPF layer of the backbone network Backbone, and obtaining a photovoltaic cell defect detection and recognition model; 2) training the photovoltaic cell defect detection and identification model by using a photovoltaic cell defect data set; and 3) inputting a photovoltaic cell defect image to be identified into the trained photovoltaic cell defect detection model to obtain a detection result. According to the method, fine defects distributed on the surface of the solar cell can be effectively processed, the receptive field of small target defects is expanded, the problem of key feature information loss is relieved, network attention is focused on the to-be-detected target, interference of irrelevant backgrounds is reduced, the parameter quantity is reduced, and the detection precision of the model is remarkably improved.

The present disclosure provides a system for IoT Botnet detection, comprising: a flow preprocessing device for processing the flow data packets to obtain NetFlow data; a flow clustering device for segmenting the NetFlow data to obtain flow points, and clustering the flow points to form botnet transactions or normal behavior transactions; a fingerprint generation device for extracting feature fingerprints from the obtained transactions and converting the feature fingerprints into RGB fingerprint images; and a classification device for detecting the fingerprint images and yielding the classification results.

Arrangements for detecting polymorphic botnets using a pattern matching engine are provided. The platform may train a pattern matching engine to generate image pattern statuses based on a training set of historical image patterns. The platform may automatically generate real-time interaction information based on monitoring interactions between user devices and cloud platforms. The platform may generate a potentially malicious image pattern based on the real-time interaction information. The platform may then input the image pattern into the pattern matching engine to generate an image pattern status for the image pattern. The platform may store the image pattern to a pattern storage repository. Based on identifying the image pattern as malicious, the platform may initiate a security action. The platform may update the pattern matching engine based on the image pattern and its image pattern status to detect future polymorphic botnet attacks.

The invention discloses a Botnet detection method and system based on feature selection and feature fusion, and the method comprises the steps: obtaining to-be-detected network traffic, and extracting M statistical features from the to-be-detected network traffic; the M statistical features are screened, and N optimal features are screened out; constructing a host feature vector based on the N optimal features; constructing a triple list of the network traffic to be detected based on the host feature vector; based on the triple list of the network traffic, constructing a graph structure of the network traffic to be detected; and inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result. Three advanced models of OrdedGNN, GRU and Linformer are fused, and unified modeling of network flow data structure features and time sequence dependency relationships is realized, so that the accuracy and robustness of botnet detection are remarkably improved.

Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.

A service provider may deploy a security threat detection and mitigation platform in a multi-tenant virtualization environment that includes pluggable data collection, data analysis, and response components. The data analysis components may apply machine learning techniques to generate (based on training data sets) and refine (based on subsequently received data sets and feedback about the resulting classifications) predictors configured to detect particular types of security threats, such as denial of service attacks, botnets, scans, or remote desktop attacks. A data collection layer may collect, filter, organize, and curate network packet traffic data, network packet header data, or other information emitted by computing instances or applications executing on them, and provide the curated data as streams to the analysis layer. A response layer may automatically take action in response to threat detections (which may be overridden by an administrator) and may store classification data for subsequent analysis, feedback, and predictor refinement.

A system and method that uses midservers located between an enterprise network and an external network to provide mass scanning network traffic detection and analysis capabilities for the enterprise network. The midserver may be loaded with configurations that allow it to operate as a mass scan event detector capable of detecting network sniffers, botnets, and malicious peer-to-peer connections which can lead to security vulnerabilities. In such configurations, midserver may receive and analyze network traffic to determine if the network traffic is suspicious based on heuristic and signature-based techniques, and then generate an appropriate response action which can be implemented to mitigate the risk.

The invention belongs to the field of network security, and provides a Botnet traffic detection method and system based on feature selection and time sequence features, and the method comprises the steps: obtaining original network traffic data, and carrying out the preprocessing; performing feature selection on the preprocessed network traffic to obtain key network traffic; according to the key network traffic, utilizing the trained double-layer long-short-term time sequence diagram attention network model to carry out botnet detection, constructing a host feature vector by key features in the key network traffic, and carrying out diagram node embedding by taking the host feature vector and time features as node features; enhancing the time characteristic of each node; the neighbor node features of the node to be detected are aggregated and fused into the feature representation of the host node to obtain target time sequence features; and classifying the target time sequence features to obtain a botnet detection result. The method can automatically learn features and capture traffic time sequence features and spatial features, and has high-efficiency botnet detection.

The invention provides a citrus tree canopy edge segmentation method based on YOLO-BBR. The method comprises the following steps: constructing a citrus tree canopy data set; a YOLO-BBR segmentation model is constructed; a frost ice optimization algorithm RIME is used to optimize hyper-parameters of the YOLO-BBR segmentation model; and the trained YOLO-BBR segmentation model is verified. The BoTNet module, the BiFPN and the frost ice optimization algorithm are fused into the YOLO model to obtain the YOLO-BBR segmentation model, so that the local information extraction capability of the model is improved, parameters are reduced, delay is minimized, features of different scales are fused by the model, image feature expression is improved, and image segmentation by the model is facilitated; through a frost ice optimization algorithm, a model network structure does not need to be changed, rapid convergence is carried out by using a swarm intelligence optimization iteration mechanism, and an optimal hyper-parameter combination is obtained, so that the model performance is improved.

A method for classifying a digital certificate as malicious or non-malicious includes receiving the digital certificate from a network source and extracting textual fields from the certificate. The extracted text is embedded into a high-dimensional vector using a pretrained transformer-based encoder. The resulting test vector is queried against a vector data structure populated with reference vectors derived from known benign and malicious certificates. A similarity search is performed to identify a set of nearest reference vectors. A classification decision is made based on the labels of the most similar / nearest neighbors, using a voting mechanism. If a given set or number of them are labeled as malicious, the certificate is classified as malicious. If not, it is classified as benign. The classification result may trigger a network security action, such as blacklisting the associated IP address or identifying a botnet command and control server. The system may use various embedding techniques, including concatenating subject and issuer fields or embedding individual certificate attributes separately.

The invention relates to the technical field of underwater sonar detection, and discloses a region segmentation method and system for underwater target sonar image detection, and the system comprises an image collection module, an algorithm optimization module and a verification evaluation module. According to the region segmentation method and system for underwater target sonar image detection, an image acquisition module is connected with a side-scan sonar to acquire sonar image data of all regions, then image processing software is utilized to perform data enhancement on a sonar data set, an experimental data set is constructed, an algorithm optimization module sets a YOLOv9 algorithm model as a real-time target detection framework, and a real-time target detection result is obtained. A BoTNet network and a SimAm attention mechanism are introduced, optimization and improvement are carried out, feature information in an experiment data set is extracted, the feature capturing capacity is high, and the verification and evaluation module calculates the average precision mean value and score of each algorithm model according to the experiment data set and carries out calculation according to the average precision mean value and score of each algorithm model. The detection precision of the improved YOLOv9 algorithm model is compared with the detection precision of the YOLOv3 algorithm model, the detection precision of the improved YOLOv5 algorithm model, the detection precision of the improved YOLOv7 algorithm model and the detection precision of the improved YOLOv9 algorithm model are compared with the detection precision of the improved YOLOv9 algorithm model.

The invention discloses a greenhouse tomato maturity detection method based on improved YOLOv8n, and relates to the technical field of target detection. Comprising the following steps: acquiring image data of tomatoes in a greenhouse within a preset time range, performing expansion preprocessing and enhanced expansion processing by using a SinGAN network to obtain processed tomato image data, and dividing the processed tomato image data into a training set and a test set; yOLOv8n is used as a backbone network, an SPD-Conv module is introduced into the front section of the backbone network, BoTNet and an attention mechanism are introduced into the tail end of the backbone network, a greenhouse tomato maturity detection model is constructed, and the trained greenhouse tomato maturity detection model is obtained through a training set and a test set; and inputting the processed tomato image data into the trained greenhouse tomato maturity detection model to obtain an indoor tomato maturity detection result.

The invention relates to the technical field of network security, in particular to a method, a device and equipment for detecting a distributed denial of service (DDoS) attack and a storage medium, which are used for comprehensively detecting the DDoS attack so as to reduce the risk of the DDoS attack. The method comprises the steps that node information of a plurality of control nodes in an active state in a network is collected, each control node is used for controlling a botnet attacked by a distributed denial of service (DDoS), and the node information comprises address information and communication protocol information; for each control node, based on the node information of the control node, intercepting a communication instruction between the control node and a puppet host in the botnet, analyzing the communication instruction, obtaining corresponding attack task information, and obtaining host information of each puppet host controlled by the control node; and performing aggregation analysis on the node information of the plurality of control nodes, the corresponding attack task information and the host information of the associated puppet hosts to generate an attack detection result.

The invention discloses a botnet traffic detection method and device based on space-time fusion characteristics. The detection method comprises the following steps: firstly, cutting original network traffic into byte streams with the same source-target IP, the same source-target port and the same protocol; then the byte stream is processed into two different forms of space and time sequence; processing data in a spatial form by using a residual network so as to solve the problems of gradient disappearance and degradation in a traditional convolutional network; data in a time sequence form is processed by using a Transform architecture, the time sequence dependence is reduced compared with a traditional network architecture, and meanwhile, the parallel computing capability also enables the system to have faster training reasoning time; weighted feature fusion is carried out on feature vectors output by the residual network and the Transform architecture; and carrying out binary classification on the final feature vector by using a Softmax classifier, and carrying out parameter optimization by using an adaptive moment estimation algorithm to finally obtain a detection model.

The invention discloses an abnormal network detection method, apparatus and device, and a storage medium, relates to the technical field of computers, and is used for improving the efficiency and accuracy of identification and detection of an abnormal network and improving the network security. Comprising the steps that multiple pieces of flow data in a to-be-detected network are acquired, each piece of flow data comprises communication information, the to-be-detected network comprises multiple terminals, and each piece of flow data is flow data between any two terminals; based on the communication information included in each piece of traffic data, multiple feature data streams are determined, and each feature data stream is formed based on the traffic data including the same source address and destination address; for any two feature data streams in the plurality of feature data streams, determining the similarity between any two feature data streams; and based on the similarity between every two feature data streams in the plurality of feature data streams, determining a target terminal from the plurality of terminals, the target terminal being a control terminal of the botnet, and determining a controlled terminal.

The application discloses a botnet domain name determination method and device and electronic equipment. It relates to the technical field of data processing, the field of network security and other related technical fields. The method comprises the following steps: constructing a target network relationship graph according to target DNS data; performing community division on the target network relationship graph according to a community discovery algorithm to obtain multiple community structure information; and determining a target botnet domain name from the target DNS data according to the multiple community structure information. Through the application, the problem that the determination accuracy of the botnet domain name is relatively low in the related art, which is caused by calculating the similarity between the target domain name and the historical botnet domain name to determine whether the target domain name is a botnet domain name, is solved.

The invention provides a banknote detection method which can be applied to the technical field of finance. The method comprises the following steps: constructing a banknote detection model to be trained, wherein the banknote detection model comprises a backbone module, a BotNet module, a neck module, a head module and an efficient multi-scale attention module; training a to-be-trained banknote detection model based on the collected banknote sample data set to obtain a trained banknote detection model; and inputting an image of a to-be-identified banknote into the trained banknote detection model, and outputting a recovery result of the to-be-identified banknote. The invention further provides a banknote detection device and equipment, a storage medium and a program product.

The application discloses a domain name resolution method and device based on domain name request risk management and control, the method comprises the following steps: identifying domain name requests as normal domain name requests or abnormal domain name requests; according to the user domain name access behavior data set and the abnormal domain name association strength, evaluating the security rating and the security score of the user; sending the normal domain name requests initiated by users with different security ratings to the DNS server subset cluster corresponding to their levels, so that the DNS server subset cluster of the level responds to the normal domain name requests in order based on the security score; predicting the normal domain names with high probability of access to form a domain name resource list, which is used to cache the domain name resource list to the selected DNS server when the security rating of the user is higher than the set threshold, so as to improve the domain name resolution cache hit rate and the resolution efficiency. The application solves the problem of reduced performance of the domain name server caused by the low utilization rate of the conventional DNS server due to the zombie network attack.

Methods, systems, and devices for access management are described. A software platform may identify devices of a botnet based on a cluster score associated with a device characteristic. For example, the software platform may receive a request from a device to access an application. The software platform may determine a cluster score for the characteristic of the device. The cluster score may be based on a link between the device and a list of devices (e.g., devices of a botnet). If the cluster score satisfies (e.g., exceeds) a cluster score threshold, the software platform may deny the access request. In some examples, the cluster score may be determined using machine learning techniques. Based on determining the cluster score, the software platform may efficiently identify devices of the botnet and prevent brute force attacks, which may improve reliability of access for users of the application.

The invention relates to a method, a device (101), a system (106), a computer program (504) and a computer program product (505) for supporting botnet traffic detection. A device (101) for supporting botnet traffic detection obtains information associated with a first data flow of a first communication device (104a) and information associated with a second data flow of the first communication device (104a) or of a second communication device (104b), and trains a first and a second prediction model. The first and second prediction models are applied to data traffic and a label based on the outputs of the first and the second prediction models is associated with the traffic, wherein the label either indicates benign traffic or malicious traffic.

The present invention belongs to the field of network security technology and specifically discloses a DDoS defense system and method, including: determining whether a client has a forged IP address; a server performing IP filtering on access requests from the client, classifying the client IP address into those with or without a history of access; and further determining whether the IP address is a trusted IP address, a whitelisted IP address, or a blacklisted IP address. The system then randomly retrieves a client from the trusted IP list in real time to determine whether communication between the client and the server is normal. The system can accurately detect DDoS attacks through multiple determinations and save the botnet IP addresses in an IP blacklist, effectively preventing further attacks from the same botnet.

The invention provides a method and device for identifying a C2 address, electronic equipment and a storage medium, and relates to the technical field of security. According to the method, the C2 address is identified by analyzing the Botnet traffic, identifying the traffic of DNS and TCP protocol sessions and counting the traffic characteristics, so that the key characteristics of Botnet communication can be captured in time without depending on a preset rule, and the attack mode of a novel Botnet virus family can be quickly adapted. Compared with a traditional detection method based on IDS, the scheme effectively solves the problem that the defense capability is lagged due to attack changes, the real-time performance and accuracy of detection are greatly improved, network defense can respond to new threats more quickly, and the overall network security protection efficiency is enhanced.

Detect the C2 server that actually participated in the attack. In the analysis device, an identification unit identifies bots that perform a distributed denial-of-service attack from communication flow information. An extraction unit extracts servers with which a predetermined percentage or more of the identified bots have performed communication within a predetermined range of communication volume, based on past communications of the distributed denial-of-service attack.

The invention discloses an underwater wavelength scale sound scattering object classification and identification method based on continuous wavelet transform and Botnet, and the method comprises the steps: extracting the time-frequency joint features of a sound scattering signal through the continuous wavelet transform, and processing an obtained time-frequency graph through the feature extraction capability based on a convolutional neural network method, thereby recognizing and classifying an object. According to the method, a framework of ultrasonic scattering-time frequency analysis-deep learning is provided, the gradient disappearance problem in deep network training is effectively relieved through cross-layer jump connection, and it is ensured that the model can capture multi-level detailed information in a time frequency feature map; and global structure information of a time-frequency domain can be mined through a self-attention mechanism, so that the precision of a multi-category classification task is improved.

A method includes identifying, from online clustering data, an internet protocol (IP) pair. The method further includes determining, by a processing device during an offline process, that the IP pair is part of a botnet. The method further includes, in response to the determining, appending data associated with the botnet to the online clustering data.

The invention relates to the technical field of data detection, and discloses a Botnet malicious software detection method based on a download link, which comprises the following steps: firstly, analyzing original traffic, capturing a pcap packet in an environment, and extracting IP, port and url information of each frame in the pcap packet; performing data set arrangement on the data of the pcap packet in the environment; training detection is carried out, firstly, an adjacent matrix is constructed, and then parameter initialization is carried out; carrying out matrix operation on the initialized data, then carrying out multi-channel training, carrying out image convolution layer input, and training a recognition model; performing model training optimization on the trained identification model; and applying the trained model to the data based on the download link to detect the botnet malicious software. The detection method is flexible in design and can adapt to constantly changing malicious software attack means and modes. By dynamically adjusting detection strategies and parameters, the method can quickly respond to and adapt to newly appearing threats, and the efficient detection capability is kept.

The invention discloses a botnet virus defense method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: collecting a target network data packet in network traffic through an edge firewall, and extracting the features of the target network data packet; determining a target attack detection model by using historical network traffic and a preset artificial intelligence technology through the AI center, performing lightweight processing on the target attack detection model to obtain a corresponding lightweight model, and issuing the lightweight model to the edge firewall; wherein the historical network traffic comprises botnet viruses; and detecting the botnet virus in the network flow on the edge firewall by using the lightweight model based on the characteristics of the target network data packet, and updating the rule of the edge firewall to defend the attack of the botnet virus. The Botnet virus defense effect can be improved through the edge firewall and the AI technology.

The invention discloses a method and device for detecting a botnet of the Internet of Things and a storage medium, and the method comprises the steps: determining a device which initiates a DDoS attack in the Internet of Things, and obtaining a to-be-detected device; acquiring a TCP data packet sent and received by each to-be-detected device before initiating the DDoS attack to obtain sampling data; acquiring at least two groups of feature vectors of the sampling data; the source address, the destination address, the source port and the destination port of each group of feature vectors are different, and each group of feature vectors record the length value of the effective load of the corresponding TCP data packet in the sampling data according to the time sequence; calculating a matching degree between each group of feature vectors and a preset reference feature vector; selecting a feature vector of which the matching degree indication is abnormal traffic to obtain a first screening vector; the botnet detection operation is executed on each to-be-confirmed device, the IP address used by the to-be-confirmed device for accessing the Internet of Things is the source address corresponding to the first screening vector, and the unknown or encrypted botnet of the Internet of Things can be detected.

A system and method for detecting botnets are provided. The method includes monitoring a network traffic to collect network data for a device; mapping the device to members of at least one stored botnet, wherein the mapping matches a network data of the device to network data of the members of the at least one stored botnet; determining the mapped device as a botnet device of an associated botnet upon matching the network data of the device to a network data of a member of the associated botnet, wherein the associated botnet is the at least one stored botnet; and logging the network data of the mapped device as being part of the at least one stored botnet.