32 results about "Botnet" patented technology

A method for classifying a digital certificate as malicious or non-malicious includes receiving the digital certificate from a network source and extracting textual fields from the certificate. The extracted text is embedded into a high-dimensional vector using a pretrained transformer-based encoder. The resulting test vector is queried against a vector data structure populated with reference vectors derived from known benign and malicious certificates. A similarity search is performed to identify a set of nearest reference vectors. A classification decision is made based on the labels of the most similar / nearest neighbors, using a voting mechanism. If a given set or number of them are labeled as malicious, the certificate is classified as malicious. If not, it is classified as benign. The classification result may trigger a network security action, such as blacklisting the associated IP address or identifying a botnet command and control server. The system may use various embedding techniques, including concatenating subject and issuer fields or embedding individual certificate attributes separately.

The application discloses a domain name resolution method and device based on domain name request risk management and control, the method comprises the following steps: identifying domain name requests as normal domain name requests or abnormal domain name requests; according to the user domain name access behavior data set and the abnormal domain name association strength, evaluating the security rating and the security score of the user; sending the normal domain name requests initiated by users with different security ratings to the DNS server subset cluster corresponding to their levels, so that the DNS server subset cluster of the level responds to the normal domain name requests in order based on the security score; predicting the normal domain names with high probability of access to form a domain name resource list, which is used to cache the domain name resource list to the selected DNS server when the security rating of the user is higher than the set threshold, so as to improve the domain name resolution cache hit rate and the resolution efficiency. The application solves the problem of reduced performance of the domain name server caused by the low utilization rate of the conventional DNS server due to the zombie network attack.

Detect the C2 server that actually participated in the attack. In the analysis device, an identification unit identifies bots that perform a distributed denial-of-service attack from communication flow information. An extraction unit extracts servers with which a predetermined percentage or more of the identified bots have performed communication within a predetermined range of communication volume, based on past communications of the distributed denial-of-service attack.

Arrangements for detecting polymorphic botnets using a pattern matching engine are provided. The platform may train a pattern matching engine to generate image pattern statuses based on a training set of historical image patterns. The platform may automatically generate real-time interaction information based on monitoring interactions between user devices and cloud platforms. The platform may generate a potentially malicious image pattern based on the real-time interaction information. The platform may then input the image pattern into the pattern matching engine to generate an image pattern status for the image pattern. The platform may store the image pattern to a pattern storage repository. Based on identifying the image pattern as malicious, the platform may initiate a security action. The platform may update the pattern matching engine based on the image pattern and its image pattern status to detect future polymorphic botnet attacks.

The invention provides a botnet traffic detection method and device and related equipment, and relates to the technical field of networks. The method comprises the following steps: extracting meta-features of network encrypted traffic, the meta-features comprising request interval time, query type distribution and request packet-response packet size distribution; determining a target standard deviation of the request interval time, a first Shannon entropy of query type distribution and a compression ratio of a response packet; and determining whether the network encrypted traffic is botnet traffic based on the target standard deviation, the first Shannon entropy and the compression ratio. Through the technical means, the technical problem of low success rate of botnet detection in related technologies is solved.

The application discloses a botnet detection method and system, and belongs to the technical field of network security. Firstly, current behavior data of each network node in a unit time length is collected. Then, the matching value of the behavior data between nodes is calculated to quantify the coordination degree of the nodes in three dimensions of time sequence synchronization, behavior similarity and communication graph structure. When multiple nodes have the same matching value, the nodes are determined as a network node group. Finally, the botnet node is confirmed by verifying the behavior consistency of the node group in continuous multiple historical periods. The botnet detection method provided by the application adopts multi-dimensional coordination analysis combined with a historical continuity verification mechanism, effectively overcomes the limitations of traditional single-node detection, significantly improves the detection accuracy and greatly reduces the false positive rate, and is suitable for real-time security protection in a large-scale network environment.

The present application relates to the technical field of underwater sonar detection, and discloses a region segmentation method and system for underwater target sonar image detection, comprising an image acquisition module, an algorithm optimization module and a verification and evaluation module. The region segmentation method and system for underwater target sonar image detection are connected to a side scan sonar through the image acquisition module to collect sonar image data of all regions, then utilize image processing software to perform data enhancement on the sonar data set and construct an experimental data set, the algorithm optimization module sets the YOLOv9 algorithm model as a real-time target detection framework, then introduces a BoTNet network and a SimAm attention mechanism for optimization and improvement, and is used for extracting feature information in the experimental data set, has strong feature capturing capability, the verification and evaluation module calculates the average precision mean and score of each algorithm model according to the experimental data set, compares the detection precision of the improved YOLOv9 algorithm model with the YOLOv3 algorithm model, the YOLOv5 algorithm model, the YOLOv7 algorithm model and the YOLOv9 algorithm model, and has high wreck detection precision.

This invention relates to the field of network behavior analysis technology, specifically a method for automatically inventorying and monitoring botnet assets. The method includes the following steps: extracting traffic and analyzing the five-tuple order to generate communication trajectories; identifying abnormal communication and time differences; dividing state sequences to analyze interruption relationships and determine botnet assets; and associating abnormal ports to update asset status. In this invention, by constructing continuous interaction trajectories around communication five-tuples combined with process and interface information, and introducing time intervals and adjacency relationships to characterize communication evolution paths, it integrates time interval sequence differences and position offset consistency to identify abnormal behavior characteristics, possessing stronger dynamic correlation capabilities. Through communication state sequence division and extraction of interruption intervals and attenuation relationships to characterize state evolution, and combining with associated communication records and trajectory existence for multi-dimensional correlation verification, it enables the identification of hidden control links and intermittent communication characteristics, improving the level of abnormal asset judgment and the stability of status updates.

This application discloses a method, apparatus, device, and storage medium for detecting botnet hosts. The method includes: acquiring NetFlow data of the network traffic of the host to be detected; extracting features from the NetFlow data to obtain target feature information; and using a KNN algorithm model to detect the target feature information to determine whether the host to be detected is a botnet host. This method improves detection efficiency by extracting target feature information consistent with botnet hosts based on NetFlow data. Furthermore, the use of the KNN algorithm model improves detection accuracy, enabling rapid identification of botnet hosts and timely blocking of malicious requests initiated by them, resulting in good timeliness.

The invention discloses an AGV (Automatic Guided Vehicle) three-dimensional obstacle detection method and system based on an improved PointPill multi-modal fusion algorithm, which introduces an ECA lightweight attention mechanism in a point cloud coding stage, enhances key geometric features, alleviates the insufficiency of sparse point cloud information, and reduces the calculation complexity and parameter quantity of the attention mechanism. A ConvNeXt V2 module is added in the point cloud backbone network, all feature channels are fully utilized, and the feature learning ability of the backbone network is improved. According to the method, the BotNet algorithm is used for carrying out feature extraction on the RGB image, in the deep convolution process, the global context modeling capacity is enhanced in a self-attention mode, the relation between the overall composition of the image and different object parts is better understood, and a more accurate classification decision is made. And finally, realizing bidirectional interaction between the point cloud features and the RGB image features by using a feature bidirectional fusion interactive fusion network, fully mining complementary information, realizing effective integration of two kinds of modal information, and improving obstacle detection precision.

The invention discloses a mining belt conveyor belt longitudinal tearing detection method based on an improved YOLOv5 network. The mining belt conveyor belt longitudinal tearing detection method comprises the following steps that data are collected on site in a mine field; making a conveyor belt tearing data set; preprocessing the data; a YOLOv5 network is configured; a BoTNet attention mechanism is added; the ShapeIOU is used for calculating the loss; model training and parameter adjustment; evaluating and testing the performance of the model; and comparing algorithms. According to the mining belt conveyor belt longitudinal tear detection method based on the improved YOLOv5 network, tear damage to the surface of a conveyor belt can be rapidly and accurately recognized, particularly, good detection precision is achieved for small tear, the false detection rate and the omission ratio of manual detection are reduced, and the detection efficiency is improved. And the tearing detection precision and speed of the conveyor are greatly improved. Moreover, the invention designs a novel conveyor tearing detection algorithm, and the detection precision of the model on a tiny target is remarkably improved. According to the invention, non-stop real-time detection can be realized, and the problem of manual detection efficiency of enterprises is solved.

The application discloses a botnet detection method based on a multi-modal stacked autoencoder. The method comprises the following steps: obtaining an executable file of an application; performing dynamic analysis and static analysis on a dataset containing benign programs and bot programs respectively, and extracting flow-based dynamic features and printable string information graph-based static features; pre-training two stacked autoencoders to encode flow-based features and graph-based features respectively, and extract deep features; fusing the dynamic features and the static features based on a multi-modal autoencoder; fine-tuning the multi-modal stacked autoencoder model; taking the encoder of the trained multi-modal stacked autoencoder model as a feature extractor, taking the output of a shared hidden layer as the input of a softmax layer, and performing bot program detection. The application can automatically fuse static features and dynamic features through an improved multi-modal stacked autoencoder, can learn the complex relationship between two different modal features, can fully play the advantages of a hybrid analysis method, and can improve the precision of detecting botnet programs.

The application relates to a method for discovering associated nodes of a springboard node. By analyzing the flow data of the springboard node in a botnet, nodes with highly similar behaviors are discovered from the nodes connected to the springboard node, thereby discovering multiple associated nodes belonging to the same botnet, positioning the C&C server node possibly at the upper level, and providing help for subsequent trace analysis, discovery and prevention of botnet threats. The application can extract important features representing the behaviors of network nodes through analysis of network flow data, input the features into a well-constructed program after pretreatment, complete the discovery of nodes with similar behaviors, and output the results. By drawing a flow curve of the communication between highly suspicious nodes and the springboard node and visually displaying the flow curve, the upper and lower control relationship of the suspicious IP pair is further verified, and the discovery of associated nodes of the same botnet and attack prevention are realized.

Embodiments of the present disclosure provide a botnet management method and device based on deep protocol reverse analysis, which comprises: deploying a plurality of high-interaction honeypots in a virtual machine or a container, simulating real operating systems, application services or Internet of Things devices to trap bot nodes; obtaining data packets between the bot nodes and the honeypots, reverse analyzing the communication protocols in the data packets to obtain protocol analysis results; based on the protocol analysis results, constructing a virtual C&C communication network to simulate the communication protocols of the attackers to send fake instructions to the connected bot nodes; recording the node information connected to the virtual C&C communication network, and constructing a node relationship graph based on the node information; and identifying abnormal behavior patterns based on the node relationship graph, triggering a defense mechanism or a countermeasure mechanism when an abnormal behavior is detected. The present scheme not only can discover and analyze bot nodes when encountering botnet attacks, but also can counterattack and attack the attackers through an active virtual command and control network.

The application discloses a botnet threat hunting system based on binary code automatic analysis, relates to the network field, and comprises a real-time capturing subsystem and an intelligent analysis subsystem, which realize real-time capturing of samples and intelligent analysis of C&C servers respectively. The application successfully constructs corresponding pseudo Bot through the captured malicious samples, successfully accesses the C&C server, receives corresponding attack information, and successfully realizes a high-precision and high-efficiency botnet threat detection system.

The invention relates to a layered distillation method for botnet detection in encrypted DNS (Domain Name Server) traffic, which mainly comprises the following steps of: carrying out adaptive feature extraction and screening on preprocessed data by combining an entropy weight method and grey correlation analysis, and screening out optimal features which are strongly correlated with botnet behaviors; classifying the botnet by adopting a spatial clustering classification strategy to obtain a plurality of different types of botnet features; a hierarchical knowledge distillation model HLD-TCN is constructed and trained; deploying a trained multi-student model; and inputting the real-time encrypted DNS traffic, sequentially carrying out parallel detection on the real-time encrypted DNS traffic through the student models, and if a certain student model is judged to be abnormal, immediately marking the real-time encrypted DNS traffic as Botnet traffic and terminating subsequent detection. The method has the advantages that the accuracy of botnet detection in the encrypted DNS traffic is improved, and an efficient and lightweight solution is provided for network security protection.

Described herein are methods, systems, and apparatuses for query analysis and classification. A plurality of entity identifier queries associated with a plurality of entity identifiers may be received and classified as being legitimate or illegitimate. Illegitimate entity identifier queries may be associated with originating devices that are infected with malware. The originating devices may have sent the illegitimate entity identifier queries in an attempt to communicate with a command and control server(s) of a botnet. Such originating devices may be identified and one or more remedial actions may be performed.

The application discloses a botnet propagation prediction method based on a network security knowledge graph, and the steps include: 1) constructing a network security knowledge graph based on network security data, and marking nodes involved in each botnet event in historical network security data on the network security knowledge graph; 2) calculating the state of each node in the network security knowledge graph, and generating a botnet propagation topology graph of a corresponding botnet according to the state of each node in each botnet event; 3) layering nodes in the botnet propagation topology graph of a target botnet, and setting a corresponding influence value Ks for nodes in each layer; 4) constructing a propagation model of the target botnet according to the state of each node in the target botnet and the corresponding influence value Ks; and 5) generating a dynamic topology graph of a propagation process of the target botnet according to the propagation model, and predicting the propagation situation of the target botnet at the next moment.

An MCP flooding attack detection method based on behavior characteristics comprises the following steps: collecting and learning a large amount of legal MCP traffic, extracting parameter length, request interval, nesting depth and response time characteristics, and constructing four-dimensional normal distribution as a legal traffic model based on the parameters, the request interval, the nesting depth and the response time characteristics; the probability density of the feature vector of each new request under the legal model is calculated to judge the abnormal request and the attack type thereof, finally, an SIR infectious disease dynamic model and an ARIMA time sequence model are further innovatively integrated to predict the zombie node scale and the attack trend, and the prediction result is used as input to automatically trigger and adjust a defense strategy; according to the method, botnet attack detection is carried out on the large language model integrated with the MCP protocol by utilizing the multi-dimensional behavior characteristics, so that attack detection and an adaptive defense strategy are effectively realized, and a security protection capability is also provided for a complex network environment in which the large language model is integrated with the MCP protocol; the invention further comprises a system, equipment and a storage medium for implementing the method.

The invention provides a troubleshooting processing method, device, equipment and medium for a botnet infected machine in an intranet environment, and the method comprises the steps: carrying out the abnormality analysis of network flow and network behaviors corresponding to an intranet, so as to determine target equipment infected by a botnet from a plurality of pieces of communication equipment in communication connection with the intranet; isolating the target equipment from the intranet; the propagation module is used for carrying out malicious software analysis on the target equipment so as to extract the botnet from the target equipment; embedding an executable code corresponding to the propagation module into a preset special killing tool to obtain a disposal tool; the method comprises the following steps: comprehensively scanning an intranet environment through a disposal tool to determine transmission equipment with botnet infection; botnet clearing and reinforcement protection are performed on the target device and the propagation device, so that the protection capability of the infected machine in the intranet is further enhanced, and it is ensured that the infected machine does not become an attack target of the Botnet any more.

This disclosure provides a method for identifying the master controller of a botnet, relating to the field of network security technology, particularly attack attribution, botnets, and deep learning. The specific implementation scheme is as follows: In response to the detection of attack traffic targeting external communication addresses, a set of controlled hosts corresponding to the attack traffic is determined, and network flow data of each controlled host within a preset attack attribution time window is extracted; for any controlled host, botnet feature preprocessing is performed on the network flow data to generate host behavior description information; the host behavior description information of each controlled host is input into a large language model in the security field, and through the prompt information configured for botnet feature analysis in the large language model, a list of suspected master controllers corresponding to each controlled host is output; the lists of suspected master controllers of each controlled host are aggregated, attack correlation analysis is performed, and the target botnet master controller is determined based on the analysis results.

The invention discloses a network traffic deep packet detection and malicious behavior recognition system, which relates to the technical field of network security, and comprises a traffic feature multi-dimensional extraction module, a dynamic graph construction and updating module, an adaptive graph attention recognition module and a closed loop feedback optimization module. A network communication relation is modeled into a dynamic graph structure, a graph neural network based on a dynamic attention mechanism is adopted to identify malicious behaviors such as botnet, transverse movement and data leakage, system parameters are continuously optimized through a closed-loop feedback mechanism, and the four modules form a deep coupling closed-loop cooperative system. According to the method, the mutual promotion and superposition synergistic effect is achieved, the system malicious behavior recognition accuracy rate reaches 96% or above, the processing delay is controlled at the microsecond level, and the method can be applied to network security protection of operator networks and large enterprises.

The present invention provides a method and system for classifying and suppressing zombie networks facing different communication architectures, which relates to the field of network security technology. The method includes: determining an implementable suppression channel according to control instructions, heartbeat mechanisms, and data synchronization characteristics, in combination with the protocol characteristics and network structure to which they belong; matching a corresponding blocking scheme based on the suppression channel; the blocking scheme is selected according to the communication architecture type of the zombie network, and the communication architecture type includes centralized control C2 communication type, peer-to-peer P2P communication type, and hybrid type; implementing blocking measures matching the blocking scheme through policy scheduling, adjusting the suppression blocking intensity according to network feedback, coordinating multi-point linkage operations, and evaluating the blocking effect at the same time. The present invention enhances the ability to govern zombie networks in cyberspace by effectively cutting off and interfering with the communication links of centralized control communication type, peer-to-peer communication type, and hybrid type zombie networks.

A controller, detection method, and communication system with botnet detection capabilities are disclosed. The communication system includes a controller, a first networking device, a switch, and a routing device. The switch communicatively connects the first networking device and the controller, and the routing device communicatively connects the switch and a second networking device. The controller has botnet detection capabilities and includes a computing unit, a storage unit, and a network interface. The storage unit is electrically connected to the computing unit and stores a plurality of program codes. The network interface is used to acquire a plurality of packets transmitted from the first networking device to the second networking device. The computing unit executes the plurality of program codes to acquire a plurality of headers from the plurality of packets and to determine, using a plurality of characteristic parameters from the headers, whether the first networking device has been infected with malware and become a member of a botnet.

This application relates to the field of network detection, specifically disclosing a method and system for detecting IoT botnets that integrates multi-dimensional information. First, it transforms raw traffic data into structured network flow records through flow feature aggregation, laying the foundation for deep analysis. Second, it constructs a time-series dynamic communication graph from these timestamped flow records, thereby transforming isolated network events into a network topology that reflects the interaction relationships and behavioral evolution between devices. Finally, it introduces a time-graph attention mechanism to perform time-aware aggregation learning on the nodes and their neighborhood information in the dynamic graph. This mechanism can adaptively focus on key cooperative communication behaviors, deeply integrating multi-dimensional information such as node topology, interaction content, and temporal evolution to generate highly discriminative feature representations. This effectively identifies the covert and cooperative attack patterns of botnets, improving the accuracy and robustness of detection.

This invention belongs to the field of virtual reality and discloses a virtual try-on method that integrates multi-viewpoint and multi-level sampling distortion modules. Specifically, it includes: multi-viewpoint image acquisition and preprocessing; extracting multi-angle human body features using a multi-branch residual fusion network and achieving spatial consistency fusion through a cross-attention mechanism; inputting human body features and clothing images into a multi-level sampling distortion module to perform local and global deformation on different parts of the clothing; using a BoTNet-based generator to generate high-fidelity virtual try-on images through a multi-head self-attention mechanism and a bottleneck residual structure; and finally, achieving multi-angle visualization through a rendering module. This invention solves the problems of single viewpoint, unnatural clothing deformation, and low texture fidelity in existing virtual try-on technologies, achieving a virtual try-on effect that is natural-fitting, detailed, and can be displayed from multiple angles, with high real-time performance and broad application prospects.

The invention provides a Botnet attack simulation-oriented knowledge enhanced large model time series data generation method. A simulation instruction is received through an interaction interface, a semantic enhancement module is communicated with a knowledge graph and threat intelligence to complete intention recognition, graph reasoning, template matching and consistency verification, and structured scene features with confidence are output; the environment perception adaptation module calculates a scale scaling factor in combination with asset surveying and mapping, vulnerability risks and a historical utilization success rate; the generation engine generates an exponential growth-cosine platform-exponential decay parameter template by using Transform in a unified normalized time sequence space, renders a curve, and introduces OU noise synthesis flow and an active host time sequence; the self-adaptive optimization module verifies the peak value, the accumulated value and the increment under the asset / IP / port / bandwidth boundary and updates the template or the low-rank adaptation layer in a closed loop mode, high simulation of form-scale decoupling is achieved, and simulation data can be restrained.

The embodiment of the invention provides a Botnet management method and device based on deep protocol reverse analysis. The method comprises the following steps: deploying a plurality of high-interaction honeypots in a virtual machine or a container, simulating a real operating system, application service or Internet of Things equipment, and trapping Botnet nodes; acquiring a data packet between the zombie node and the honeypot, and performing reverse analysis on a communication protocol in the data packet to obtain a protocol analysis result; constructing a virtual Camp based on a protocol analysis result; c, the communication network simulates a communication protocol of an attacker to send a forged instruction to the connected zombie node; the record is connected to the virtual Camp; c, communicating node information of the network, and constructing a node relation graph based on the node information; and identifying an abnormal behavior mode based on the node relation graph, and triggering a defense mechanism or a countering mechanism when an abnormal behavior is detected. According to the scheme, when the botnet attack is encountered, the botnet node can be found and analyzed, and an attacker can be countered and attacked through an active virtual command and a control network.

The invention discloses a zombie process resource recovery method and system, a medium and a product, and the method comprises the steps: periodically carrying out process state inspection on continuous processes of an operating system, and adding process information of the continuous processes in a zombie state into a global zombie process chain table; selecting one piece of process information from the process information of the global zombie process chain table as current processing information, judging whether a corresponding target process meets a process recovery condition or not according to the information, and if the condition is met, directly executing resource recovery operation on the target process by a kernel; and processing the next piece of process information in the global zombie process chain table after the subsequent processing is completed, and if the condition is not met, continuing to process the next piece of process information in the global zombie process chain table. According to the method, the zombie process is directly recovered through the kernel, the business service interruption of the parent process is not caused, and the safe and effective recovery of the zombie process is realized.