16 results about "Covert channel" patented technology

The invention relates to a network security situation awareness method and device for multi-source data fusion, equipment and a medium, and the method comprises the steps: respectively collecting kernel logs and network flow data, and carrying out the standardization processing to generate a communication data set; constructing a dynamic process link map, defining a communication type, frequency and data volume, and updating a topological relation in real time; a sliding time window is adopted to count communication time sequence characteristics, and abnormal signals deviating from normal distribution are screened in combination with a time sequence analysis technology; training a robustness classifier model through an adversarial sample enhancement technology, fusing a graph neural network to analyze a dependency relationship between processes, and filtering a false alarm signal; and the hidden channel is accurately identified and alarm information is generated in combination with a dynamic similarity threshold and a threat intelligence gain coefficient, so that the problems of insufficient multi-source data fusion, high false alarm rate of a static rule base, failure in detection of weak signals of the hidden channel and the like in a traditional method are solved. And the real-time perception and response capability of APT attacks in a complex network environment is improved.

The invention discloses a network security early warning method and system based on artificial intelligence, and relates to the technical field of network security early warning and defense. According to the method, multi-dimensional intelligent analysis of network traffic and accurate identification of abnormal traffic modes are realized, the defense concealment is enhanced through a concealed channel coding technology, detection of attackers is avoided, internal association and evolution paths of attack modes are mined by using a dynamic knowledge graph and an attention mechanism, and the attack modes are accurately identified. The method improves the recognition and prediction capability of novel attacks and advanced threats, optimizes a camouflage strategy, combines a lightweight encryption algorithm and distributed execution nodes, efficiently deploys defense actions, evaluates the attack mitigation effect in real time through a support vector machine, dynamically adjusts a defense strategy, achieves the quick recovery of a network state, and achieves the stable operation. And the real-time performance and the automation level of safety response are obviously improved.

The invention provides an adaptive data encryption method based on risk driving, and belongs to the technical field of data security based on deep learning. The method comprises the following steps: firstly, constructing a multi-dimensional input feature by collecting context information such as a communication behavior sequence, a topological structure and an equipment state; secondly, designing a communication risk intelligent assessment module based on an echo state network and a multi-head attention mechanism to realize joint identification of communication behavior types and risk levels; then, constructing an encryption strategy decision module composed of a rule tree and a strategy neural network cooperatively, and obtaining an optimal disturbance level, a disguise level, an encryption algorithm, a channel type and other strategy combinations in a limited strategy space according to an identification result; and finally, executing structure disturbance, behavior camouflage and data encryption packaging according to a strategy result, and performing secure transmission through a hidden channel. The method breaks through the limitations of lack of context modeling, uncontrollable strategy acquisition, extensive encryption granularity and the like in the traditional communication encryption technology, and has remarkable technical advantages.

The invention provides a self-adaptive hybrid covert channel construction method based on dynamic flow perception, and belongs to the technical field of covert communication and network security. The method comprises the following steps: constructing a hybrid covert channel comprising a time sequence type covert channel and a storage type covert channel to transmit secret information; monitoring the flow condition of the network in real time and calculating the network congestion degree; determining the proportion of a time sequence type covert channel and a storage type covert channel in the mixed type covert channel based on the network congestion degree; segmenting the to-be-sent secret information according to the belonging proportion to obtain to-be-sent information of a time sequence type covert channel and to-be-sent information of a storage type covert channel; the time sequence type hidden channel to-be-sent information is sent through the time sequence type hidden channel; and sending the to-be-sent information of the storage type covert channel through the storage type covert channel. The method can adapt to changes of different network loads and crowdedness degrees, the reliability and concealment of data concealed transmission are guaranteed, and the requirements of two communication parties for safe communication are met.

The present invention provides a risk-driven adaptive data encryption method, which belongs to the field of data security technology based on deep learning. First, by collecting contextual information such as communication behavior sequences, topological structures and device states, multi-dimensional input features are constructed. Secondly, a communication risk intelligent assessment module based on echo state networks and multi-head attention mechanisms is designed to achieve joint identification of communication behavior types and risk levels. After that, an encryption strategy decision module composed of a rule tree and a policy neural network is constructed. According to the identification results, the optimal perturbation level, camouflage level, encryption algorithm and channel type strategy combination is obtained within a limited strategy space. Finally, structural perturbation, behavior camouflage and data encryption encapsulation are executed according to the strategy results, and secure transmission is carried out through a covert channel. The present invention breaks through the limitations of traditional communication encryption technology, such as lack of context modeling, uncontrollable strategy acquisition and coarse encryption granularity, and has significant technical advantages.

This application discloses a covert channel identification method, apparatus, computer device, and storage medium. The method includes obtaining a DNS tunnel domain name to be detected, extracting target domain name features of the DNS tunnel domain name using a DFA algorithm, performing feature enhancement processing on the target domain name features using a convolutional neural network algorithm and a long short-term memory algorithm, respectively, to obtain local enhancement features corresponding to the convolutional neural network algorithm and global enhancement features corresponding to the long short-term memory algorithm; and determining whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel based on the fused features of the local and global enhancement features. This method can effectively improve recognition accuracy, reduce the possibility of misjudgment, and thus improve the efficiency of covert channel identification.

The present invention discloses a controllable data sharing method based on SGX and smart contracts. The method is as follows: 1) Generate a smart contract based on the data usage requirements of the data user and the code review results of the data provider for using the data, and upload it to the blockchain; 2) The data user constructs a trusted computing environment required for data calculation based on SGX; the data provider performs security verification on the trusted computing environment, and after the verification passes, transmits the encrypted sensitive data to the trusted computing environment; 3) The data user uses the sensitive data under the control of the smart contract. The present invention can not only ensure that data cannot be stolen through direct copying and covert channels during the program operation, thereby ensuring data security, but also ensure the accountability issue after data leakage, thereby ensuring the trustworthy traceability during the data usage process.

The application provides an industrial control protocol covert channel detection method and system, the method comprises the following steps: obtaining multi-source industrial control network communication data, obtaining conversation flow, command flow and field level change sequence through protocol identification and hierarchical analysis; dividing three behavior windows of fixed time length, conversation length and logical transaction, extracting communication events to form multi-granularity behavior sequence; calculating information entropy, transition entropy or structure entropy and normalizing to construct dynamic baseline entropy image; detecting entropy variation drift based on adaptive sliding threshold, marking abnormal interval; performing multi-dimensional feature clustering on entropy variation events and combining logical verification to output suspected covert channel instances; generating a traceability report and feeding back optimized detection model parameters. Through multi-scale entropy analysis and closed-loop optimization, the application realizes high-precision, low-false alarm and adaptive detection of the covert channel.

Literature on access control policies in cloud computing has focused on the design of secure models of access or on the syntactic and semantic analysis of policies but not into aspect of covert channel. A method and system for detecting covert channels in role based cloud access control policies using Large Language Model (LLM) is disclosed. A set of access control policies and an access specification is analyzed by the LLM for presence of violation indicating an implicit path between an entity (principal) and a restricted resource. Further, the LLM is prompted to generate a script Python program, which in turn generates a graph to visually depict paths leading from principal to one or more resources in the cloud environment, wherein any implicit access to the restricted resource if detected is highlighted by introducing a path from the principal to the restricted resources with label as covert channel. The covert channel so depicted provides information on possible theft threats.

The invention belongs to the technical field of network security, and relates to a DNS covert channel detection method based on Transform. Comprising the following steps: S1, acquiring a DNS query data packet in network traffic by using a network data packet capturing tool; s2, extracting a multi-dimensional feature set from the DNS query data packet; s3, carrying out preprocessing on the multi-dimensional feature set; s4, constructing a detection model based on multi-dimensional feature fusion and a self-adaptive Transform; s5, training the detection model by using the labeled DNS covert channel sample data set; and S6, processing DNS query data to be detected according to the steps S1-S3, inputting the DNS query data to be detected into the trained Transform detection model, and outputting a detection result. By adopting the technical scheme of the invention, the detection accuracy is obviously improved, the false alarm rate is greatly reduced, and the complex code detection capability is stronger.

The invention relates to a secure communication method for heterogeneous Internet of Things, which comprises the following steps that: a control end establishes a covert channel according to a communication protocol between the control end and a controlled end, sends an encryption mode and a random key to the controlled end by using the covert channel, establishes a secure channel with the control end, encrypts a control instruction input by a user to obtain an instruction ciphertext, and sends the instruction ciphertext to the controlled end; the specified ciphertext is transmitted to the controlled end through the established secure channel, the controlled end decrypts the instruction ciphertext through the obtained encryption mode and the random key to obtain a decryption instruction, and the decryption instruction is forwarded to a specified destination address through a corresponding port after being subjected to protocol conversion. The device of the destination address executes a corresponding operation according to the decryption instruction and returns a corresponding request resource, the controlled end encrypts the request resource through the obtained encryption mode and the random key to obtain an encrypted request resource, and the encrypted request resource is forwarded to the control end through a corresponding port after being subjected to protocol conversion; and the control end receives the encrypted request resource returned by the controlled end, decrypts the encrypted request resource by using the selected encryption mode and the random key to obtain a decrypted request resource, prints the decrypted request resource on a command line interface, and displays the decrypted request resource to a user. According to the invention, the concealment of network communication is improved.

This invention relates to a secure communication method for heterogeneous Internet of Things (IoT), comprising: a control terminal establishing a covert channel according to a communication protocol with a controlled terminal; sending an encryption method and a random key to the controlled terminal via the covert channel; establishing a secure channel with the control terminal; encrypting user-input control commands to obtain ciphertext; transmitting the ciphertext to the controlled terminal via the established secure channel; decrypting the ciphertext using the acquired encryption method and random key to obtain a decryption command; converting the decryption command according to a protocol and forwarding it to a specified destination address via a corresponding port; the device at the destination address executing the corresponding operation according to the decryption command and returning the corresponding requested resource; encrypting the requested resource using the acquired encryption method and random key to obtain an encrypted request resource; converting the encrypted request resource according to a protocol and forwarding it to the control terminal via a corresponding port; the control terminal receiving the encrypted request resource returned by the controlled terminal; decrypting the encrypted request resource using the selected encryption method and random key to obtain the decrypted request resource; and printing the decrypted request resource on a command-line interface for display to the user. This invention improves the concealment of network communication.

The invention relates to the technical field of computer security, in particular to a covert channel detection blocking method and device based on file system synchronous operation. When synchronous calling operation of a target file system is detected, the synchronous calling operation is intercepted, and calling information corresponding to the synchronous calling operation is determined; judging whether the target file system has a hidden channel or not based on the calling information, and when it is determined that the target file system has the hidden channel, executing blocking operation of the synchronous calling operation. According to the method, the potential hidden channel is identified by monitoring and analyzing the synchronous operation behavior of the file system, so that malicious utilization is blocked in real time, and detection and blocking are carried out completely based on rules and system behavior modes without depending on machine learning or artificial intelligence technologies.

The invention provides a data detection method, which is applied to a vehicle-mounted system and comprises the following steps: acquiring a network time protocol (NTP) data packet; and according to domain name system DNS data associated with the NTP data packet, determining whether the NTP data packet has information of the NTP covert channel. Therefore, the information of the NTP covert channel can be simply and effectively detected, and the detection cost is relatively low.

The present invention provides a controllable unidirectional optical transmission device, belonging to the field of optical communication technology, comprising: a first unidirectional transmission unit that receives signal light carrying application data; a security control unit that receives the signal light transmitted by the first unidirectional transmission unit and allows the signal light to pass through when the data security check is passed; a second unidirectional transmission unit that sends the signal light passing through the security control unit to an optical receiving unit; the signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit. By adding a security control unit between the optical transmitting unit and the optical receiving unit, the present invention forms a secure and trusted intermediate domain that is unidirectionally isolated from both the optical transmitting unit and the optical receiving unit, ensuring the reliability of the security policy, no longer relying on the security of the optical transmitting unit directly reachable by the network, completely solving the problem of passive leakage of secrets, no longer having status data such as heartbeat packets and synchronization frames passing through the network boundary, and no longer having the possibility of time-based covert channels.

The present invention relates to the technical field of APT covert channel identification methods, and provides an APT covert channel identification method and system for multimodal anomaly detection, which aims to solve the problem of detecting covert channels in advanced persistent threat (APT) attacks. Through multimodal anomaly detection, the method can identify and analyze APT attacks in complex network environments, especially those using covert channels. The present invention provides an APT covert channel identification method for multimodal anomaly detection, which includes obtaining multimodal data, normal behavior modeling, joint representation learning, enhancing anomaly sensitivity, capturing time series anomaly patterns, optimizing anomaly features, updating anomaly detection models, APT covert channel identification, and generating detection reports. The present invention is used to improve the detection accuracy of APT covert channels, reduce false alarm rates, increase detection delays, enhance the adaptability of models, and reduce computing resource consumption, thereby providing enterprises with powerful network security protection measures.