634 results about "Cyber-attack" patented technology

An apparatus comprises a cyber security restoration engine configured to simulate an asset of a computing network that is involved in a simulated cyberattack. The cyber security restoration engine is configured to generate data representative of a simulated cyber security scenario involving the asset of the computing network. The simulated cyber security scenario is derived from a real world cyber security scenario mapped to the asset.

A quantum-key distributed (QKD)-enabled communication architecture it devises for networked microgrids (NMGs). A real-time QKD-enabled NMGs testbed built in an RTDS environment, and a novel two-level key pool sharing (TLKPS) strategy it designs to improve the system resilience against cyberattacks. In the QKD-based microgrid testbed design there is used a real-time power system simulator, i.e., RTDS, including the QKD modeling, hardware connection, communication network design, and QKD integration. By integrating QKD features into a real-time microgrid simulator, this testbed offers a flexible and programmable testing environment for evaluating the performance of QKD-enabled microgrids under a variety of scenarios.

A method includes creating, via a server, a plurality of virtualized human personalities associated with respective human users; receiving, via the server, a cyberattack message; determining, via the server, the cyberattack message targets a human user of the respective human users; selecting, via the server, a virtualized human personality of the plurality of virtualized human personalities based on the virtualized human personality being associated with the human user targeted by the cyberattack message; and responding, via the server, to the cyberattack message using the virtualized human personality selected from the plurality of virtualized human personalities.

The present disclosure relates to cyber-attack mitigation, information theoretic security in-motion, at-rest and storage intrusion mitigation with exclusive-path, content routing across an overlay network. Overlay network built upon Data Transport Controllers (DTC), SG nodes and SV nodes. System modules are deployed across various geo locations in a Wide Area Network, operating at the control of Universal Security Controller (USC). USC extracts system, security and storage activity telemetry data from Secure Vaults, Storage Gateways and Data Transport Controllers to orchestrate Autonomous Security Operations. SG nodes create SP fragments and store in SV nodes upon a data input operation. USC initiates an Exclusive-path content forwarding from the first SG node, across the DTC overlay through an exclusive list of DTC nodes and move it to second SG node. USC keeps the security control of SG nodes, DTC nodes and SV nodes and realize multi-vectored storage security at-rest and in-motion. SG nodes are connected to SV nodes which are micro-segmented, data vaults with restricted network reachability.

The invention relates to the technical field of risk assessment, and discloses an intelligent compliance risk assessment and monitoring system, which comprises a threat detection module, a management module, a data protection module and an automatic risk assessment module, the management module is used for identifying potential network attacks, malicious behaviors or abnormal traffic and providing automatic early warning, and the management module is used for docking global and local data protection and privacy laws and regulations, automatically analyzing compliance states of enterprises, generating compliance reports and providing correction suggestions; the data protection module is responsible for encrypting sensitive data, managing data access authority and tracking data flow, and the automatic risk assessment module performs automatic assessment on risk conditions of enterprises by utilizing artificial intelligence and machine learning technologies, predicts future compliance risks and generates a coping scheme. The method has the advantage of monitoring and analyzing potential threats and compliance risks.

Systems and methods for mathematical modeling of the hardware and software stack of commodity computer platforms are provided, enabling provable guarantees on memory, device, and program execution. This approach addresses the technical problem of reliance on system agents that rely on implicit trust in the operating environment, which can be exploited by sophisticated attackers using complex threats such as memory access exploits and code / data integrity exploits. The solution provides a proactive, mathematically-backed security solution that eliminates entire classes of cyberattacks by design, ensuring realizable guarantees on commodity computer platforms running hardware and software stack elements at the lowest operating level. This approach has significant advantages over current reactive cybersecurity methods, including reduced complexity and overhead, and increased confidence in the integrity of the system. The solution's main uses include providing mathematically-backed security and availability guarantees for critical infrastructure, financial institutions, and other organizations vulnerable to cyberattacks.

The invention discloses a multi-agent robust specified time state estimation method based on discrete continuous mixing, and belongs to the field of distributed state estimation of an agent system, and the method comprises the following steps: S1, analyzing the uncertainty of a multi-agent system and a measurement noise model, and building a system dynamic equation; s2, designing a transformation matrix based on a null space and a system dynamic equation, and constructing a multi-agent system consistency error; s3, constructing a state space equation of the state observer based on the consistency error of the multi-agent system; and S4, based on the state space equation of the state observer, realizing specified time convergence of the estimation error through the power return-to-zero characteristic of the power zero matrix. According to the multi-agent robust specified time state estimation method based on discrete continuous mixing, state estimation is carried out only by using relative output information between neighbors without depending on relative input information between the neighbors, use of communication channels is avoided, and the method has the characteristic of network attack immunity.

Embodiments of a cyberattack monitoring system are disclosed to identify successful attacks on a service based on benign activities of the attacker performed after the initial attack attempt. In embodiments, the system identifies the initial attack by matching client actions to known attack patterns. Clients observed with attempted attacks are remembered as suspected attackers. The system will then monitor subsequent actions of suspected attackers for signs that the initial attack attempt was successful. In embodiments, a successful attack is recognized when the system observes one or more subsequent benign actions by the suspected attacker. In embodiments, the presence of follow-on benign actions is used as a filter to filter out unsuccessful attacks and false positives detected by the system. The filtering enables the system to better focus system resources and human attention on a small set of client activities that are likely successful attacks.

The invention relates to the technical field of new energy vehicle charging, and provides a new energy vehicle charging data interaction method and a charging pile operation management system. The method comprises the steps that a target charging pile responds to a charging control request sent by a BMS, attribute information of the charging control request is acquired, and a verification strategy is determined based on the attribute information; when it is determined that the verification strategy is local verification, verifying the charging control request based on historical charging data to determine whether the charging control request has an attack risk; when the verification strategy is determined to be far-end verification, extracting a first charging parameter in the charging control request, and constructing a first parameter verification request; the target client processes the first parameter verification request to generate a first verification result; and the target charging pile judges whether the charging control request has an attack risk or not according to the first verification result, so that identification of a network attack behavior is realized, and the communication security between the target charging pile and the BMS is improved.

The invention relates to the technical field of network security, in particular to a non-cooperative network attack tracing method based on multiple stages. The method comprises the following steps: providing security verification for network equipment and a terminal in a traceability process based on a collaborative authentication code, and ensuring credibility and integrity of the traceability process; converting the network attack into behavior feature data based on the feature extraction of the attack behavior; extracting event-level features, revealing a sequential relationship and a dependency relationship of attack behaviors, and identifying a potential attack mode; performing time alignment on the events by using causal analysis to form a standardized causal chain; performing multi-dimensional feature fusion in combination with a Transform network and an NLP pre-training model, and identifying an attack mode; an IP address database, a self-built organization library and a code author library are combined, and a multi-cascade CNN structure is adopted to carry out attack source positioning and attacker tracing. According to the invention, through multi-level feature analysis, accurate identification and traceability of complex network attacks are realized.

A data protection system uses machine learning to detect the cyber-attacks on a data protection system in advance to notify the user of possible attacks and also instigate any counter attacks to the best possible extent. The system trains a support vector machine model (SVM) to recognize a malware, or other type of attack before it comes into action against the system. This model learns the parameters of hazardous files or code to prepare the best model of attributes of such files to help block the malware proactively. It uses several independent variables as features to gain more accuracy to the threat detection. Some of the parameters include: rate of data change (Drastic / High / Low), attack vulnerability history, resource usage history, performance metrics, application hit ratio, and the like.

System and methods are disclosed for providing unforgeable telemetry on computer platforms. Mathematical modeling and theorem proving are utilized to guarantee the integrity of telemetry probe execution flow and trigger, thereby preventing circumvention and tampering of logged probe data. In contrast to current state-of-the-art solutions that rely implicitly on the operating environment, this approach provides a sound and complete assurance of telemetry output. The system enables organizations to map unforgeable telemetry probe data to industry and government cybersecurity regulatory controls, ensuring compliance therewith. This invention addresses the shortcomings of existing solutions, including their vulnerability to sophisticated attacks, operational complexity, and inability to provide unforgeable telemetry data, thereby providing a reliable and accurate monitoring output in the presence of cyberattacks on computer platforms.

Arrangements for detecting polymorphic botnets using a pattern matching engine are provided. The platform may train a pattern matching engine to generate image pattern statuses based on a training set of historical image patterns. The platform may automatically generate real-time interaction information based on monitoring interactions between user devices and cloud platforms. The platform may generate a potentially malicious image pattern based on the real-time interaction information. The platform may then input the image pattern into the pattern matching engine to generate an image pattern status for the image pattern. The platform may store the image pattern to a pattern storage repository. Based on identifying the image pattern as malicious, the platform may initiate a security action. The platform may update the pattern matching engine based on the image pattern and its image pattern status to detect future polymorphic botnet attacks.

The invention relates to the technical field of information security, in particular to an electronic information security attack detection method and device based on a graph neural network. According to the electronic information security attack detection method and device based on the graph neural network, data are collected from a target electronic information network system, and an initial network topological graph structure is generated; feature selection and optimization are carried out based on a gold washing optimization algorithm, an optimized network node feature matrix and an optimized network edge feature matrix are generated, and an improved graph neural network model is established; and dynamically updating a network topological graph structure, inputting the optimized improved graph neural network model, analyzing features of network nodes and network edges, detecting abnormal behaviors, classifying attack types, generating attack paths, triggering an early warning mechanism, and outputting an attack detection result. According to the electronic information security attack detection method and device based on the graph neural network, accurate and efficient detection of electronic information security attacks is realized, and important technical support is provided for defense of complex network attacks.

Methods to add an “Admission Control / Access Control” system to control access to a “Software-Defined-Deterministic Industrial Internet of Things” (SDD-IIoT) network are described. The SDD-IIoT comprises a “Software Defined Networking” (SDN) control-plane, and many “Software-Defined-Deterministic Wide Area Networks” (SDD-WANs). The SDN control-plane comprises 3 layers of “Zero Trust Architectures”, i.e., rule-based “Attribute-Based Access Control” (ABAC) systems, where subjects can request access to resources. A controller's “Knowledge-Base” consists of a set of facts and rules, which an inference-engine processes to make access decisions. Each SDD-WAN comprises a low-complexity deterministic forwarding-plane, with many simple deterministic packet switches (D-switches), realized with “Field Programmable Gate Arrays” (FPGAs). The forwarding-plane implements “Authenticated Encrypted Deterministic Channels” (AEDCs or D-flows) directly in hardware in layer-3, using Quantum Safe ciphers. Each D-flow has a deterministic data-rate requirement, with delay and jitter requirements. The D-switches can forward encrypted data, according to pre-defined periodic (repeating) deterministic schedules. For a packet to be accepted at the destination, it must be successfully decrypted at the destination in layer-3, using a Quantum Safe cipher. Malicious packets from cyber-attackers will fail the decryption process in layer-3, and thus be detected and removed. Each enterprise has an “Enterprise-Controller”, to control access to its private resources (i.e., computers, data-bases, etc), with an extensive knowledge base of rules. Each SDD-WAN has a “WAN-Controller”, to control the communications between enterprises over the SDD-WAN. If an Enterprise-Controller or WAN-Controller approves a request to establish a new D-flow, the SDN control-plane will download deterministic schedules and secret keys to the D-switches in the forwarding-plane. An IIoT-Controller will control the communications between different SDD-WANs. In an IIoT deployment, there may be 10s of WAN-Controllers, each with 100s of Enterprise-Controllers. These collaborative controllers work together, to control access to the bandwidth of the SDD-IIoT. They can achieve exceptionally-strong cyber-security, where the expected number of successful cyber-attacks per year from external cyber-attackers with Quantum Computers, can be reduced to zero. The SDD-IIoT can achieve security comparable to that offered by “Quantum Key Distribution” (QKD) networks in practice, determined by the computational hardness of cracking Quantum Safe ciphers. The SDD-IIoT can save the industry 10s . . . $100s of billions (US dollars) per year, by exploiting low-cost FPGAs, providing a powerful incentive to innovate layer-3 of the Internet.

An apparatus comprises a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network. The cyber security restoration engine is configured to receive an indication that the asset in the computing network is involved in a cyber security scenario. The cyber security restoration engine is further configured to identify, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario.

The invention relates to the technical field of data security detection, in particular to a data security detection method for signal transmission software. And obtaining residual time sequence data after decomposition of the plurality of signal-to-noise ratio time sequence data. Because the electromagnetic interference can cause the residual points to present trend characteristics, the value distribution and change trend of the residual points are analyzed, and outliers and trend characteristic values are obtained. The distribution of the outliers subjected to electromagnetic interference is random, so that a local distribution characteristic value is obtained based on the position distribution condition of the outliers. And combining the two indexes to obtain an electromagnetic attribute characteristic value. Furthermore, as the abnormity generated by the network attack is more correlated, the correlation condition of the outliers in the residual time sequence data of the plurality of channels is analyzed and combined with the electromagnetic attribute characteristic value to obtain an electromagnetic interference degree value, and finally, the outliers generated by electromagnetic interference are removed according to the electromagnetic interference degree value to obtain network abnormal points. The detection precision of the network abnormal points is improved, and the safety detection effect is ensured.

An intelligent orchestration module can facilitate an AI augmented and adaptive interactive response loop between multiple AI-based engines. A cyber threat detection uses AI to detect a cyber threat. An autonomous response engine uses AI to mitigate the detected cyber threat. A cyber-security restoration engine uses AI to remediate nodes in the system to a trusted operational state. The prediction engine uses AI to conduct simulations of cyberattacks to assist in determining how a simulated cyberattack might occur in the system, and how to use the simulated cyberattack information to preempt possible escalations of an ongoing actual cyberattack. The multiple AI-based engines bilaterally exchange behavioral metrics between the AI-based engines to work together to provide an overall cyber threat response during the ongoing cyberattack in light of continuing attack activities and simulations of the cyberattack to predict what might occur in the nodes based on the mitigation actions taken and / or the restoration actions taken.

A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.

According to one embodiment, host infrastructure analysis logic that attempts to detect a malicious host operating within a network prior to a cyber-attack being conducted by the malicious host is described. The host infrastructure analysis logic includes querying logic, profile confirmation logic, classification logic and reporting logic. The querying logic retrieves salient characteristics associated with a plurality of hosts operating within the network and determines whether any hosts are suspicious. The profile confirmation logic, if a suspicious host is detected, establishes communications with that suspicious host to retrieve additional context information. The classification logic, based on the retrieved information, determines whether the suspicious host is malicious, prior to and without reliance on information associated with a cyber-attack being conducted by that host. The reporting logic outputs analytic results identifying at least the suspicious host is operating as a malicious host.

The invention relates to the technical field of digital image processing, in particular to a digital image mixed watermarking method based on time domain and frequency domain synchronization. According to the method, a time domain and frequency domain synchronous watermark embedding algorithm and a multi-stage watermark extraction algorithm are innovatively combined, so that the concealment and robustness of the watermark are remarkably improved, and the problems of digital image copyright protection in the face of printing and scanning attacks and network attacks are effectively solved; the method ensures the security and reliability of digital image copyright protection, provides a more advanced and effective technical means for digital image copyright protection, has the advantages that a time domain and frequency domain synchronous watermark embedding algorithm enables watermarks to be fused into image details and is high in concealment, the watermarks are effectively protected in the face of various attacks, and the security and reliability of digital image copyright protection are improved. The multi-stage watermark extraction algorithm ensures accurate extraction when the image quality is reduced, and the watermark performance is integrally improved.

The invention belongs to the technical field of new energy power system modeling and control, and discloses a photovoltaic inverter system parameter identification method based on an ARMAX model and a least square method, and the method comprises the steps: collecting the lag time sequence data of the control input and output current of a photovoltaic inverter, constructing an ARMAX model of a multi-lag structure, and carrying out the recognition of the parameters of the photovoltaic inverter system. Estimating model parameters by adopting a least square method; constructing an adversarial data set by injecting watermark disturbance signals with statistical characteristics, and realizing fine modeling and difference prediction of system output behaviors; a double-layer variance detection mechanism is constructed based on a watermark model, and effective recognition of network behaviors such as replay attacks and harmonic forgery is achieved. The method aims at achieving high-precision modeling of dynamic response characteristics of the photovoltaic inverter and real-time detection of network attacks, can be deployed on a new energy edge control node, achieves cooperative operation of model identification, system prediction and attack detection, and has good real-time performance, robustness and engineering application value.

Apparatuses, methods, and computer-readable storage media for implementing a cyber-attack security action. One method includes receiving, by a processor, a cyber profile associated with a digital environment, and receiving a security posture associated with the cyber profile. The method includes determining a plurality of security actions to be implemented in the digital environment based on the cyber profile and the security posture, wherein the security posture includes a single point of failure data. The method includes determining a priority security action of the plurality of security actions, implementing the priority security action in the digital environment, and generating a user interface data structure configured to display the implemented security action on a user interface.

The disclosure relates to 5G or 6G communication systems for supporting higher data transmission rates.A method of detecting cyber-attacks using network analytics in a user equipment (UE) is provided. The method includes receiving, by a network data analytics function (NWDAF), a request for sharing analytics information associated with the UE from a consumer network function (NF), requesting the analytics information associated with the UE and causing the cyber-attack to at least one 5th generation core (5GC) network entity, receiving the analytics information associated with the UE and causing the cyber-attack from the at least one 5GC network entity, comparing an expected behavior of the UE with an actual behavior based on the analytics information provided by the at least one 5GC network entity, deriving analytics associated with the cyber-attack based on the analytics information and the comparison, and sending the analytics associated with the UE to the consumer NF.

The invention relates to a digital twin honeypot generation and network attack containment method based on a voting system, and belongs to the technical field of network security. The attack introduction decision is automatically developed through the voting system, the authenticity, interactivity and dynamicity of the honeypot are enhanced through the digital twin technology, the attack luring capability of the honeypot system is enhanced, through the system, precise putting different from traditional honeypots is achieved, and the system is suitable for popularization and application. And the probability that hackers discover and attack the honeypot bait is greatly improved.

Various embodiments include systems and methods to implement a security platform providing application-level cyberattack detection using multiple stages of classifiers. The security platform may use requests received by a web service to determine training data to train one or more machine learning models. The training data may be determined by instrumenting an application, such as a web service, with a first stage classifier to determine security events indicative of cyberattacks. The security platform may train machine learning models using aggregations of security events over various periods of time. The machine learning models may serve as second stage classifiers for the security platform.

Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on a security service that operates on structurally deduplicated network data. The security service may operate within a cloud environment and perform the security analysis that includes compiling a ruleset to generate an executable, where the executable is run over the structurally deduplicated event data. If the executable identifies a rule match for a given portion of structurally deduplicated event data, then the security service platform may reconstruct the structurally deduplicated event data to access all portions of a network event associated with the structurally deduplicated event data that triggered the rule match. The security service platform may use the reconstructed event data to generate and provide an alert that indicates a detected cyberattack.

Cross-channel user authentication is provided, to increase resilience of a computerized system to cyber-attacks and to fraudulent transactions. In a demonstrative scenario, a user utilizes his web browser on his laptop computer to log-in to a web server; which in turn extracts the IP address of the laptop computer. The web server triggers an application server to send a Push Notification to a Mobile App that had been installed on a smartphone of that user who just logged in; and that Push Notification causes that smartphone to respond to the application server with the IP address of the smartphone. If the IP address of the computer is not identical to the IP address of the smartphone, then the servers determine that the log-in attempt on the computer was possibly fraudulent, and fraud mitigation operations are initiated. Optionally, geo-location data, device orientation data, device motion data, or other parameters are used as part of the cross-channel authentication process.

Disclosed embodiments pertain to cybersecurity assessment and remediation. A questionnaire comprising a set of questions can be generated and provided electronically to a device of a small business representative. In one instance, the questionnaire can be dynamically responsive to input to focus on questions relevant to a particular business. Responses to questions can be used to generate a score that captures cyberattack readiness and a recommendation to reduce cybersecurity risk. Further, tests can be executed on a technology stack of the business. Test results can then be employed as a basis to generate the score and recommendation.

The present invention discloses a network attack early warning and tracing method, system and device based on a knowledge graph of facts, obtains network attack records to build a knowledge graph layer; extracts event causal relationships from network attack records, forms attack links, and aggregates and generalizes events and causal relationships to build a graph layer of facts; maps generalized nodes in the attack link with knowledge graph layer entities to establish a network attack knowledge graph of facts; infers the attack means taken by the attacker, or predicts the attack means to be taken in the next step, thereby realizing the tracing and early warning of the attack behavior. The present invention combines the facts graph and knowledge graph technology, and through the construction of the facts graph layer and the knowledge graph layer, transforms the network attack link and the organizational information asset architecture into a reasoning graph that combines dynamic facts logic with static objective knowledge, and realizes the reasoning and prediction of the overall attack behavior based on a small amount of exposed attack traces, so as to support the rapid and effective response of network attacks.