416 results about "Cyber-attack" patented technology

Systems and methods for mathematical modeling of the hardware and software stack of commodity computer platforms are provided, enabling provable guarantees on memory, device, and program execution. This approach addresses the technical problem of reliance on system agents that rely on implicit trust in the operating environment, which can be exploited by sophisticated attackers using complex threats such as memory access exploits and code / data integrity exploits. The solution provides a proactive, mathematically-backed security solution that eliminates entire classes of cyberattacks by design, ensuring realizable guarantees on commodity computer platforms running hardware and software stack elements at the lowest operating level. This approach has significant advantages over current reactive cybersecurity methods, including reduced complexity and overhead, and increased confidence in the integrity of the system. The solution's main uses include providing mathematically-backed security and availability guarantees for critical infrastructure, financial institutions, and other organizations vulnerable to cyberattacks.

Embodiments of a cyberattack monitoring system are disclosed to identify successful attacks on a service based on benign activities of the attacker performed after the initial attack attempt. In embodiments, the system identifies the initial attack by matching client actions to known attack patterns. Clients observed with attempted attacks are remembered as suspected attackers. The system will then monitor subsequent actions of suspected attackers for signs that the initial attack attempt was successful. In embodiments, a successful attack is recognized when the system observes one or more subsequent benign actions by the suspected attacker. In embodiments, the presence of follow-on benign actions is used as a filter to filter out unsuccessful attacks and false positives detected by the system. The filtering enables the system to better focus system resources and human attention on a small set of client activities that are likely successful attacks.

The invention relates to the technical field of network security, in particular to a non-cooperative network attack tracing method based on multiple stages. The method comprises the following steps: providing security verification for network equipment and a terminal in a traceability process based on a collaborative authentication code, and ensuring credibility and integrity of the traceability process; converting the network attack into behavior feature data based on the feature extraction of the attack behavior; extracting event-level features, revealing a sequential relationship and a dependency relationship of attack behaviors, and identifying a potential attack mode; performing time alignment on the events by using causal analysis to form a standardized causal chain; performing multi-dimensional feature fusion in combination with a Transform network and an NLP pre-training model, and identifying an attack mode; an IP address database, a self-built organization library and a code author library are combined, and a multi-cascade CNN structure is adopted to carry out attack source positioning and attacker tracing. According to the invention, through multi-level feature analysis, accurate identification and traceability of complex network attacks are realized.

System and methods are disclosed for providing unforgeable telemetry on computer platforms. Mathematical modeling and theorem proving are utilized to guarantee the integrity of telemetry probe execution flow and trigger, thereby preventing circumvention and tampering of logged probe data. In contrast to current state-of-the-art solutions that rely implicitly on the operating environment, this approach provides a sound and complete assurance of telemetry output. The system enables organizations to map unforgeable telemetry probe data to industry and government cybersecurity regulatory controls, ensuring compliance therewith. This invention addresses the shortcomings of existing solutions, including their vulnerability to sophisticated attacks, operational complexity, and inability to provide unforgeable telemetry data, thereby providing a reliable and accurate monitoring output in the presence of cyberattacks on computer platforms.

The invention relates to the technical field of information security, in particular to an electronic information security attack detection method and device based on a graph neural network. According to the electronic information security attack detection method and device based on the graph neural network, data are collected from a target electronic information network system, and an initial network topological graph structure is generated; feature selection and optimization are carried out based on a gold washing optimization algorithm, an optimized network node feature matrix and an optimized network edge feature matrix are generated, and an improved graph neural network model is established; and dynamically updating a network topological graph structure, inputting the optimized improved graph neural network model, analyzing features of network nodes and network edges, detecting abnormal behaviors, classifying attack types, generating attack paths, triggering an early warning mechanism, and outputting an attack detection result. According to the electronic information security attack detection method and device based on the graph neural network, accurate and efficient detection of electronic information security attacks is realized, and important technical support is provided for defense of complex network attacks.

The invention relates to the technical field of data security detection, in particular to a data security detection method for signal transmission software. And obtaining residual time sequence data after decomposition of the plurality of signal-to-noise ratio time sequence data. Because the electromagnetic interference can cause the residual points to present trend characteristics, the value distribution and change trend of the residual points are analyzed, and outliers and trend characteristic values are obtained. The distribution of the outliers subjected to electromagnetic interference is random, so that a local distribution characteristic value is obtained based on the position distribution condition of the outliers. And combining the two indexes to obtain an electromagnetic attribute characteristic value. Furthermore, as the abnormity generated by the network attack is more correlated, the correlation condition of the outliers in the residual time sequence data of the plurality of channels is analyzed and combined with the electromagnetic attribute characteristic value to obtain an electromagnetic interference degree value, and finally, the outliers generated by electromagnetic interference are removed according to the electromagnetic interference degree value to obtain network abnormal points. The detection precision of the network abnormal points is improved, and the safety detection effect is ensured.

An intelligent orchestration module can facilitate an AI augmented and adaptive interactive response loop between multiple AI-based engines. A cyber threat detection uses AI to detect a cyber threat. An autonomous response engine uses AI to mitigate the detected cyber threat. A cyber-security restoration engine uses AI to remediate nodes in the system to a trusted operational state. The prediction engine uses AI to conduct simulations of cyberattacks to assist in determining how a simulated cyberattack might occur in the system, and how to use the simulated cyberattack information to preempt possible escalations of an ongoing actual cyberattack. The multiple AI-based engines bilaterally exchange behavioral metrics between the AI-based engines to work together to provide an overall cyber threat response during the ongoing cyberattack in light of continuing attack activities and simulations of the cyberattack to predict what might occur in the nodes based on the mitigation actions taken and / or the restoration actions taken.

According to one embodiment, host infrastructure analysis logic that attempts to detect a malicious host operating within a network prior to a cyber-attack being conducted by the malicious host is described. The host infrastructure analysis logic includes querying logic, profile confirmation logic, classification logic and reporting logic. The querying logic retrieves salient characteristics associated with a plurality of hosts operating within the network and determines whether any hosts are suspicious. The profile confirmation logic, if a suspicious host is detected, establishes communications with that suspicious host to retrieve additional context information. The classification logic, based on the retrieved information, determines whether the suspicious host is malicious, prior to and without reliance on information associated with a cyber-attack being conducted by that host. The reporting logic outputs analytic results identifying at least the suspicious host is operating as a malicious host.

The invention relates to the technical field of digital image processing, in particular to a digital image mixed watermarking method based on time domain and frequency domain synchronization. According to the method, a time domain and frequency domain synchronous watermark embedding algorithm and a multi-stage watermark extraction algorithm are innovatively combined, so that the concealment and robustness of the watermark are remarkably improved, and the problems of digital image copyright protection in the face of printing and scanning attacks and network attacks are effectively solved; the method ensures the security and reliability of digital image copyright protection, provides a more advanced and effective technical means for digital image copyright protection, has the advantages that a time domain and frequency domain synchronous watermark embedding algorithm enables watermarks to be fused into image details and is high in concealment, the watermarks are effectively protected in the face of various attacks, and the security and reliability of digital image copyright protection are improved. The multi-stage watermark extraction algorithm ensures accurate extraction when the image quality is reduced, and the watermark performance is integrally improved.

The invention belongs to the technical field of new energy power system modeling and control, and discloses a photovoltaic inverter system parameter identification method based on an ARMAX model and a least square method, and the method comprises the steps: collecting the lag time sequence data of the control input and output current of a photovoltaic inverter, constructing an ARMAX model of a multi-lag structure, and carrying out the recognition of the parameters of the photovoltaic inverter system. Estimating model parameters by adopting a least square method; constructing an adversarial data set by injecting watermark disturbance signals with statistical characteristics, and realizing fine modeling and difference prediction of system output behaviors; a double-layer variance detection mechanism is constructed based on a watermark model, and effective recognition of network behaviors such as replay attacks and harmonic forgery is achieved. The method aims at achieving high-precision modeling of dynamic response characteristics of the photovoltaic inverter and real-time detection of network attacks, can be deployed on a new energy edge control node, achieves cooperative operation of model identification, system prediction and attack detection, and has good real-time performance, robustness and engineering application value.

The invention relates to a digital twin honeypot generation and network attack containment method based on a voting system, and belongs to the technical field of network security. The attack introduction decision is automatically developed through the voting system, the authenticity, interactivity and dynamicity of the honeypot are enhanced through the digital twin technology, the attack luring capability of the honeypot system is enhanced, through the system, precise putting different from traditional honeypots is achieved, and the system is suitable for popularization and application. And the probability that hackers discover and attack the honeypot bait is greatly improved.

Various embodiments include systems and methods to implement a security platform providing application-level cyberattack detection using multiple stages of classifiers. The security platform may use requests received by a web service to determine training data to train one or more machine learning models. The training data may be determined by instrumenting an application, such as a web service, with a first stage classifier to determine security events indicative of cyberattacks. The security platform may train machine learning models using aggregations of security events over various periods of time. The machine learning models may serve as second stage classifiers for the security platform.

Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on a security service that operates on structurally deduplicated network data. The security service may operate within a cloud environment and perform the security analysis that includes compiling a ruleset to generate an executable, where the executable is run over the structurally deduplicated event data. If the executable identifies a rule match for a given portion of structurally deduplicated event data, then the security service platform may reconstruct the structurally deduplicated event data to access all portions of a network event associated with the structurally deduplicated event data that triggered the rule match. The security service platform may use the reconstructed event data to generate and provide an alert that indicates a detected cyberattack.

Disclosed embodiments pertain to cybersecurity assessment and remediation. A questionnaire comprising a set of questions can be generated and provided electronically to a device of a small business representative. In one instance, the questionnaire can be dynamically responsive to input to focus on questions relevant to a particular business. Responses to questions can be used to generate a score that captures cyberattack readiness and a recommendation to reduce cybersecurity risk. Further, tests can be executed on a technology stack of the business. Test results can then be employed as a basis to generate the score and recommendation.

A DI (device identification) chip, smartphone, communication device, system, method, or operating method is rendered capable of imposing punitive damages to cybercriminals and cyberterrorisms. Comprised are operating instructions for building a DI database, setting specified DI information required, formatting DI packet, and transmitting the DI packet for verification. The DI database may comprise a banned DI list and / or a DI-Member-Only list. The punitive measure in conjunction with the banned DI list will render a cybercriminal's communication device incapable of gaining access to the Internet, and its operating system invalid, once registered in the banned DI list. Accordingly, for the first time, no cybercriminal / cyberterrorism can proceed with any cybercrime at no cost. Equally unique is the DI-Member-Only list that will allow a central server to be accessible only to the communication devices with the DI information preregistered, thus precluding any potential cyberattack from unknown communication devices also for the first time.

The invention discloses a multi-robot cooperative positioning and elastic formation control method based on a distributed Kalman consistency filtering (DKCF) algorithm. Aiming at the problems of insufficient sensor noise suppression, poor robustness under network attack and the like in the prior art, a dynamic model containing process noise and a sensor model of measurement noise are constructed, and a consistency state estimation method of weighted fusion observation data is provided. According to the method, multi-modal redundant sensor information is fused, and an improved DKCF is combined, so that cooperative state estimation between robots is realized, and the positioning precision in a noise environment is effectively improved; an elastic positioning framework under denial of service attack is established, and the robustness to network attack is enhanced while the formation precision is ensured through the joint design of distributed cooperative position estimation and a formation controller. According to the method, high positioning precision and a stable formation form can still be kept in the face of network attacks of denial of service, and the safety cooperation performance of a multi-robot system in a complex scene is remarkably improved.

Disclosed herein is a method for generating a cyberattack sequence based on reinforcement learning. The method includes generating a cyberattack simulation environment, training a cyberattack agent model based on the cyberattack simulation environment, and generating an attack sequence using the trained cyberattack agent model.

A non-transitory computer readable medium stores instructions that, when executed by a processor, cause the processor to receive data associated with a plurality of simulated cyberattacks on a virtual operational technology (OT) network, wherein the virtual OT network comprises a virtualized representation of an OT network based on configuration data of the OT network, identify, based on the received data, one or more cybersecurity vulnerabilities of the OT network, identify one or more modifications to a set of cybersecurity rules implemented in the OT network to address the one or more cybersecurity vulnerabilities of the OT network, provide an indication of the one or more modifications to a computing device associated with the OT network for approval; and update, via a third-party network security service utilized by an operator of the OT network, the set of cybersecurity rules to implement the one or more identified modifications.

Various embodiments include systems and methods to implement a security platform providing cyberattack detection using multiple stages of classifiers. The security platform may use a first stage of classifiers to analyze multiple requests from a client device to a service. The first stage of classifiers may determine an initial indication of whether a request is indicative of a cyberattack and provide the initial indication to a second stage of classifiers. The second stage of classifiers may, based on initial indication of a cyberattack over a period of time, determine whether a cyberattack is underway.

The disclosed techniques automatically identify cyber-security attacks and predict attack next steps. Descriptions of previously observed cyber-attack campaigns are decomposed into attack campaign steps. Real-time security incident signals are generated by cybersecurity software. Attack campaigns are identified by mapping attack campaign steps to security incident signals. Custom-generated telemetry queries are executed to determine if a missing attack campaign step occurred. A machine learning model generates embeddings for attack campaign steps, security incident signals, and telemetry query responses. A security incident signal or a telemetry query response matches an attack campaign step when their embeddings are within a defined distance. A security alert may be raised when most or all of the attack campaign steps of a particular attack campaign are matched. Attack campaign steps that are not matched to security incident signals or telemetry query results are predicted as attack next steps.

A computerized platform for implementing a positive reinforcement-based educational campaign to increase awareness of indications of signs of unsafe e-mails is configured to perform a method utilizing an assignment-based approach to provide an assignment to a user in which the user is presented with a simulated e-mail including one or more indicators the user is instructed to determine as being more likely associated with a social engineering-containing e-mail or a safe e-mail. This method of phish testing simulations eliminates the possibility of false positive metrics tied to a company's cyber resiliency and thus improves the overall accuracy of cyber program measures and reporting designed to prevent the most prevalent and successful cyber-attack methods in use today-social engineering delivered through phishing e-mails.

A security alert meta-analysis (SAMA) system is disclosed capable of identifying causally related evidence of a cyberattack in a computing environment. In embodiments, the system builds a security data graph from security alerts generated by other security monitoring services. The security data graph links related entities (e.g. users and resources) in the computing environment and the entities to their associated security alerts. Edges in the graph are filtered based on edge weights to identify sub-graphs that represent clusters of causally related evidence probative of attacks. The evidence clusters are presented to analysts to be investigated further. In embodiments, the meta-analysis process is implemented as periodic jobs executed on a cluster of worker nodes. Advantageously, the disclosed system is able to filter through large volumes of alerts to reduce false positives, and group related alerts, possibly from different monitoring services, so that they can be investigated together.

The invention relates to the technical field of network security attack defense, and discloses an automatic network attack classification trapping system based on ensemble learning, comprising a network attack trapping module used for constructing a network attack trapping subsystem; the monitoring module is used for monitoring the network attack trapping subsystem; the control module is used for transmitting the system call log acquired by the monitoring module from the network attack trapping subsystem to the automatic attack classification module and carrying out rollback and recovery on the network attack trapping subsystem damaged by an attacker; the automatic attack classification module is used for converting a system call log into a triple and abstraction, then extracting text word frequency features and performing data enhancement in a numerical dimension; and performing feature selection on the enhanced data, selecting corresponding feature subsets by adopting different classifiers to train sub-classifiers, training element classifiers by utilizing prediction results of the sub-classifiers, and generating classification results by utilizing the element classifiers. The method can significantly improve the classification accuracy.

The invention provides an oil and gas pipe network sensor fault intelligent identification method and device and storage equipment, and the method comprises the steps: determining a safety production process data threshold interval of a target oil and gas medium based on the physical parameters of the target oil and gas medium, and obtaining the operation parameters, and determining a sudden change time point when the operation parameters are within a safety production process data threshold interval, determining an abnormal type of the sensor based on the sudden change time point, and distinguishing physical faults (such as natural aging and power depletion) of the sensor and network attacks suffered by the sensor. According to the method, whether the network attack occurs or not can be judged based on the abnormal disturbance time difference of the sensor output data after the control core analysis, the potential sensor anomaly type is identified, the method is suitable for numerous application scenes, the matching degree between the anomaly identification result and the application scenes is improved, and the user experience is improved. Therefore, the sensor network attack and the physical fault are distinguished.

The invention discloses a security guarantee-oriented encryption and decryption strategy-driven memristor neural network multi-index state estimation method. The method comprises the following steps of: 1, establishing a memristor neural network dynamic model with H infinity performance constraint and hybrid attack; 2, performing state estimation on the memristor neural network dynamic model under the driving of an encryption and decryption strategy; 3, calculating an error covariance matrix upper bound and an H infinity performance constraint condition of the memristor neural network; and 4, solving a value of an estimator gain matrix, and realizing memristor neural network state estimation with hybrid network attacks. The method solves the problem that the existing state estimation method cannot process the multi-index state estimation of the memristive neural network with H infinity performance constraint and variance constraint under the driving of encryption and decryption strategies at the same time, so that the estimation accuracy is low, and under the condition that information exists under the encryption and decryption strategies and information at other moments cannot be received, the estimation accuracy is low. And the accuracy of the estimation performance is low.

Methods, systems, apparatuses, and non-transitory computer-readable storage media for detecting cyber-attacks and incidents are disclosed. A method for detecting network incidents comprises: receiving outputs from a plurality of artificial intelligence (AI) models analyzing a plurality of network operation streams, wherein the plurality of AI models are respectively trained to detect suspicious events corresponding to a potential type of network incident in a respective network operation stream and to output an alert when a suspicious event is detected; determining, from the outputs of the plurality of AI models, a plurality of suspicious events that are associated with an entity; calculating a probability that two or more of the plurality of suspicious events associated with the entity occurred randomly; and outputting an alert based on the probability.

The invention discloses a micro-grid power distribution method and system based on virtual impedance control, and belongs to the technical field of power system control, and the method comprises the following steps: constructing a micro-grid system in which multiple inverters operate in parallel, and simulating the power distribution of a synchronous generator through droop control; establishing a communication topological structure for power information exchange among the inverter nodes; collecting reactive power output by each inverter, and obtaining a virtual impedance value through reactive power deviation among the inverters in the micro-grid system; a virtual impedance controller capable of detecting and resisting network attacks is introduced, and the controller identifies abnormal node signals in real time by performing threshold judgment on the reactive power difference value and performs signal reconstruction by using information of normal nodes to obtain a virtual impedance adjustment value; the virtual impedance value is adjusted in real time according to the reactive power difference value output by each inverter, reference voltage is generated to control the state of an inverter switch, and the reactive power of the system is reasonably distributed. According to the method, network attacks can be detected and resisted in real time, and the stability of the micro-grid system is improved.

Mechanisms are provided for identifying clean backups of a monitored computing system. A backup of a state of a computing system is generated. In response, these operations are performed: alert data associated with the monitored computing system is retrieved, where alert data is stored in response to patterns of data accesses indicating a possible cyber-attack on the computing system; a classification engine executes a classification operation on the alert data to determine if it indicates that the state of the monitored computing system was the target of a cyber-attack within a predetermined period of time prior to a time the backup was generated; if so, a first tag is generated for the backup indicating the backup to be corrupted; if not, a second tag for the backup is generated indicating the backup to be clean; and the first or second tag is stored in association with the backup.

A modular adversarial training data generator (“generator”) generates adversarial training data for a machine learning (ML) model to detect malicious protocol data units (PDUs). The adversarial training data mimics high volume cyberattacks by perturbing PDUs to bypass malicious detection systems. For HyperText Transfer Protocol (HTTP) PDUs, the generator rearranged, replaces, and grid searches values of HTTP header fields to generate the adversarial training data. The generator further biases grid search based on metrics for values of HTTP header fields that quantify impact of replacing the values on malicious verdicts by ML models trained on the adversarial training data.

Techniques for automated generation of behavioral signatures for malicious web campaigns are disclosed. In some embodiments, a system / process / computer program product for automated generation of behavioral signatures for malicious web campaigns includes crawling a plurality of web sites associated with a malware campaign; determining discriminating repeating attributes (e.g., behavior related attributes, which can be determined using dynamic analysis, and static related attributes, which can be determined using static analysis) as malware campaign related footprint patterns, wherein the discriminating repeating attributes are not associated with benign web sites; and automatically generating a human-interpretable malware campaign signature based on the malware campaign related footprint patterns.