57 results about "Cyber Space" patented technology

The invention belongs to the crossing field of network space security, software engineering and artificial intelligence, and discloses a dynamic and static cooperative vulnerability full-link intelligent analysis and verification method based on a large language model and an MCP protocol, and the method comprises the steps: S1, task initialization and context construction; s2, target code deep analysis and static taint preanalysis are carried out; s3, carrying out Fuzzing Harness directional generation and iterative optimization on the basis of the stain paths; s4, performing dynamic and static collaborative sandbox execution and dynamic stain tracking; and S5, vulnerability accessibility judgment and report output of multi-source data fusion are carried out. According to the method, a dynamic and static combination mechanism is adopted, vulnerability analysis and verification can be automatically completed for software target codes, and accurate technical support is provided for vulnerability risk grading and repairing priority ranking.

The application discloses an open set malicious traffic identification method and system based on multi-view retrieval enhancement, and belongs to the technical field of cyberspace security. In order to solve the technical problems that the existing malicious traffic identification is insufficient in generalization of unknown attacks, depends on task-specific training, and the retrieval evidence is unstable, the known category malicious traffic samples and the to-be-identified suspicious traffic are acquired, and traffic feature data is extracted. The traffic feature data of the known category malicious traffic samples is normalized and stored to obtain a multi-view traffic knowledge base. The structured identification prompt is generated based on the traffic feature data of the to-be-identified suspicious traffic. The multi-view retrieval is carried out in the multi-view traffic knowledge base, and the reliability pruning is carried out on the initial candidate evidence set. The trusted retrieval evidence set is filled into the structured identification prompt and input into the parameter frozen large language model. The open set malicious traffic identification result of the to-be-identified suspicious traffic can be obtained.

This application discloses a training method for a chip layout model, a chip layout method, and related apparatus. The method includes: calculating first to third instantaneous rewards in parallel based on the layout state data of the target layout region in the current training cycle; calculating the corresponding temporal difference target and temporal difference error using the first to third instantaneous rewards, and updating the parameters of the density evaluation network, space utilization evaluation network, and position compliance evaluation network in parallel; outputting first to third expected rewards using the parameter-updated density evaluation network, space utilization evaluation network, and position compliance evaluation network; calculating the advantage function based on the first to third expected rewards and the corresponding first to third instantaneous rewards; and updating the parameters of the policy network based on the advantage function. This application improves the learning efficiency, training stability, and final layout quality of reinforcement learning models in complex layout tasks.

This invention relates to the field of cyberspace security and threat intelligence analysis technology, and discloses a sparse anomaly behavior detection method and system based on privacy-preserving semantic evidence. First, irreversible semantic abstraction is performed on collected multi-source security data to extract semantic evidence elements related to anomalies, which are then semantically encoded to obtain semantic evidence units. Next, based on the semantic evidence elements and their semantic feature representations, a semantic evidence hypergraph containing intra-event and cross-event hyperedges is constructed. Finally, based on the semantic evidence hypergraph, feature aggregation is performed on semantic evidence nodes and their relationships, anomaly scores for each behavioral event or semantic evidence are calculated, and sparsity is determined by combining the frequency of behavior occurrence to identify anomalies. This invention can construct cross-event semantic behavior representations without exposing the original data and model multi-entity collaborative relationships based on the hypergraph structure, achieving effective detection of low-frequency, cross-stage recurring anomalies.

This invention provides a method for calculating the risk level of online individuals based on multi-source data fusion and dynamic perception, relating to the fields of cyberspace security and social governance. By integrating online and offline behavioral data, this invention extracts behavioral frequency, violation records, trajectory features, and emotional characteristics to construct a basic risk level. This risk level is then dynamically corrected by incorporating time decay, event sensitivity, emotional polarization, and platform amplification effects, outputting the risk level of online individuals. This achieves a quantitative assessment of individual online individual risk, providing decision support for public opinion command and online risk early warning.

This invention relates to the field of information technology, specifically disclosing a method and system for detecting weak passwords in containerized application services. The method includes: obtaining container nelink socket information in the kernel based on the container's NameSpaceID, and obtaining the container's network port information; enriching and associating container network port and process information; obtaining all processes of the container and matching them with the container based on the network information of the container's nelink socket information; and obtaining the network IP address of the container corresponding to the host machine. This invention uses kernel nelink sockets to construct container network and process information to accurately filter and identify weak password detection targets and detection methods, enabling real-time detection of dynamically changing weak password security issues during container process runtime, reducing false negatives and false positives.

The application discloses a network security vulnerability knowledge graph construction method based on HPO-BiLSTM-CRF, which comprises the following steps: collecting public vulnerability data from related databases in the network space security field, preprocessing, and constructing a data set; analyzing and extracting existing data source feature information, and constructing a network security vulnerability domain ontology model CSVDO; based on the optimized bidirectional long short-term memory network and the conditional random field fusion model HPO-BiLSTM-CRF, realizing named entity recognition and relationship extraction; adopting an integrated entity alignment method for knowledge fusion, matching different instances of the same object in different ontologies based on an improved similarity measurement algorithm, and constructing a knowledge graph; carrying out knowledge graph embedding, storing the result into a graph database, and completing knowledge graph construction and graphic visualization. The application can improve the efficiency of entity recognition and relationship extraction in network security vulnerability knowledge, and has the advantages of high efficiency and high accuracy compared with other graph construction methods.

The application discloses a digital quantum computing-based computing power network DDoS detection method and system, and relates to the technical field of network space safety management and control.The application comprises the following steps: collecting real-time network flow data in a jurisdictional area through a dispersed detection point, constructing a graph neural network DDoS detection algorithm based on quantum random walk sampling, and performing quantum random walk to obtain quantum probability distribution of each node; performing quantum probability weighted non-replacement sampling on neighbor nodes of each target node to obtain a sampled neighbor set; performing message passing on the sampled neighbor set through a graph sampling aggregation network; uploading local model parameters to a safety management center through a federated learning architecture, and outputting a DDoS attack detection result.The application realizes DDoS flow feature extraction based on a graph structure, and utilizes a neighbor sampling mechanism guided by quantum random walk to complete real-time identification and detection of DDoS attacks.

The application discloses a social network key node identification method based on double population interaction, which comprises the following steps: 1, double population construction, based on the original network space and the reduced search space, the main population and the auxiliary population are generated respectively to complete initialization; 2, double population evolution, the main population and the auxiliary population obtained in step 1 are respectively subjected to genetic operation, offspring is generated through crossover and mutation, and a new population is formed according to the corresponding population updating method; 3, double population interaction, when the double population evolution reaches a certain iteration number and meets the interaction condition, the influence strategy and the expansion strategy are alternately executed to realize the information interaction of the main population and the auxiliary population; 4, individual selection, the individuals in the main population and the auxiliary population are sorted based on the target function value, and the optimal individual is selected as the key node combination output. The application can quickly and effectively identify the key node combination in a large-scale social network, and provide a high-quality selection scheme for decision makers within a reasonable time.

This invention discloses a visual-language navigation method with cross-modal alignment in dynamic occlusion environments. The method utilizes visual sensors, inertial measurement units, and LiDAR to collect multimodal data, and performs preprocessing and time synchronization. It perceives dynamic occlusions using a model composed of convolutional neural networks and long short-term memory networks, and predicts their future changes using a spatiotemporal sequence prediction algorithm. It extracts and fuses visual and semantic features using a dual-branch convolutional neural network and a Transformer based on a dynamic attention mechanism. Based on occlusion prediction, it extracts potential occlusion region features in advance from the temporal dimension, and repairs occluded images in the spatial dimension using generative adversarial networks and geometric constraints. It optimizes cross-modal feature alignment through an attention mechanism. Finally, it plans the path using a hybrid reinforcement learning algorithm based on deep Q-networks, spatial and fast exploratory random trees, and dynamically adjusts the path according to real-time occlusion. This invention improves the accuracy, adaptability, and reliability of visual-language navigation in dynamic occlusion environments.

The present application belongs to the field of information security, and relates to a multi-agent network security operation method and device, electronic equipment and a storage medium, the method comprising: constructing a layered architecture from physical hardware to upper application; receiving a network security global task, and decomposing the network security global task into a task subset in a coarse-grained layer; assigning atomic tasks to suitable agents to form a task alliance and formulate a collaborative strategy; adapting to interference-free information interaction between agents by improving an operating system process credible interference-free information flow control method; performing real-time intention synchronization and collaborative adjustment between agents; collecting feedback information in the task execution process, evaluating the task completion condition, and optimizing the multi-granularity collaborative decision-making process. The present application meets the needs of intelligent network space security protection system; and can be applied to the security operation system platform scene of multi-agent collaboration, multi-robot collaboration, multi-agent software system, multi-digital person collaboration and the like.

This invention relates to an automated penetration testing method based on reinforcement learning, belonging to the field of cyberspace security in computer and information science and technology. First, this invention utilizes environment-related parameters to construct the state space, action space, and reward function of the reinforcement learning model to generate training data. Second, it applies the training data and vulnerability exploitation components to train and generate a reinforcement learning model. Finally, based on a vulnerability exploitation component library, the reinforcement learning model recommends optimal vulnerability exploitation information, thereby automating the entire penetration testing process. This invention addresses the problems of manual reliance in penetration testing and the rigid application of vulnerability exploitation components by employing artificial intelligence technology to effectively improve the accuracy of vulnerability exploitation component recommendations, significantly enhancing the efficiency of penetration testing.

This invention discloses a state protocol fuzzing method and process based on a hierarchical large language model framework, belonging to the field of cyberspace security technology. Addressing the problems of skill dilution, context obfuscation, and high computational cost inherent in existing single large language model-driven fuzzing methods, this invention constructs a syntax analysis layer, a semantic reasoning layer, and a policy optimization layer. Specifically, the syntax analysis layer extracts a structured syntax tree from the raw message using protocol templates and an LLM (Local Language Model); the semantic reasoning layer combines protocol state with the syntax tree to infer business logic constraints, identify vulnerability patterns, and dynamically assess risks; and the policy optimization layer intelligently generates and adaptively adjusts mutation strategies based on risk scores and historical feedback. This invention effectively improves the coverage depth of the protocol state space and the efficiency of vulnerability discovery, while reducing computational costs, providing an efficient, intelligent, and economical solution for the security testing of complex network protocols.

The application discloses a malware robust identification method based on contrast learning, and discloses an end-to-end robust identification technology of malware organizations (or families). The implementation process of the technology comprises a training stage and a testing stage. In the training stage, a convolutional neural network model MConv is used to perform contrast learning-based adversarial training on MConv in combination with three modules (an adversarial training module, a contrast learning module and a KL divergence module). In the testing stage, MConv and a full connection layer are used to perform sample identification. The application fully considers the possibility of malware escape organization identification, is more in line with the actual demand of cyberspace and has more practical application significance, and the method can achieve good identification and resistance to adversarial attack effect in various evaluation indexes.

The application discloses a network space mapping method based on weak supervision learning, comprising the following steps: S1, establishing a public network space mapping IP address library, and identifying known IP information; using self-owned basic resource data to collect information of IP with relatively clear unit attribution; S2, identifying IP address association information of non-known IP address. In the application, through self-developed asset identification algorithm, weak supervision learning algorithm is used to extract website features, high-precision asset labels are made, and internet assets are spatially mapped. The main contents of mapping include IP street-level geographic location, industry classification, IP port service information, certificate information, website feature information, etc. In a manner of combining spatial mapping map and vector topographic map, data is presented. The network space mapping map is the infrastructure for realizing digital production and life and digital governance in the digital era, and is of great significance for providing network security event monitoring and analysis, emergency response and attack tracing.

The application belongs to the technical field of cloud computing and network space security simulation, and particularly relates to a traffic-aware resource scheduling method for large-scale network ranges, which comprises the following steps: constructing a hybrid virtualization system for large-scale network ranges; analyzing a network range description file uploaded by a user to generate an undirected attribute graph, and obtaining a predicted traffic correlation matrix L through graph convolution network inference; collecting resource load data of physical computing nodes and constructing a physical distance matrix, and combining the predicted traffic correlation matrix L to construct a multi-objective fitness function; based on the multi-objective fitness function, generating a global optimal resource mapping matrix through a genetic-whale hybrid evolutionary scheduling algorithm; generating a scheduling instruction according to the global optimal resource mapping matrix, and realizing collaborative instantiation scheduling of virtual machines and containers on specified physical computing nodes through a cloud platform interface; and the application effectively avoids the defects of traditional methods, such as complicated configuration and easy to fall into local extreme value.

The application belongs to the cross field of network space security, software engineering and artificial intelligence, and discloses a kind of dynamic and static cooperative type vulnerability full-link intelligent analysis and verification method based on large language model and MCP protocol, comprising: S1: task initialization and context construction;S2: target code depth analysis and static stain pre-analysis;S3: Fuzzing Harness directional generation and iterative optimization based on stain path;S4: dynamic and static cooperative sandbox execution and dynamic stain tracking;S5: vulnerability accessibility determination and report output of multi-source data fusion.The application method adopts dynamic and static combination mechanism, and can automatically complete vulnerability analysis and verification for software target code, providing accurate technical support for vulnerability risk grading and repair priority sorting.

The application provides a social robot-detecter confrontation simulation method and device, which can be applied to the technical field of network space security. The social robot-detecter confrontation simulation method comprises the following steps: modeling the confrontation process between a social robot and a social robot detector in a virtual social environment as a Markov decision process, and utilizing multiple types of intelligent agents to cooperatively control the interaction between the social robot and the virtual social environment in the Markov decision process; utilizing a trained user caution degree prediction model to predict the reply probability of the social robot in multiple types of interactive scenes; based on the editable attribute features of the social robot, utilizing a trained personal profile editor and a target preselection mechanism to optimize and improve the social robot in the Markov decision process; utilizing a social cluster reward function to overall optimize the interactive state of a social robot cluster composed of multiple social robots in the Markov decision process.

The application discloses a kind of based on multi-attribute ordering's federal learning participant trust evaluation method, equipment and storage medium, belong to cyberspace security field;Its method includes: aggregation server issues federal learning task, and defines initial global model distribution to each participant;Participant trains local model based on local data, and sends to aggregation server;Aggregation server collects the behavior information interacted with participant, and the recommended trust information of recommendation server, and the behavior information and recommended trust information are used as trust evidence, according to trust evidence, the trust attribute comprehensive value of participant is calculated, and after updating trust information based on trust attribute comprehensive value, the local model uploaded by the participant ranking in front is selected to participate in model aggregation, after aggregation, the aggregated model is sent to all participants;Equipment and storage medium are used to realize the method;The application improves federal learning performance and model precision, and has important application value in federal learning field.

The application relates to the technical field of network space security, and discloses an APT attack organization attribution method and system based on a topic-enhanced heterogeneous hypergraph. First, multi-source network threat intelligence texts are obtained, attack behavior elements are extracted from the network threat intelligence texts, and initial semantic feature representations of the attack behavior elements are generated; the attack behavior elements are taken as behavior element nodes, event-intra hyperedges and topic-level cross-event hyperedges are constructed, unified modeling is carried out, a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges is formed, feature aggregation processing is carried out, and a hypergraph structure feature reflecting attack behavior collaborative relationships is obtained; organization-level feature representations used for representing overall behavior patterns of attack organizations are generated; attribution determination is carried out on APT attack organizations to which attack behaviors belong; and attack organization attribution results are output. The application solves the problems of the unified APT attribution method, such as insufficient description of multi-entity collaborative relationships, weak cross-event semantic correlation and the like.

The application relates to the technical field of network space security, in particular to a kernel memory vulnerability mining method and device based on a state diagram and computer equipment, the method comprises the following steps: obtaining a kernel source code file to be analyzed; analyzing the kernel source code file to be analyzed, and generating a state diagram represented by memory management variables and function summaries; for the state diagram, a constructed kernel vulnerability mining tool is used to identify potential memory error states and generate corresponding system call sequences; the system call sequences are input into a kernel fuzz testing tool, and corresponding test results and test effects are output. The application can accurately identify kernel memory state changes and locate abnormal states, and improve vulnerability mining efficiency.

This invention discloses a method and related equipment for identifying key fields in industrial control protocols, belonging to the field of cyberspace security technology. The method includes: if a delimiter exists in the message, identifying key fields in the protocol using the features of the delimiter; if no delimiter exists in the message, performing type-length-value decoding on the protocol; if decoding is successful, identifying key fields in the protocol using type-length-value decoding; if decoding fails, when there is only one length field in the protocol, identifying the length field based on the correlation between the message length difference and the field value difference, and identifying the structure identifier field based on the consistency of the field value in similar messages; when there are multiple length fields in the protocol, identifying the structure identifier field based on the protocol spectrum and convolutional neural network, and identifying the length field based on multidimensional hypothesis testing. This method can effectively identify structure identifier fields and length fields in industrial control protocols.

This invention relates to the field of network security technology and discloses a method for dynamic mapping of cyberspace based on a large model. The method includes: Step 1, using a BERT model as the core feature extractor to capture deep semantic features of asset banner information and identify asset changes; Step 2, classifying asset types to mark the asset change process; Step 3, extracting newly added assets and using an unsupervised anomaly detection algorithm to identify newly added assets significantly different from normal patterns. Using this invention, the accuracy and efficiency of identifying dynamic changes in asset addresses can be improved, newly added assets can be accurately discovered, the situation of newly added assets in cyberspace can be clearly depicted, and the discovery process of new devices can be accelerated.

The application discloses a malicious code semantic perception static detection method and system and a storage medium, and belongs to the technical field of cyberspace security. In view of the problems of poor anti-confusion ability of existing regular matching technology and high false alarm rate caused by the inability to distinguish RCE attacks from DoS abnormalities, the application proposes a solution based on an abstract stack machine and a taint analysis. The method first extracts a serialized operation code sequence, simulates stack behavior by using an abstract stack machine and a sentinel mechanism to restore instruction structure; secondly, in combination with a semantic environment knowledge base, a reflective call is deeply deduced, and obfuscated code is restored to real semantics; finally, based on a four-state taint analysis model, a judgment strategy of triggering an alarm only when a high-risk function is called and the parameters contain taint data is implemented. The application can effectively resist Fickling and other advanced obfuscation attacks, accurately filter non-malicious program noise, and significantly improve the accuracy and anti-interference ability of model security detection.

This invention discloses a method and system for monitoring encrypted protocols, belonging to the field of cyberspace security technology. The method includes: parsing encrypted session data and simultaneously extracting protocol semantic feature vectors and randomness original data sequences; determining variational mode decomposition parameters through fast Fourier transform, adaptively decomposing the random sequence to obtain multiple intrinsic mode function components, and calculating the permutation entropy of each component to construct a multi-scale entropy spectrum; fusing the protocol semantic feature vector and the entropy spectrum and inputting them into a pre-trained correlation model to output a multi-dimensional risk feature vector; matching a dynamic evaluation strategy according to the protocol type, calculating a comprehensive risk score by combining a risk threshold vector and a weight vector, and outputting a graded compliance conclusion and key risk description based on the score. This invention achieves deep correlation analysis of the randomness and semantics of encrypted protocols from multiple scales and dimensions, overcoming the limitations of traditional methods' single-scale detection and static judgment.

This invention discloses a method for estimating threat events in a metaverse network, primarily addressing the problems of existing threat detection methods failing to fully reflect the dynamics of the system, lacking the ability to detect real-time network attacks, and lacking the capability to reconstruct attack scenarios. The implementation scheme involves: monitoring changes in virtual resource parameters within the metaverse virtual environment and issuing warnings about the current virtual boundary status of the user; constructing a source map using system log data collected from the user's device and network space anchor entity information; compressing the source map to obtain a compressed source map, which is then visualized in the Neo4j database; setting attack stage labels for entity matching in the compressed source map, and performing forward and reverse searches on the compressed source map to extract the attack map of metaverse security boundary attacks. This invention can detect attacks in the metaverse network in real time, has a wider range of applications, enhances the ability to proactively respond to metaverse network threats, and can be used for network security.

The application discloses a source code vulnerability detection method based on a graph neural network and multi-level attention fusion, and belongs to the technical field of intelligent software engineering and network space security. First, the source code is preprocessed and parsed to generate a code graph; a pre-trained model is used to extract graph structure features and graph node features; then, a graph neural network model is constructed, the graph node features are input into a multi-layer graph convolution network, and a self-attention mechanism is used to dynamically assign weights to each layer feature, and a global semantic feature matrix is generated through an average pooling layer; then, the original graph node features and the global semantic feature matrix are locally cross-fused, and a soft / hard attention fusion mechanism is used to extract local features; the fused features are input into a max pooling layer to generate local significant features; finally, a classifier is used to output a vulnerability detection result. The application uses global semantics to guide the extraction of local microscopic features, effectively improving the model's ability to capture and detect high-concealment code vulnerabilities.

This invention belongs to the field of artificial intelligence technology and discloses a method for optimizing deep learning network models based on neural network architecture search. The method includes the following steps: Step 1: Constructing a network search space, which is divided into a global search space and a local search space; Step 2: Continuously relaxing the discrete network search space; Step 3: Designing a network decoupling search strategy; Step 4: Training the model on the optimal network architecture obtained in Step 3; Step 5: Testing the trained model and outputting prediction results. This invention uses an automatic neural network architecture search method, employing a continuously relaxed optimization search strategy within the constructed deep learning network space, to find a network architecture suitable for a specific task, reducing network redundancy and improving model performance while simultaneously increasing computational efficiency.