510 results about "Cyber threat" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

The disclosed embodiments provide systems and methods for automated mapping of raw data into a data fabric. An innovative approach leveraging Artificial Intelligence (AI)-powered tools and a data fabric to automate the ingestion, transformation, and integration of raw data into a unified model is introduced. By automating the data mapping process, organizations can reduce reliance on manual methods and accelerate their ability to utilize robust insights for exposure management and attack surface reduction. The disclosed solution provides a scalable architecture for unifying cybersecurity signals across cloud and hybrid environments, enabling real-time decision-making and improved organizational resilience against cyber threats

The invention discloses a high-accuracy threat intelligence assisted network threat tracing method, which comprises the following steps: S1, collecting and preprocessing multi-source network security data, and constructing a time-marked event sequence set; s2, constructing an optimized Transform network model, and processing an attack event sequence by using position coding and time embedding; s3, a black swan optimization algorithm is initialized, and a Transform structure hyper-parameter is dynamically optimized; s4, outputting an attack event semantic vector, and constructing an attack path semantic map; s5, the intelligence information vector is embedded into a Transform hidden space; s6, calculating semantic similarity and dependency intensity, and generating an attack source candidate set and a traceability path; s7, outputting an attack traceability path, a starting point node and an information label, and generating a structured traceability report; and S8, according to the traceability result feedback, updating the black swan algorithm and the Transform model. The method is used for realizing intelligent modeling of multi-source network attack events and high-accuracy traceability analysis of attack source nodes.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

The invention relates to the technical field of network security, in particular to a network security risk assessment method and device based on artificial intelligence and a medium, and the method comprises the following steps: S1, collecting network flow data, user behavior data and device state data, and generating a standardized data set; s2, extracting features related to network threats, and constructing a risk data set with labels; s3, dividing the risk data set with the label into a training set and a verification set, and training the risk assessment model by using a support vector machine algorithm; s4, outputting a risk score and a threat level, and identifying a high-risk event; and S5, performing backtracking analysis on the high-risk events identified in the step S4, and forming a risk assessment report. According to the invention, through multi-source data processing, intelligent feature extraction and support vector machine model training technologies, accurate identification and real-time evaluation of network threats and deep traceability analysis of high-risk events are realized, and the initiative of network security protection is improved.

A cyber security system that protects against cyber threats including a synthetic clone of a voice of a speaker can include several components. A deep learning model is trained to analyze an audio file and produce one or more embeddings of the audio file. One or more AI classifiers are trained to analyze the one or more embeddings of the audio file from the deep learning model to determine whether it is likely that the voice of the speaker engaging with a user is real or the synthetic clone of the voice of the speaker. The voice clone detection bot can be resident on a computing device of the user and can integrate with different sources of audio data on the computing device of the user in order to collect the audio file containing an attempt to synthetically clone the voice of the speaker protected by the cyber security system.

The invention relates to the technical field of traffic data processing, and discloses a traffic edge computing data security sharing method and system, and the method comprises the steps: collecting traffic edge computing network multi-source heterogeneous data, and carrying out the classification standardization processing to generate a structured data set; designing a dynamic data sharing security protocol based on a multi-party security computing protocol and a homomorphic encryption algorithm; verifying the authority of a requester in a multi-level manner by using an attribute-based access control model and a zero-knowledge proof mechanism, and generating a dynamic access token; storing data by adopting a fragmentation storage and redundancy encryption strategy, and recording storage information through a hash chain; and dynamically adjusting the encryption strength and the sharing strategy according to the network threat level and the data sensitivity. The method effectively guarantees safe sharing of traffic data, accurately controls access authority, improves storage and sharing efficiency, adapts to complex network environment changes, and provides powerful support for development of an intelligent traffic system.

Aspects of the subject disclosure may include, for example, obtaining a group of threat research reports, obtaining a group of indicators of compromise (IOCs), and monitoring a network of Internet of Things (IoT) devices. Further embodiments can include determining a group of possible malware on the network based on the monitoring of the network, and generating a network security recommendation based on the group of threat research reports based on the group of threat research reports, the group of IOCs, and the group of possible malware. Other embodiments are disclosed.

The invention relates to the technical field of edge device security policy deployment, in particular to an edge device-oriented lightweight AI security policy adaptive deployment method. The method comprises the following steps: collecting operation state information of edge equipment, and constructing a current multi-dimensional environment vector and a sliding window feature vector; constructing a strategy candidate library, constructing a strategy adaptability scoring function based on the current multi-dimensional environment vector and a real-time perceived network threat event, and scoring and sorting all candidate strategy items to obtain a strategy execution candidate set; and performing scheduling optimization on the strategy execution candidate set by adopting a multi-objective optimization algorithm, and selecting a strategy combination with the highest deployment score as a deployment result. According to the method, a multi-dimensional strategy adaptability scoring function is constructed, candidate strategy items are screened according to current network threat events and system resource conditions, a strategy screening mechanism from fixed template type configuration to resource awareness and attack scene linkage is converted, and the pertinence and accuracy of strategy deployment are improved.

The invention discloses a network threat detection method, device and equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: executing a preset data collection operation to capture initial multi-dimensional data, and carrying out the preset data processing operation on the initial multi-dimensional data to obtain processed multi-dimensional data; executing a preset entity extraction operation on the processed multi-dimensional data to obtain a target entity, storing the target entity in a preset database, and inputting the target entity into a preset long-short-term memory network model to obtain attack time sequence characteristics; inputting the attack time sequence features into a target graph neural network model to construct a target knowledge graph, and determining a cross-device abnormal behavior chain based on the target knowledge graph; and determining an attack chain integrity coefficient according to the cross-device abnormal behavior chain, and determining a network threat event and a target risk level by using the CVSS vulnerability score, the space-time correction factor and the attack chain integrity coefficient to complete network threat detection. The problems of incomplete single-dimensional data coverage, high false alarm rate and the like can be solved.

A system (100) for securing cloud-based large language models through cyber threat defense and compliance monitoring, comprising: (a) an access control and authentication module configured to authenticate users and applications using role-based access control (RBAC) and multi-factor authentication (MFA); (b) a data protection and encryption module configured to encrypt data in transit and at rest and to anonymize sensitive input / output data using cryptographic techniques; (c) a threat detection and behavior monitoring module employing machine learning algorithms to identify anomalies and detect potential cyber threats in real time;(d) a regulatory compliance monitoring module configured to continuously assess system operations against applicable regulatory frameworks and generate alerts in the event of deviations from the regulations; (e) an incident response and mitigation module configured to automatically execute predefined response actions upon detection of threats or regulatory violations; (f) a logging, auditing, and forensic analysis module configured to securely log system activities, interactions, and threat events with cryptographic integrity protection; and (g) a governance and policy management module configured to define, update, and enforce organizational AI usage and compliance policies via the cloud-based LLM infrastructure.

The invention discloses a computer network security threat real-time monitoring method and system, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-source network data, organizing the multi-source network data into a behavior sequence according to a time sequence, and forming time sequence behavior data for analysis; constructing an attack atlas based on the preprocessed multi-source network data, and in the atlas construction process, forming dynamic representation of the attack atlas in combination with time attributes of behavior events and inter-entity contexts; time sequence behavior data are input into an RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, the LSTM captures time features, key behavior features are concerned by using an adaptive attention mechanism, and a high-dimensional behavior embedding vector is generated. High-precision and real-time detection and response to network threats are realized, and the intelligence and actual combat adaptability of the system are greatly improved.

The invention discloses a network intrusion prevention method, apparatus and device, and a storage medium. The method comprises the steps of extracting feature information representing network behaviors from collected network flow data; inputting the feature information into a reinforcement learning model, and performing reinforcement learning on the feature information through the reinforcement learning model to obtain an intrusion prevention strategy; and acquiring environment feedback corresponding to execution of the intrusion prevention strategy, and adjusting the reinforcement learning model according to the environment feedback. Through the reinforcement learning model, automatic learning is carried out from a large amount of network flow data and adjustment is carried out to cope with continuously changing network threats, so that the accuracy and efficiency of network intrusion prevention are improved, and through automatic optimization of the model, the requirement of manual intervention is reduced, and the operation cost is reduced.

Techniques are described herein for providing artificial intelligence mediated curation of access and content within a cyber threat intelligence platform. An example system includes: one or more memories, and one or more processors. The example system may receive, from a node, an input indicating a cyber threat type; identify, by a trained AI model, cyber threat intelligence content objects, each of the objects being (a) contributed by one or more nodes having access to the distributed ledger or (b) generated by the trained AI model; evaluate, by the trained AI model, each object to: determine relevance values corresponding to each of object, and generate (i) a curated set of cyber threat intelligence content objects based on the relevance values and (ii) a recommended cyber threat practice; and transmit the recommended cyber threat practice and an indication of the curated set of cyber threat intelligence content objects to the node.

The invention provides a network security policy automatic execution method and system based on an artificial intelligence large model, and relates to the technical field of network security, and the method comprises the steps: firstly obtaining a network threat chain data set comprising a threat initiating node, an intermediate propagation node, a target attacked node and propagation path description; calling a pre-trained threat chain analysis large model to carry out hierarchical disassembly and variation trend prediction, outputting a threat chain disassembly map, then extracting a matching strategy gene segment from a preset security strategy gene pool, generating candidate security strategies through model gene recombination and cross-strategy collaborative adaptation, and carrying out threat chain analysis on the candidate security strategies; inputting the candidate strategies, the current network topology and the equipment resource load data into a strategy execution deduction system, outputting an executable security strategy set adaptive to the current network state, finally issuing the executable security strategy set to network security equipment, and collecting execution feedback data for updating the threat chain analysis large model. And automatic, efficient and accurate generation and execution of the network security policy are realized.

The invention provides a network security decision-making method and device based on a large language model. The method comprises the following steps: collecting network state data and converting the network state data into natural language description; determining a semantic feature vector corresponding to the natural language description, and retrieving target threat knowledge matched with the semantic feature vector in a knowledge base storing various basic network threat knowledge; generating an analysis prompt text in combination with the target threat knowledge and the natural language description, inputting the analysis prompt text into a large language model, sequentially executing network threat analysis steps indicated in a preset thinking chain according to the analysis prompt text, and determining a network anomaly attribution and a corresponding protection strategy; and issuing the protection strategy to each distributed execution unit deployed in the target network environment, and converting the protection strategy into an equipment configuration command and executing the equipment configuration command. A closed-loop intelligent defense process from information perception to semantic understanding to collaborative response can be realized, and the real-time performance, the accuracy and the expandability of a security decision are improved.

The invention provides a power system network space precision linkage defense control method and device, and belongs to the field of power system management. The method comprises the following steps: generating a network topology structure and a key asset distribution diagram based on real-time dynamic mapping of a power system network space by a space mapping technology, extracting operation state data and potential risk information of network nodes, integrating data sources of different levels of a power system, and performing association analysis by using a deep learning algorithm, so as to obtain a key asset distribution diagram; obtaining a network threat classification result and generating a dynamic defense strategy by integrating the network operation state; wherein the strategy comprises defense path selection, response node scheduling and risk isolation measures; and executing the generated dynamic defense strategy, evaluating the effectiveness of defense measures according to a feedback mechanism, collecting historical defense records, threat features and response effects, and updating a threat knowledge base and a defense rule base based on a data analysis technology. According to the invention, the accuracy and efficiency of network space defense can be improved.

The invention discloses an adaptive distributed network threat detection and response system and method, and the system comprises a data collection module which is used for capturing network traffic in real time and converting the network traffic into structured data; the data analysis module is used for performing parallel analysis on the structured data by adopting a plurality of anomaly detection algorithms; the algorithm fusion module is used for counting the abnormal judgment times of each algorithm on the same sample through a voting mechanism, and outputting a final classification result according to a preset threshold value; the method comprises the following working steps: concurrently capturing network traffic through distributed nodes, analyzing the network traffic into structured data, operating an isolated forest algorithm, a DBSCAN algorithm and a K-means algorithm in parallel, and outputting an anomaly judgment result; and fusing multi-algorithm results and generating final classification through a voting mechanism. The invention provides an efficient, intelligent and distributed network security protection system, which can effectively detect and respond to various network threats, and is particularly suitable for large-scale distributed environments and dynamic network security defense requirements.

The invention discloses a network threat knowledge automatic extraction method, electronic equipment and a storage medium, and the method comprises the following steps executed by a computer hardware system: collecting threat intelligence data related to an APT organization from a multi-source network security text, and processing the threat intelligence data to generate a standardized corpus; using the pre-training sentence vector model to generate semantic embedding for a corpus input text and a manual annotation example library text, and retrieving similar examples to construct an ICL prompt template; inputting a large language model subjected to LoRA fine tuning, and extracting structured triples of multiple types of entities and semantic relationships; generating standardized entity nodes and updated relation information by adopting semantic aggregation; and constructing an APT organization network threat intelligence knowledge graph and outputting a structured file. The method provides key technical support for APT attack tracing, threat situation awareness and automatic security policy generation.

The invention relates to the technical field of network security protection, in particular to a power monitoring network security detection method and system. The method comprises the following steps: performing comprehensive monitoring object identification on a power monitoring network to obtain a power monitoring object list; carrying out comprehensive monitoring resource demand analysis on the power monitoring network according to the power monitoring object list to obtain power network monitoring resource demand data; performing intelligent agent node deployment analysis on the power monitoring network according to the power monitoring object list and the power network monitoring resource demand data to obtain an agent node deployment topological graph; performing lightweight intelligent agent deployment on the power monitoring network according to the agent node deployment topological graph to obtain a power distributed security monitoring network; and performing monitoring strategy analysis on the power monitoring network based on the power distributed security monitoring network to obtain a power agent node monitoring rule set. According to the invention, comprehensive identification of network threats is realized, and the risk of false alarm and missing alarm is reduced.

Systems and processes are disclosed for enhancing cybersecurity and optimizing software repositories through integration of web crawling, web scraping, feature engineering, and advanced machine learning algorithms to detect phishing attempts, prevent account takeover fraud, and identify unused code in repositories. The system collects and refines data from various sources, including transaction logs, customer databases, device details, external data sources, and historical fraud data, to build comprehensive datasets. Feature engineering creates new, meaningful features from the refined data, which are used to train and evaluate machine learning models. The best-performing models are deployed in production to monitor incoming communications and transactions in real-time, flagging suspicious activities and optimizing codebases. This processing ensures timely detection and prevention of security threats while maintaining efficient software development processes. Robust protection is provided against evolving cyber threats and enhances software performance and security through continuous learning and adaptation.

The invention relates to the technical field of power system network security, in particular to a multi-level power network threat collaborative identification method and system, and the method comprises the steps: obtaining an attack behavior data set according to multi-source attack data collected by transformer substations of different voltage levels in a multi-level power network, generating an attack semantic feature set based on the attack behavior data set; analyzing the real-time threat intelligence data based on the attack semantic feature set, and extracting cross-site time sequence mode features; obtaining a coordination action event sequence according to the cross-site time sequence mode characteristics; analyzing a threat propagation path of the attack load among different substations according to the coordination action event sequence to obtain a cross-site threat association feature map; and obtaining a threat association identification result according to the cross-site threat association feature map. According to the method, the attack load characteristics of the multi-level power network and cross-site time sequence cooperative behavior analysis are fused, so that the cross-site cooperative attack behavior is efficiently identified, and the network security protection capability of the power system is improved.

The invention provides a method and a system for dynamically optimizing a security defense strategy based on an AI Agent, and aims to solve the problems that the traditional network security defense strategy is static and cannot adapt to a dynamic network environment and novel network threats, and the processing efficiency of massive security data is low and the response is not timely. The method comprises the following steps: firstly, realizing whole network node data acquisition through a distributed AI Agent, performing accurate identification in combination with a multi-dimensional threat perception and fusion detection mechanism, and establishing a threat parameter quantitative evaluation model; secondly, the AI Agent generates a dynamic defense strategy according to the analysis result of the intelligent threat detection and the real-time state of the network in combination with threat features and risk assessment; and finally, according to the dynamic defense response result, realizing attack path tracking, accurate vulnerability positioning, automatic repair execution and traceability information retention processing. According to the method, real-time sensing and quick response to network threats can be realized, and the hysteresis of a traditional static defense strategy is overcome.

The invention relates to a network threat report attack knowledge graph automatic construction method and system based on a large language model, a storage medium and a program product, and the method comprises the steps: carrying out the iterative processing of extracted entities and relationships through a clustering method based on the large language model, and generating an initial attack knowledge graph; according to the invention, aggregation processing is carried out on a plurality of technology example threat reports belonging to the same attack technology through an attack technology graph template generation mechanism, a standardized attack technology standardized template library is established, and automatic attack technology tagging of new threat reports is realized by adopting an attack technology alignment method based on Word2Vec and WordNet, so that the automatic attack technology tagging of the new threat reports is realized. And a complete attack technology knowledge graph is constructed, so that a security analyst can quickly understand an attack path and a key threat point, and the automation degree and the accuracy of threat intelligence analysis are remarkably improved.

The invention discloses a security access control method and system oriented to DNS (Domain Name Server) analysis, and relates to the technical field of network security, and the method comprises the steps: collecting DNS data, carrying out the preprocessing, and calculating the dynamic spectrum intensity based on the preprocessed DNS data; calculating the threat degree based on the dynamic spectrum intensity, constructing a long-short-term memory network model, predicting the future threat degree, and drawing a threat degree trend curve; and constructing a visual interface to display a threat degree trend curve, and storing, collecting and analyzing the generated DNS data. A dimension reduction feature matrix is generated through a multi-scale embedding technology and a nonlinear dimension reduction method, rapid detection and protection of potential network threats are achieved, the capability of preventing potential network attacks is improved, the threat degree is calculated in combination with nonlinear dynamic weighting, the sensitivity to complex attack behaviors is enhanced, the recognition precision of DNS traffic abnormal behaviors is improved, and the method is suitable for popularization and application. And the occurrence probability of security vulnerabilities is reduced.

An intelligent orchestration module can facilitate an AI augmented and adaptive interactive response loop between multiple AI-based engines. A cyber threat detection uses AI to detect a cyber threat. An autonomous response engine uses AI to mitigate the detected cyber threat. A cyber-security restoration engine uses AI to remediate nodes in the system to a trusted operational state. The prediction engine uses AI to conduct simulations of cyberattacks to assist in determining how a simulated cyberattack might occur in the system, and how to use the simulated cyberattack information to preempt possible escalations of an ongoing actual cyberattack. The multiple AI-based engines bilaterally exchange behavioral metrics between the AI-based engines to work together to provide an overall cyber threat response during the ongoing cyberattack in light of continuing attack activities and simulations of the cyberattack to predict what might occur in the nodes based on the mitigation actions taken and / or the restoration actions taken.

The invention discloses an industrial network threat state monitoring method and system, belongs to the technical field of industrial system security, solves the limitation of single flow detection through collaborative analysis of fused flow characteristics, equipment logs, threat intelligence and vulnerability scanning data, establishes a real-time association mechanism of log events and flow anomalies, and improves the safety of the system. Threat confirmation and response time is shortened from a traditional hour level to a minute level, and active strategy adjustment is realized based on linkage of a configuration baseline deviation degree and a vulnerability scanning result.

The invention belongs to the technical field of network security, and provides a network threat real-time detection and defense method and system based on artificial intelligence. The method comprises the steps of multi-modal data acquisition and preprocessing, dynamic graph feature engineering and knowledge graph collaborative fusion, dual-adaptive model training and optimization, streaming real-time detection and anomaly scoring, DRL-driven hierarchical defense response and automatic disposal, and feedback-driven model adaptive updating and block chain auditing. According to the method, a mixed model of OS-ELM + dual-adaptive ridge regression + federated learning is designed, the training speed is higher than that of CNN, and over-fitting / under-fitting is avoided by dynamically adjusting a regularization coefficient; the federal learning realizes data local training and parameter uploading, and solves the problem of privacy disclosure; knowledge distillation enables the model volume to be reduced, edge equipment deployment is adapted while the accuracy is maintained, and the generalization ability is obviously superior to that of a traditional static model.