694 results about "Cyber threat" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

The invention, which relates to the technical field of data security monitoring, discloses a network data risk assessment system for a computer, comprising a data monitoring platform. The data monitoring platform is in communication connection with a data acquisition module, a data preprocessing module, an anomaly detection module, a threat evaluation module, an automatic alarm module, a response strategy generation module and a report generation module, and all the modules are in electric signal connection. According to the network data risk assessment system for the computer, the functions of anomaly detection, threat assessment, response strategy generation and automatic alarm are integrated, rapid detection and response to network threats are achieved, abnormal mode recognition is conducted through the machine learning technology, potential security threats are found, the recognition accuracy of abnormal behaviors is improved, and in addition, the network data risk assessment system for the computer has the advantages of being high in practicability and easy to popularize. And preset protection measures are automatically triggered, so that quick response is realized when high-risk threats are detected, and the damage of security incidents to the system is reduced.

The disclosed embodiments provide systems and methods for automated mapping of raw data into a data fabric. An innovative approach leveraging Artificial Intelligence (AI)-powered tools and a data fabric to automate the ingestion, transformation, and integration of raw data into a unified model is introduced. By automating the data mapping process, organizations can reduce reliance on manual methods and accelerate their ability to utilize robust insights for exposure management and attack surface reduction. The disclosed solution provides a scalable architecture for unifying cybersecurity signals across cloud and hybrid environments, enabling real-time decision-making and improved organizational resilience against cyber threats

The invention discloses a high-accuracy threat intelligence assisted network threat tracing method, which comprises the following steps: S1, collecting and preprocessing multi-source network security data, and constructing a time-marked event sequence set; s2, constructing an optimized Transform network model, and processing an attack event sequence by using position coding and time embedding; s3, a black swan optimization algorithm is initialized, and a Transform structure hyper-parameter is dynamically optimized; s4, outputting an attack event semantic vector, and constructing an attack path semantic map; s5, the intelligence information vector is embedded into a Transform hidden space; s6, calculating semantic similarity and dependency intensity, and generating an attack source candidate set and a traceability path; s7, outputting an attack traceability path, a starting point node and an information label, and generating a structured traceability report; and S8, according to the traceability result feedback, updating the black swan algorithm and the Transform model. The method is used for realizing intelligent modeling of multi-source network attack events and high-accuracy traceability analysis of attack source nodes.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

Provided is a cyber threat information processing method including receiving a CTI analysis request for assembly code from a client; analyzing the assembly code to obtain analysis information of the CTI for the assembly code; generating a CTI query related to a file based on the analyzed CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query obtained from the CTI for the assembly code and the natural language model as visualization information based on a web service.

The invention relates to the technical field of network security, in particular to a network security risk assessment method and device based on artificial intelligence and a medium, and the method comprises the following steps: S1, collecting network flow data, user behavior data and device state data, and generating a standardized data set; s2, extracting features related to network threats, and constructing a risk data set with labels; s3, dividing the risk data set with the label into a training set and a verification set, and training the risk assessment model by using a support vector machine algorithm; s4, outputting a risk score and a threat level, and identifying a high-risk event; and S5, performing backtracking analysis on the high-risk events identified in the step S4, and forming a risk assessment report. According to the invention, through multi-source data processing, intelligent feature extraction and support vector machine model training technologies, accurate identification and real-time evaluation of network threats and deep traceability analysis of high-risk events are realized, and the initiative of network security protection is improved.

A cyber security system that protects against cyber threats including a synthetic clone of a voice of a speaker can include several components. A deep learning model is trained to analyze an audio file and produce one or more embeddings of the audio file. One or more AI classifiers are trained to analyze the one or more embeddings of the audio file from the deep learning model to determine whether it is likely that the voice of the speaker engaging with a user is real or the synthetic clone of the voice of the speaker. The voice clone detection bot can be resident on a computing device of the user and can integrate with different sources of audio data on the computing device of the user in order to collect the audio file containing an attempt to synthetically clone the voice of the speaker protected by the cyber security system.

The invention relates to the technical field of network security, and discloses an LLM-based network threat flow detection rule automatic generation method and system. According to the system, an automatic rule generation framework based on a large language model is constructed for network threat traffic, and the system comprises a cue word module, a large language model module, a rule engine module and a rule base management module; the four modules are executed in sequence to form a complete link from traffic information input to rule automatic generation and application verification; according to the method, domain knowledge is fused into a pre-training model through LoRA fine tuning, small sample cue word engineering and a correction mechanism based on engine feedback, verification is carried out through an actual detection engine, and the effectiveness of a rule automatically generated by the model is verified. According to the method, the network threat traffic sample can be fully and effectively analyzed, meanwhile, the requirement for training data is reduced, the rule set capable of being practically applied is generated, and the network defense capability is improved.

Methods, systems, and apparatus are disclosed for an Artificial Intelligence based cyber security system. An Artificial Intelligence based cyber analyst can make use of a data structure containing multiple tags to assist in creating a consistent, expanding modeling of an ongoing cyber incident. The Artificial Intelligence based cyber analyst can make use of a cyber incident graph database when rendering that incident to an end user. The Artificial Intelligence based cyber analyst can also be used as a mechanism to evaluate the quality of the alerts coming from 3rd parties' security tools both when the system being protected by the cyber security appliance is not actually under attack by a cyber threat as well as during an attack by a cyber threat.

A security awareness training system can include a recognition module, a mapping module, a customized training module, and an authentication module. The recognition module can detect when behavioral activity by an end user on an endpoint device creates one or more of i) a model breach indicative of a potential cyber threat and ii) a violation of a network policy, an email policy, or a cloud policy. The authentication module can cooperate with the recognition module to provide just-in-time cyber security awareness training on a display screen of the endpoint device associated with that specific end user, at a time when the behavioral activity by the end user on the endpoint device creates the one or more of i) the model breach indicative of the potential cyber threat and ii) the violation of the network policy, the email policy, or the cloud policy. The authentication module can cooperate with a mapping module and a customized training module to provide the just-in-time cyber security awareness training on the endpoint device associated with that specific end user at the time when the behavioral activity by the end user on the endpoint device triggers a need for the cyber security awareness training, which causes more relevant and better learning for the end user. The mapping module can correlate the just-in-time cyber security awareness training to the behavioral activity by the end user on the endpoint device that created the model breach and / or the violation.

The invention discloses a network threat deduction system and method based on Transform and a graph attention network model. The system mainly comprises four modules including a threat intelligence extraction module, a network threat entity construction module, a network threat deduction module and a deduction result application module. The method comprises the following steps: preprocessing and mining network security threat intelligence data by utilizing a graph attention network (GAT) model, constructing a complete network threat intelligence knowledge graph based on a data association relationship, and determining a vulnerability utilization weight in the graph; modeling is carried out on a reasoned path sequence based on a Transform model, a next reasoning sequence is predicted in a generative mode, and rapid and efficient network threat intelligence reasoning is achieved. According to the method, the complexity of attack deduction calculation is reduced, the deduction efficiency is improved, and security risk investigation and early warning can be carried out for a large-scale network environment.

The disclosed cyber threat detection and deception system leverages metadata information collected by the data storage management system. Using the metadata collected by the data storage management system, the cyber threat detection and deception system analyzes that metadata to detect any anomalies. Once suspicious or abnormal behavior is detected in an asset, the cyber threat detection and deception system creates and deploys a cyber deception plan for that asset. The cyber deception plan is implemented by way of deploying sensors or emulation traps in any number of cyber-threat appliances within the data network. Lures or tokens are configured and deployed on the suspected assets themselves to redirect attackers to the emulation traps.

The invention relates to the technical field of traffic data processing, and discloses a traffic edge computing data security sharing method and system, and the method comprises the steps: collecting traffic edge computing network multi-source heterogeneous data, and carrying out the classification standardization processing to generate a structured data set; designing a dynamic data sharing security protocol based on a multi-party security computing protocol and a homomorphic encryption algorithm; verifying the authority of a requester in a multi-level manner by using an attribute-based access control model and a zero-knowledge proof mechanism, and generating a dynamic access token; storing data by adopting a fragmentation storage and redundancy encryption strategy, and recording storage information through a hash chain; and dynamically adjusting the encryption strength and the sharing strategy according to the network threat level and the data sensitivity. The method effectively guarantees safe sharing of traffic data, accurately controls access authority, improves storage and sharing efficiency, adapts to complex network environment changes, and provides powerful support for development of an intelligent traffic system.

Aspects of the subject disclosure may include, for example, obtaining a group of threat research reports, obtaining a group of indicators of compromise (IOCs), and monitoring a network of Internet of Things (IoT) devices. Further embodiments can include determining a group of possible malware on the network based on the monitoring of the network, and generating a network security recommendation based on the group of threat research reports based on the group of threat research reports, the group of IOCs, and the group of possible malware. Other embodiments are disclosed.

The invention relates to the technical field of edge device security policy deployment, in particular to an edge device-oriented lightweight AI security policy adaptive deployment method. The method comprises the following steps: collecting operation state information of edge equipment, and constructing a current multi-dimensional environment vector and a sliding window feature vector; constructing a strategy candidate library, constructing a strategy adaptability scoring function based on the current multi-dimensional environment vector and a real-time perceived network threat event, and scoring and sorting all candidate strategy items to obtain a strategy execution candidate set; and performing scheduling optimization on the strategy execution candidate set by adopting a multi-objective optimization algorithm, and selecting a strategy combination with the highest deployment score as a deployment result. According to the method, a multi-dimensional strategy adaptability scoring function is constructed, candidate strategy items are screened according to current network threat events and system resource conditions, a strategy screening mechanism from fixed template type configuration to resource awareness and attack scene linkage is converted, and the pertinence and accuracy of strategy deployment are improved.

The invention provides a time sequence security atlas-oriented network threat detection method, and relates to the technical field of attack traceability, and the scheme comprises the following steps: obtaining and cleaning security event data to obtain entity data, constructing a security map, and introducing an entity and relationship enhancement history to construct a time sequence security map; performing fine tuning on the trained large language model to obtain a forward prediction model, adjusting the position sequence of entities and relationships, and optimizing the forward prediction model in combination with a position perception prompt strategy to obtain a reverse reasoning model; associating a current event with a historical event to establish a historical chain for the time sequence security map, and introducing a mode matching mechanism based on the reverse reasoning model to perform reverse reasoning on the time sequence security map to obtain traceability attack information, and predicting the entity data based on the forward prediction model to obtain potential attack information, and then outputting a threat detection report in combination with the traceability attack information. According to the method, reverse reasoning is optimized, so that the inference capability on historical events is enhanced, and the detection requirements of advanced persistent threats and variant attacks are met.

A cyber threat information processing method including receiving a CTI analysis request for a document script from a client; analyzing the document script to obtain analysis information of the CTI for the script; generating a CTI query related to the document script based on the analysis information of the CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query from the analysis information of the CTI and the natural language model to the client.

Provided is a cyber threat information processing method including receiving a CTI analysis request for a document script included in a file from a client; analyzing the document script to obtain analysis information of the CTI for the document script; generating a CTI query related to the document script based on the analysis information of the CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query from the analysis information of the CTI and the natural language model to the client as visualization information.

The invention discloses a network threat detection method, device and equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: executing a preset data collection operation to capture initial multi-dimensional data, and carrying out the preset data processing operation on the initial multi-dimensional data to obtain processed multi-dimensional data; executing a preset entity extraction operation on the processed multi-dimensional data to obtain a target entity, storing the target entity in a preset database, and inputting the target entity into a preset long-short-term memory network model to obtain attack time sequence characteristics; inputting the attack time sequence features into a target graph neural network model to construct a target knowledge graph, and determining a cross-device abnormal behavior chain based on the target knowledge graph; and determining an attack chain integrity coefficient according to the cross-device abnormal behavior chain, and determining a network threat event and a target risk level by using the CVSS vulnerability score, the space-time correction factor and the attack chain integrity coefficient to complete network threat detection. The problems of incomplete single-dimensional data coverage, high false alarm rate and the like can be solved.

A system (100) for securing cloud-based large language models through cyber threat defense and compliance monitoring, comprising: (a) an access control and authentication module configured to authenticate users and applications using role-based access control (RBAC) and multi-factor authentication (MFA); (b) a data protection and encryption module configured to encrypt data in transit and at rest and to anonymize sensitive input / output data using cryptographic techniques; (c) a threat detection and behavior monitoring module employing machine learning algorithms to identify anomalies and detect potential cyber threats in real time;(d) a regulatory compliance monitoring module configured to continuously assess system operations against applicable regulatory frameworks and generate alerts in the event of deviations from the regulations; (e) an incident response and mitigation module configured to automatically execute predefined response actions upon detection of threats or regulatory violations; (f) a logging, auditing, and forensic analysis module configured to securely log system activities, interactions, and threat events with cryptographic integrity protection; and (g) a governance and policy management module configured to define, update, and enforce organizational AI usage and compliance policies via the cloud-based LLM infrastructure.

The invention discloses a computer network security threat real-time monitoring method and system, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-source network data, organizing the multi-source network data into a behavior sequence according to a time sequence, and forming time sequence behavior data for analysis; constructing an attack atlas based on the preprocessed multi-source network data, and in the atlas construction process, forming dynamic representation of the attack atlas in combination with time attributes of behavior events and inter-entity contexts; time sequence behavior data are input into an RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, the LSTM captures time features, key behavior features are concerned by using an adaptive attention mechanism, and a high-dimensional behavior embedding vector is generated. High-precision and real-time detection and response to network threats are realized, and the intelligence and actual combat adaptability of the system are greatly improved.

Disclosed is a method of processing cyber threat information including disassembling an input file to acquire analysis target functions in assembly code, calculating a function hash value for each of quantized function vectors of the analysis target functions, determining at least one candidate function from pre-stored comparison target functions based on the calculated function hash value, and classifying cyber threat information for the analysis target functions based on similarity for the at least one candidate function.

Provided is a cyber threat information processing method including receiving a CTI analysis request for a file from a client; analyzing the file to obtain analysis information of the CTI for the file; generating a CTI query related to the file based on the analyzed CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query obtained from the CTI for the analyzed file and the natural language model.

The invention discloses a network intrusion prevention method, apparatus and device, and a storage medium. The method comprises the steps of extracting feature information representing network behaviors from collected network flow data; inputting the feature information into a reinforcement learning model, and performing reinforcement learning on the feature information through the reinforcement learning model to obtain an intrusion prevention strategy; and acquiring environment feedback corresponding to execution of the intrusion prevention strategy, and adjusting the reinforcement learning model according to the environment feedback. Through the reinforcement learning model, automatic learning is carried out from a large amount of network flow data and adjustment is carried out to cope with continuously changing network threats, so that the accuracy and efficiency of network intrusion prevention are improved, and through automatic optimization of the model, the requirement of manual intervention is reduced, and the operation cost is reduced.

Techniques are described herein for providing artificial intelligence mediated curation of access and content within a cyber threat intelligence platform. An example system includes: one or more memories, and one or more processors. The example system may receive, from a node, an input indicating a cyber threat type; identify, by a trained AI model, cyber threat intelligence content objects, each of the objects being (a) contributed by one or more nodes having access to the distributed ledger or (b) generated by the trained AI model; evaluate, by the trained AI model, each object to: determine relevance values corresponding to each of object, and generate (i) a curated set of cyber threat intelligence content objects based on the relevance values and (ii) a recommended cyber threat practice; and transmit the recommended cyber threat practice and an indication of the curated set of cyber threat intelligence content objects to the node.

Provided is a cyber threat information processing method including receiving a CTI analysis request for assembly code from a client; analyzing the assembly code to obtain analysis information of the CTI for the assembly code; generating a CTI query related to a file based on the analyzed CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query obtained from the CTI for the assembly code and the natural language model.

The invention provides a network security policy automatic execution method and system based on an artificial intelligence large model, and relates to the technical field of network security, and the method comprises the steps: firstly obtaining a network threat chain data set comprising a threat initiating node, an intermediate propagation node, a target attacked node and propagation path description; calling a pre-trained threat chain analysis large model to carry out hierarchical disassembly and variation trend prediction, outputting a threat chain disassembly map, then extracting a matching strategy gene segment from a preset security strategy gene pool, generating candidate security strategies through model gene recombination and cross-strategy collaborative adaptation, and carrying out threat chain analysis on the candidate security strategies; inputting the candidate strategies, the current network topology and the equipment resource load data into a strategy execution deduction system, outputting an executable security strategy set adaptive to the current network state, finally issuing the executable security strategy set to network security equipment, and collecting execution feedback data for updating the threat chain analysis large model. And automatic, efficient and accurate generation and execution of the network security policy are realized.