149 results about "Hacker" patented technology

The invention relates to the technical field of network security defense, in particular to a distributed threat intelligent honeynet trapping method, which comprises the following steps: S1, on the basis of an attack deception defense technology, constructing a trap on the inevitable way of a hacker, confusing the attack target of the hacker, accurately sensing the attack behavior of the hacker, and guiding and isolating the attack traffic into an intelligent honeynet; and S2, combining attack countering and attack tracing to accurately obtain network identity and fingerprint information of the hacker. According to the distributed threat intelligent honeynet trapping method, through dynamic assembly of a bait environment and a monitoring module and reconstruction of a polymorphic module, resources of basic elements (a sandbox, bait and the like) forming the intelligent honeynet are servitized, and the maximum flexibility is ensured through modular design. When deception resources are deployed, different types of sandboxes can be randomly arranged according to an existing template or a user-defined mode, various disguise confusion capability combinations adaptive to a typical power application scene are called, and existing anti-trapping techniques and tactics of attackers can be effectively coped with.

The invention relates to a digital twin honeypot generation and network attack containment method based on a voting system, and belongs to the technical field of network security. The attack introduction decision is automatically developed through the voting system, the authenticity, interactivity and dynamicity of the honeypot are enhanced through the digital twin technology, the attack luring capability of the honeypot system is enhanced, through the system, precise putting different from traditional honeypots is achieved, and the system is suitable for popularization and application. And the probability that hackers discover and attack the honeypot bait is greatly improved.

The invention relates to a secure starting method based on HSM secure hardware support, which comprises a self-updating step and a secure starting step: copying a code of a Bootloader, re-partitioning and positioning the code to a code interval used by an App, retaining a basic CodeFlash erasing function, deleting an interaction part between a main core and an HSM, and named as Bootloader 2 carrying code; a Bootloader module is newly added to a starting code in the Bootloader, the Bootloader code needing to be re-burnt into the ECU after repairing is compiled to generate hex, a hex file is subjected to specified address setting and file refreshing, and a self-updating refreshing file is obtained through merging; the ECU receives a refreshing instruction issued by a refreshing tool, writes an App effective mark into a CODE FLASH, obtains a hash1 at the same time, stores the hash1 into a special DataFlash of an HSM, calls the HSM to carry out hash calculation to obtain a hash2 if the App is judged to be effective, reads the hash1 through the HSM to carry out comparison, runs the App if the hash1 is consistent, and stays at the Bootloader to only retain a refreshing function and protect software attacks of hackers and also can safely upgrade Bootloader and App codes if the hackers are consistent.

The invention discloses a security detection method and device, computer equipment and a storage medium. The method comprises the steps of obtaining to-be-detected data; and performing security detection on the to-be-detected data based on a pre-trained target large-scale language model to obtain a security detection result for the to-be-detected data, the target large-scale language model being obtained by training based on a corpus in the network security field. Through the semantic understanding ability of the trained target large-scale language model in the network security field, matching rules and features do not need to be constructed depending on expert experience, and the target large-scale language model obtained after training is used for security detection, so that hacker attacks with various changes can be coped with, the detection rate of hostile attacks is increased, and the security detection efficiency is improved. And the false alarm rate is reduced.

The invention discloses a vulnerability protection method using a blocking packet for blocking, which protects vulnerabilities through the blocking packet, and adopts a traffic monitoring technology to accurately shield identified vulnerability detection traffic or attack behaviors. By deploying a protection strategy on a network level, direct repair of vulnerabilities on a host is avoided, so that the complexity of system maintenance is reduced. The method ensures that the vulnerabilities cannot be scanned and utilized. Through the means, vulnerability supervision and hacker attacks are effectively handled, and closed loop of vulnerability management is realized. Meanwhile, when a malicious or abnormal connection request is detected, the system can generate a data packet with an RST mark and send the data packet to the other party of the connection, so that the connection is forcibly interrupted. The operation can effectively prevent illegal network traffic from being continuously transmitted.

The invention discloses a security enhanced CAN (Controller Area Network) controller based on encryption authentication and intrusion detection, and aims to deal with security threats such as remote unlocking, starting and stopping of a vehicle by a hacker through the Internet of Vehicles. According to the invention, a security framework based on encryption authentication and intrusion detection is constructed, the pre-shared symmetric key is combined with the AES and HMAC-SHA256 algorithms, the encryption and authentication of CAN communication data are realized, and the confidentiality, integrity and authenticity of data transmission are guaranteed; meanwhile, an intrusion detection technology based on information entropy is introduced, and data frame injection attacks initiated through legal nodes are effectively defended. According to the method, a strategy of parallel processing of data frame transmission and encryption calculation is used, the problem that extra data carrying overhead is introduced due to the fact that a CAN controller and a security module are independently achieved in an existing method is solved, efficient transmission of CAN encrypted data is achieved, and the method has good development and application prospects.

The invention relates to the technical field of power monitoring systems, in particular to a network security risk monitoring system and method for a power monitoring system, and the system comprises a network security monitoring end and a network security management end. The network security monitoring end is used for collecting operation information and security events of equipment in a power system, merging the information and the security events in real time and sending the information and the security events to the network security management end, and the network security management end is used for receiving the information and performing centralized processing and analysis so as to timely discover and process potential network security risks. Potential network attacks can be found and organized in time, the system is protected from being damaged by hacker viruses and other software, events are rapidly processed, and losses are reduced; and meanwhile, comprehensive monitoring and management of the power monitoring system can be realized, and the workload of operation and maintenance personnel is reduced.

A system for providing decentralized network management comprises a private, secure network that has a plurality of authentication nodes that collectively authenticate client devices or perform other security functions. That is, the security functions are decentralized such that they are performed by a plurality of authentication nodes that communicate with one another to arrive at a consensus for a given security action, such as whether to authenticate a user. Decentralizing the security functions generally helps to increase the security and robustness of the network. In this regard, even if a hacker is able to access and compromise an authentication node, the other authentication nodes may act to prevent the hacker from using the compromised node to perform harmful or unauthorized actions. In addition, if any of the authentication nodes fails, the other authentication nodes may continue performing security functions allowing the network to recover from the failure.

The present invention provides a method for transferring NFT ownership, a computer device and a storage medium, the method comprising: executing a first ownership transfer transaction, inputting the elliptic curve encryption value of a first random number, a second random number and the first proof information, as well as the elliptic curve encryption value of a third random number and the second proof information into the verification algorithm of a zero-knowledge proof circuit for verification: if the verification is successful, the ownership of the first NFT is transferred to the first transferee. The first proof information is generated according to the first proof algorithm, the public input includes the elliptic curve encryption value of the first random number and the second random number, and the private input includes the first random number, the address and private key of the first transferor; the second proof information is generated according to the second proof algorithm, the public input includes the elliptic curve encryption value of the third random number, and the private input includes the third random number and the address of the first transferee. The present invention enables the transferor to generate a transfer certificate when the transferee is not determined, and ensures that the NFT will not be stolen by hackers.

The invention relates to a vulnerability scanning and processing method and device, electronic equipment and a storage medium, and the vulnerability scanning and processing method comprises the steps: creating a scanning task through an OpenVAS client, carrying out the vulnerability scanning detection of a target through an NASL plug-in after a server receives a scanning request, and returning a scanning result to the client; and if the medium and high risk vulnerabilities exist, assigning a work order to carry out vulnerability repair and labeling, accurately notifying matched assets, and then querying a vulnerability state until no to-be-repaired vulnerability exists. According to the method and the device, the potential vulnerabilities of the assets can be comprehensively and accurately found and the security risk can be effectively coped by utilizing the vulnerability scanning tool and depending on the high-quality vulnerability library and the vulnerability scanning plug-in, so that network security protection personnel can know and master the vulnerabilities of the assets in advance, the attack of hackers can be effectively prevented, and the security of the network assets is guaranteed.

The invention discloses a safety communication device based on artificial intelligence, which comprises a processor, and the processor is connected with an encryption module, an identity verification module, an intrusion detection module, a machine learning module, a safety protocol module and a user interface module. The invention belongs to the technical field of intelligent communication, through the combination of the encryption module and the identity verification module, a trust relationship and a data encryption transmission channel can be established between two communication parties, the data security and integrity can be improved, potential malicious activities are monitored and identified in real time through the intrusion detection module, and the security of the communication parties is improved. Hacker attack and data leakage can be effectively prevented, meanwhile, through continuous learning and optimization of the machine learning module, the system can adapt to a new threat mode, flexible security configuration and management are provided, the overall security performance is improved, and the market prospect is wide.

The invention discloses a traffic data tracing method, system and device for hacker threat and a medium. The method comprises the steps of obtaining an original traffic data stream, extracting features of the original traffic data stream and constructing a traffic fingerprint; based on the traffic fingerprint, tracking an attack path through a first algorithm, and determining an attack propagation trajectory through the attack path; according to the attack propagation trajectory, a second algorithm is adopted to analyze the similarity between different attack events, and a cross-domain attack behavior is judged; and obtaining an attack source based on the cross-domain attack behavior judgment result and the attack propagation trajectory. According to the method, traffic statistical features and time sequence features are extracted, features under different frequency components are deeply excavated by applying a wavelet transform technology, traffic features are comprehensively presented, lightweight Transform model coding is utilized, feature vector dimensions are efficiently compressed by means of an attention mechanism, the anti-confusion capability is enhanced, and even if the interference of encryption, tunnel or camouflage technologies is caused, the traffic features can be fully represented. And original flow characteristics can be accurately identified, and a foundation is built for traceability analysis.

The present invention discloses a network security service collaboration method based on a blockchain dual chain. By constructing a universal network security collaboration and service platform, adopting a dual-chain cross-chain architecture combining a public chain and an alliance chain, and providing a unified security strategy, combined with digital asset title confirmation and legal safeguards, the rights and interests of users are protected. In the process of network security protection, the platform realizes functions such as abnormal alarm, alarm sharing, hacker behavior detection and tracking, judicial conviction and punishment, network security crime disposal, and asset loss claims. At the same time, completely anonymous technology is adopted to protect user privacy, and anonymous collaboration and service are supported, thereby improving the flexibility and processing efficiency of security services. By constructing an efficient and low-cost collaboration platform, the method enhances the collaboration ability of all parties in handling network security incidents, and provides a complete protection system for cyberspace security.

The invention discloses a one-way information security transmission system and method based on physical isolation and image transmission technologies, and aims to solve the information transmission security problem caused by the fact that a traditional security isolation device is attacked by hackers due to communication strategy configuration errors or existence of software and hardware backdoors. According to the invention, by disconnecting the physical connection between the production control region and the management information region, the one-way isolated transmission of information is realized by using the image transmission and comparison technology; the system comprises a production control region communication device, a special display, a first information capturing camera, a second information capturing camera and a management information region communication device, image data on the special display is transmitted to the management information large area through the first information capturing camera, and real-time monitoring and data comparison are performed by the second information capturing camera, so that the safety and reliability of information transmission are ensured; according to the method, the network security threat to equipment in a production control region is eliminated from the source, the overall security protection level of a power system is improved, and the application range is wide.

The invention discloses a Canvas fingerprint user behavior identification and tracking method, which relates to the technical field of data processing, and comprises the following steps of: A1, firstly, acquiring dynamic operation information of a program through an information acquisition unit, acquiring equipment fingerprints, and collecting information such as malicious mobile phone numbers, mailboxes, IPs (Internet Protocol) and behaviors; a2, carrying out data preprocessing and extraction through a data extraction unit based on the collected data; and A3, analyzing and confirming abnormal behaviors of the extracted data through a data analysis unit in a soft probe mode under the condition of not changing page source codes, and distributing unique identity tokens as user marks to all visitor terminal devices accessing the data by utilizing a multi-dimensional fingerprint acquisition technology, if a data visitor accesses a database in a web mode, a request of the visitor can be converted into a complete SQL statement, and metadata is provided for next data protection auditing and hacker attack behavior analysis.

The present application relates to the technical field of computer vision and natural language processing, and provides a cross-modal transferable backdoor attack method and device, comprising: constructing a backdoor dataset containing a trigger based on an unlabeled original dataset; inputting the original dataset and the backdoor dataset containing the trigger into a pre-constructed hacker network, and respectively calculating clean data silence loss and backdoor toxicity loss with the trigger; pre-training the pre-constructed hacker network by minimizing the clean data silence loss and the backdoor toxicity loss; calculating feature representation of a target category through image data and text data of the target category, generating a target CLIP model with a backdoor by using the pre-trained hacker network and the feature representation of the target category; and attacking by using the generated model. The backdoor trigger can be embedded in multi-modal data at the same time, has strong cross-modal transferability and concealment, and does not depend on large-scale labeled data.

The present disclosure provides a method for tracing a path of an attack on a smart contract on a blockchain, belonging to the technical field of blockchains. The method specifically includes: determining a hacker's attack address, and determining an attack's start time and an attack's stop time according to a data record of the hacker's attack address; and determining hash values of all transactions from a hacker's attack destination address between the attack's start time and the attack's stop time automatically, and obtaining a fungible token and a non-fungible token by parsing the hash values automatically. The problems of large error and low efficiency during original manual extraction are solved, accuracy and efficiency are higher, and the overall security is improved.

The invention discloses a distributed firewall, relates to the technical field of firewalls, and discloses that the distributed firewall is a containerized distributed firewall, and firewall functions of the distributed firewall are packaged into a lightweight virtual machine through a hypervisor technology. Compared with the prior art that a containerized distributed firewall lacks strong isolation, hackers can directly attack a host system when the system has zero-day vulnerabilities, so that the security of the whole platform is influenced, the method has the advantages that the firewall function can be packaged into a lightweight virtual machine during container operation through a hypervisor technology, and the security of the whole platform is influenced. Therefore, the strong isolation of the network is realized, the strong and weak problem during the operation of the traditional container is avoided, and the technical problem of low system security caused by the lack of strong isolation of a containerized firewall in the prior art is solved.

The application discloses a kind of security startup methods based on HSM security hardware support, including self-update step and security startup step: the code of Bootloader is copied a copy and repartition locates code to the code interval used by App, retains the erasing code flash function, and the main core and HSM interaction part are deleted, and it is called Bootloader2 carrying code;Boot manager module is added in the startup code in Bootloader, and the Bootloader code that needs to be re-burned into ECU after repair is compiled to generate hex, the hex file is set to refresh file with specified address, and self-update refresh file is obtained by merging;Bootloader2 and updated Bootloader' are formed;ECU receives the refresh instruction issued by refresh tool, writes App valid flag to CODE FLASH, simultaneously obtains hash1, stores hash1 in the special DataFlash of HSM, judges App valid, then calls HSM to calculate hash and obtains hash2, compares by reading hash1 through HSM, consistent, then runs App, otherwise, stay in Bootloader and only retain refresh function, protect against software attack of hacker, and can safely upgrade Bootloader and App code.

Various embodiments of systems and methods for an at-risk system identification via analysis of discussions from various online hacker communities are disclosed herein.

The invention discloses a data transmission method and a data transmission system, and relates to the technical field of information security. The method comprises the following steps: under the condition of establishing communication with an application server, receiving a first data transmission request sent by the application server, the data transmission request comprising to-be-transmitted first service data; generating an encryption key, and encrypting the first service data based on the encryption key to obtain a first encrypted file; and under the condition of establishing communication with the target terminal equipment, transmitting the first encrypted file to the target terminal equipment through the USB interface. According to the technical scheme provided by the invention, the risks that the sensitive data is decrypted after the terminal equipment is stolen and a hacker simulates and counterfeits a legal terminal to forge service data to be transmitted back for enforcement can be effectively reduced, and the data transmission security requirement of a high-security requirement unit on the network-free terminal equipment can be met.

Various embodiments of a system and methods for reasoning about enterprise-related external cyber threats using a rule-leaning approach are disclosed.

Connector and socket providing data exchange can be an entry port for hackers. To further improve the security in design, construction, installation and / or use of connectors, sockets and systems, a connector (15) is proposed which is constructed and configured to be connected with a socket (17) for data exchange with a network (13) via at least one physical layer (33). Therein, the physical layer (33) comprises at least one connection device constructed and configured for providing a physical link to a counterpart connection device in the socket (17) upon plugin of the connector (15) into the socket (17). Therein, the connector (15) comprises at least one of the following: - at least one galvanic separation device (21) constructed and configured to keep the physical link between connection device and counterpart connection device separated by a galvanic separation (16) between the connection device in the connector (15) and the counterpart connection device in the socket (17) upon plugin of the connector (15) into the socket (17) until an authentication is provided; or - at least one authentication device (20) constructed and configured to establish the physical link of the connection device in the connector (15) and the counterpart connection device in the socket (17) by overcoming the galvanic separation (16) between the connection device and the counterpart connection device upon authentication being provided to the authentication device (20).

The invention provides an Internet of Vehicles master-slave multi-chain architecture method based on a block chain. The method comprises five stages of system initialization, vehicle registration, data preprocessing, slave chain consensus and global synchronization. The risk of single-point failure and privacy disclosure due to the fact that the traditional Internet of Vehicles depends on a third-party trust mechanism to carry out data transmission is considered. Therefore, according to the method, the distributed technology of the block chain is adopted, the PBFT consensus algorithm is optimized by fusing the reputation mechanism and the utility guidance strategy, and the corresponding smart contract is deployed on the node of the block chain, so that the data transmission efficiency is remarkably improved, and the data tampering and stealing behaviors of hackers can be effectively resisted. Meanwhile, distributed storage of a large amount of data is achieved in combination with the IPFS storage technology, and the storage pressure of the server is relieved. Besides, a hybrid encryption mechanism combining a symmetric key and an asymmetric key is adopted, so that vehicle coordination and interaction among different cities are guaranteed, and consistency, integrity and security of data transmission are ensured.

According to the BMS direct current charging non-inductive upgrading method and device, the electronic equipment and the storage medium, online upgrading of software firmware is synchronously carried out in the vehicle direct current charging process, and high-stability non-inductive flashing is achieved. According to the scheme, the defects of a traditional mode are effectively avoided; compared with offline UDS flashing of a 4S store, normal use of the vehicle is not affected at all; compared with remote OTA flashing, the system has the advantages that flashing failure or system reset risks caused by network problems are completely eradicated by the aid of stable and reliable charging connection, the upgrading process is independent of a CAN (controller area network) and the internet in the vehicle, and extra loads cannot be caused. Meanwhile, according to the scheme, hacker attacks are effectively defended through a safe communication mechanism, upgrading information is stored by using technologies such as a block chain, and complete historical tracing and clear three-party responsibility definition are realized. According to the scheme, a high-performance chip does not need to be upgraded for the BMS or an advanced gateway does not need to be additionally arranged for the vehicle, and the vehicle cost is remarkably reduced.

The present disclosure relates to a service providing system and method for security of data based on a web browser. In more detail, the present disclosure relates to a service providing system and method for security of data based on a web browser, the system and method preventing unauthorized takeover of data by accurately finding out whether development tools provided from a web browser for hacking data, which is transmitted through a web browser, are being driven, and the system and method securing security for data by using a one-off encoding / decoding module. According to the present disclosure, it is possible to accurately find out whether a developer tool is being driven through a web server and prevent execution of the developer tool by guiding a hacker to an error page, whereby it is possible to safely transmit data and increase security for data.

The present invention discloses a smart meter security access method and system based on ECC accumulator, which belongs to the field of network security technology. It generates anonymous identity identification for trusted smart meters and issues anonymous identity credentials to achieve anonymous and secure access. For smart meters with abnormal behavior, administrators can revoke their anonymous identity credentials. The identity of smart meters is hidden by relying on the anti-collision property of hash functions. It is difficult for hackers to forge the anonymous identity credentials of smart meters by relying on the security of ECC accumulator technology. The present invention realizes anonymous authentication of trusted smart meters and secure revocation of untrusted devices, which can improve the access security of smart meters and facilitate application in actual scenarios.

The embodiment of the present application discloses an information setting method, which includes: obtaining sample attack events for target type applications; based on the sample attack events, determining the information type of the inducement information of applications with different functions; wherein the inducement information is information used to induce attack events; based on the information type, determining the setting location of the inducement information in the target type application; based on the information type, the setting location and information of the application to be analyzed, setting the target inducement information in the application to be analyzed; wherein the type of the application to be analyzed is the target type. The embodiment of the present application also discloses an information setting device and a computer-readable storage medium. The embodiment of the present application can enhance the attack perception effect and is highly confusing, not easily detected by hackers, and also ensures the implementation effect.

The present invention relates to a cloud-based roadway equipment monitoring system that mainly provides and constructs a plurality of servers to receive and record the return data transmitted from all roadway equipment, such as vehicle detector, changeable message sign, automatic vehicle identification, traffic signal controller, electronic tag and more, within a specific area through a router monitoring data device that replaces the existing internet-connected router-modem devices. The present invention can monitor, record, and prevent hacker invasion to enhance the availability of devices of the roadway equipment and help the traffic control center to clarify responsibility of equipment vendors.