83 results about "Hacker" patented technology

The invention relates to the technical field of network security defense, in particular to a distributed threat intelligent honeynet trapping method, which comprises the following steps: S1, on the basis of an attack deception defense technology, constructing a trap on the inevitable way of a hacker, confusing the attack target of the hacker, accurately sensing the attack behavior of the hacker, and guiding and isolating the attack traffic into an intelligent honeynet; and S2, combining attack countering and attack tracing to accurately obtain network identity and fingerprint information of the hacker. According to the distributed threat intelligent honeynet trapping method, through dynamic assembly of a bait environment and a monitoring module and reconstruction of a polymorphic module, resources of basic elements (a sandbox, bait and the like) forming the intelligent honeynet are servitized, and the maximum flexibility is ensured through modular design. When deception resources are deployed, different types of sandboxes can be randomly arranged according to an existing template or a user-defined mode, various disguise confusion capability combinations adaptive to a typical power application scene are called, and existing anti-trapping techniques and tactics of attackers can be effectively coped with.

A system for providing decentralized network management comprises a private, secure network that has a plurality of authentication nodes that collectively authenticate client devices or perform other security functions. That is, the security functions are decentralized such that they are performed by a plurality of authentication nodes that communicate with one another to arrive at a consensus for a given security action, such as whether to authenticate a user. Decentralizing the security functions generally helps to increase the security and robustness of the network. In this regard, even if a hacker is able to access and compromise an authentication node, the other authentication nodes may act to prevent the hacker from using the compromised node to perform harmful or unauthorized actions. In addition, if any of the authentication nodes fails, the other authentication nodes may continue performing security functions allowing the network to recover from the failure.

The invention discloses a traffic data tracing method, system and device for hacker threat and a medium. The method comprises the steps of obtaining an original traffic data stream, extracting features of the original traffic data stream and constructing a traffic fingerprint; based on the traffic fingerprint, tracking an attack path through a first algorithm, and determining an attack propagation trajectory through the attack path; according to the attack propagation trajectory, a second algorithm is adopted to analyze the similarity between different attack events, and a cross-domain attack behavior is judged; and obtaining an attack source based on the cross-domain attack behavior judgment result and the attack propagation trajectory. According to the method, traffic statistical features and time sequence features are extracted, features under different frequency components are deeply excavated by applying a wavelet transform technology, traffic features are comprehensively presented, lightweight Transform model coding is utilized, feature vector dimensions are efficiently compressed by means of an attention mechanism, the anti-confusion capability is enhanced, and even if the interference of encryption, tunnel or camouflage technologies is caused, the traffic features can be fully represented. And original flow characteristics can be accurately identified, and a foundation is built for traceability analysis.

The present invention discloses a network security service collaboration method based on a blockchain dual chain. By constructing a universal network security collaboration and service platform, adopting a dual-chain cross-chain architecture combining a public chain and an alliance chain, and providing a unified security strategy, combined with digital asset title confirmation and legal safeguards, the rights and interests of users are protected. In the process of network security protection, the platform realizes functions such as abnormal alarm, alarm sharing, hacker behavior detection and tracking, judicial conviction and punishment, network security crime disposal, and asset loss claims. At the same time, completely anonymous technology is adopted to protect user privacy, and anonymous collaboration and service are supported, thereby improving the flexibility and processing efficiency of security services. By constructing an efficient and low-cost collaboration platform, the method enhances the collaboration ability of all parties in handling network security incidents, and provides a complete protection system for cyberspace security.

The present application relates to the technical field of computer vision and natural language processing, and provides a cross-modal transferable backdoor attack method and device, comprising: constructing a backdoor dataset containing a trigger based on an unlabeled original dataset; inputting the original dataset and the backdoor dataset containing the trigger into a pre-constructed hacker network, and respectively calculating clean data silence loss and backdoor toxicity loss with the trigger; pre-training the pre-constructed hacker network by minimizing the clean data silence loss and the backdoor toxicity loss; calculating feature representation of a target category through image data and text data of the target category, generating a target CLIP model with a backdoor by using the pre-trained hacker network and the feature representation of the target category; and attacking by using the generated model. The backdoor trigger can be embedded in multi-modal data at the same time, has strong cross-modal transferability and concealment, and does not depend on large-scale labeled data.

The present disclosure provides a method for tracing a path of an attack on a smart contract on a blockchain, belonging to the technical field of blockchains. The method specifically includes: determining a hacker's attack address, and determining an attack's start time and an attack's stop time according to a data record of the hacker's attack address; and determining hash values of all transactions from a hacker's attack destination address between the attack's start time and the attack's stop time automatically, and obtaining a fungible token and a non-fungible token by parsing the hash values automatically. The problems of large error and low efficiency during original manual extraction are solved, accuracy and efficiency are higher, and the overall security is improved.

The application discloses a kind of security startup methods based on HSM security hardware support, including self-update step and security startup step: the code of Bootloader is copied a copy and repartition locates code to the code interval used by App, retains the erasing code flash function, and the main core and HSM interaction part are deleted, and it is called Bootloader2 carrying code;Boot manager module is added in the startup code in Bootloader, and the Bootloader code that needs to be re-burned into ECU after repair is compiled to generate hex, the hex file is set to refresh file with specified address, and self-update refresh file is obtained by merging;Bootloader2 and updated Bootloader' are formed;ECU receives the refresh instruction issued by refresh tool, writes App valid flag to CODE FLASH, simultaneously obtains hash1, stores hash1 in the special DataFlash of HSM, judges App valid, then calls HSM to calculate hash and obtains hash2, compares by reading hash1 through HSM, consistent, then runs App, otherwise, stay in Bootloader and only retain refresh function, protect against software attack of hacker, and can safely upgrade Bootloader and App code.

Various embodiments of systems and methods for an at-risk system identification via analysis of discussions from various online hacker communities are disclosed herein.

The invention discloses a data transmission method and a data transmission system, and relates to the technical field of information security. The method comprises the following steps: under the condition of establishing communication with an application server, receiving a first data transmission request sent by the application server, the data transmission request comprising to-be-transmitted first service data; generating an encryption key, and encrypting the first service data based on the encryption key to obtain a first encrypted file; and under the condition of establishing communication with the target terminal equipment, transmitting the first encrypted file to the target terminal equipment through the USB interface. According to the technical scheme provided by the invention, the risks that the sensitive data is decrypted after the terminal equipment is stolen and a hacker simulates and counterfeits a legal terminal to forge service data to be transmitted back for enforcement can be effectively reduced, and the data transmission security requirement of a high-security requirement unit on the network-free terminal equipment can be met.

The invention provides an Internet of Vehicles master-slave multi-chain architecture method based on a block chain. The method comprises five stages of system initialization, vehicle registration, data preprocessing, slave chain consensus and global synchronization. The risk of single-point failure and privacy disclosure due to the fact that the traditional Internet of Vehicles depends on a third-party trust mechanism to carry out data transmission is considered. Therefore, according to the method, the distributed technology of the block chain is adopted, the PBFT consensus algorithm is optimized by fusing the reputation mechanism and the utility guidance strategy, and the corresponding smart contract is deployed on the node of the block chain, so that the data transmission efficiency is remarkably improved, and the data tampering and stealing behaviors of hackers can be effectively resisted. Meanwhile, distributed storage of a large amount of data is achieved in combination with the IPFS storage technology, and the storage pressure of the server is relieved. Besides, a hybrid encryption mechanism combining a symmetric key and an asymmetric key is adopted, so that vehicle coordination and interaction among different cities are guaranteed, and consistency, integrity and security of data transmission are ensured.

According to the BMS direct current charging non-inductive upgrading method and device, the electronic equipment and the storage medium, online upgrading of software firmware is synchronously carried out in the vehicle direct current charging process, and high-stability non-inductive flashing is achieved. According to the scheme, the defects of a traditional mode are effectively avoided; compared with offline UDS flashing of a 4S store, normal use of the vehicle is not affected at all; compared with remote OTA flashing, the system has the advantages that flashing failure or system reset risks caused by network problems are completely eradicated by the aid of stable and reliable charging connection, the upgrading process is independent of a CAN (controller area network) and the internet in the vehicle, and extra loads cannot be caused. Meanwhile, according to the scheme, hacker attacks are effectively defended through a safe communication mechanism, upgrading information is stored by using technologies such as a block chain, and complete historical tracing and clear three-party responsibility definition are realized. According to the scheme, a high-performance chip does not need to be upgraded for the BMS or an advanced gateway does not need to be additionally arranged for the vehicle, and the vehicle cost is remarkably reduced.

The present disclosure relates to a service providing system and method for security of data based on a web browser. In more detail, the present disclosure relates to a service providing system and method for security of data based on a web browser, the system and method preventing unauthorized takeover of data by accurately finding out whether development tools provided from a web browser for hacking data, which is transmitted through a web browser, are being driven, and the system and method securing security for data by using a one-off encoding / decoding module. According to the present disclosure, it is possible to accurately find out whether a developer tool is being driven through a web server and prevent execution of the developer tool by guiding a hacker to an error page, whereby it is possible to safely transmit data and increase security for data.

The embodiment of the present application discloses an information setting method, which includes: obtaining sample attack events for target type applications; based on the sample attack events, determining the information type of the inducement information of applications with different functions; wherein the inducement information is information used to induce attack events; based on the information type, determining the setting location of the inducement information in the target type application; based on the information type, the setting location and information of the application to be analyzed, setting the target inducement information in the application to be analyzed; wherein the type of the application to be analyzed is the target type. The embodiment of the present application also discloses an information setting device and a computer-readable storage medium. The embodiment of the present application can enhance the attack perception effect and is highly confusing, not easily detected by hackers, and also ensures the implementation effect.

The present invention relates to a cloud-based roadway equipment monitoring system that mainly provides and constructs a plurality of servers to receive and record the return data transmitted from all roadway equipment, such as vehicle detector, changeable message sign, automatic vehicle identification, traffic signal controller, electronic tag and more, within a specific area through a router monitoring data device that replaces the existing internet-connected router-modem devices. The present invention can monitor, record, and prevent hacker invasion to enhance the availability of devices of the roadway equipment and help the traffic control center to clarify responsibility of equipment vendors.

A computer implemented and electronic process is provided that uses artificial intelligence to detect unauthorized activity by an insider or hacker. Electronic systems that employ artificial intelligence and machine learning to detect unauthorized transaction activity by insiders or hackers for a computer network system are also provided. Hardware required for carrying out the invention typically include a plurality of networked computers. Specialized software and / or firmware is typically needed in connection with the hardware for carrying out the invention.

Various embodiments for predicting which software vulnerabilities will be exploited by malicious hackers and hence prioritized by patching are disclosed.

A robust, hacker-resistant self-sufficiency chip, including: a secure memory architecture, energy-efficient processing units and authentication mechanisms.

The invention relates to display equipment and a page display method thereof, and relates to the technical field of display equipment. The display equipment comprises a display which is configured to perform page display; the at least one controller is connected with the display and is configured to receive a connection request initiated by an AIoT (artificial intelligence Internet of Things) client; under the condition that the request moment of the connection request exceeds the page display time limit corresponding to the connection request, controlling a display to display an authorized page; under the condition that the request moment of the connection request does not exceed the page display time limit corresponding to the connection request, controlling a display not to display an authorized page; and in response to a cancelling operation on the authorized page, counting continuous cancelling times, determining a page display time limit corresponding to the next connection request according to the continuous cancelling times, and prohibiting connection with the AIoT client. According to the method and the device, the operation cancelling times of the user can be reduced under the condition that multiple misoperation behaviors occur or hacker attacks occur.

The application discloses an anti-reward hacker recommendation system optimization method and an anti-reward hacker recommendation system, and the method comprises the following steps: a dynamic interval mechanism is constructed, a dynamic interval item is calculated based on a user historical sequence and a positive and negative sample pair, and the dynamic interval item is used for quantifying the preference difference intensity between the positive and negative samples; the dynamic interval item is subjected to cross-sample statistical normalization to obtain a normalized interval item; the dynamic interval is decoupled into an optimization constraint item through a stop gradient operation, model training is carried out in combination with a preference optimization loss; a negative log-likelihood loss is introduced, and the generation probability of the positive sample is directly maximized; the preference optimization loss and the negative log-likelihood loss are jointly optimized to obtain a total loss function, which is used for inhibiting the reward hacker behavior in the recommendation system. The application dynamically adjusts the interval threshold based on the user behavior intensity, ensures that the model differentiates modeling of the fine-grained preference and the coarse-grained demand of the final positive and negative samples in the recommendation sequence, and alleviates the recommendation deviation caused by data sparseness and diversity.

The invention provides a confused script processing method and device, equipment, a medium and a program product, and a specific implementation mode of the application is as follows: obtaining an alarm source IP and subsequent actions thereof by tracking an initial access alarm event, extracting an executable script from detected transmission script traffic, and sending the executable script to a server; and performing classification by using the trained first model to obtain and mark confusion scripts, and performing attack chain tracking. When the marked confusion script is remotely started, a first operation including dynamic injection and sandbox linkage analysis is executed, sensitive behaviors are blocked, a result is forged to obtain information such as a starting secret key and an executable sample, and finally a derivative sample is predicted and detected based on the operation result. According to the method, the information of each link of the attack chain is connected in series, the real terminal environment is monitored, hackers are prevented from perceiving, more attack martial arts can be obtained in one attack, and the detection and defense capability on malicious confusion scripts and derivative samples is improved.

Malicious users (or hackers) can take advantage of user devices on or communicably connected to an autonomous vehicle (AV) to gain unauthorized access to AV subsystems (e.g., AV compute system, AV sensors, AV controls system, and AV cabin system). To address this concern, a one-way Ethernet communication link can be placed between the AV subsystems and the user devices. The one-way communication link can physically ensure that the user devices may only receive content from the AV systems, and that the user devices may not send data to the AV systems on the one-way communication link. A feature-limited backchannel that may be normally used for transporting audio data on a daisy-chained bus can be used by the user devices to transmit (8-bit) code words that correspond to specific messages to convey messages back to the AV systems.

The present invention discloses an automated penetration testing method and system, which includes: establishing a protection capability baseline for a target network system and setting basic network parameters according to the security protection level; deploying attack agents at each network level of the target network system to simulate a jump machine after a hacker attack; creating an automated penetration task to detect the exposed surface of each network level and collect vulnerability information; performing vulnerability scanning based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface; determining whether to proceed to the penetration task of the next network level through penetration decision-making; if so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next network level of the attack agent; generating a penetration test result report based on the penetration data of each network level, and providing an estimated probability of penetration of each network level. The present invention can quickly achieve in-depth testing of penetration attacks across the entire network.

Various embodiments of systems and methods for an at-risk system identification via analysis of discussions from various online hacker communities are disclosed herein.

The invention belongs to the technical field of network security and machine learning, and discloses an industrial control hacker organization identification method based on a Gaussian self-organizing incremental neural network. Dividing the network attack traffic into a plurality of traffic sessions through the session time threshold; representing each flow session in an attack mode, and introducing an attack time feature into the attack mode; and learning the time sequence characteristics of the attack pattern. Performing feature selection; classifying the attack modes after feature selection based on a Gaussian self-organizing incremental neural network; constructing a network attack heterogeneous graph; constructing a hacker relationship meta-path set: researching the relationship between hackers by evaluating all combinations of node types to form a meta-path; filtering meaningless meta-paths to obtain an effective meta-path set; learning attribute features and structural features of the nodes to obtain embedded vectors of the nodes; and incremental clustering is carried out on the embedded vectors of the hacker nodes through a Gaussian self-organizing incremental neural network, and industrial control hacker organizations are identified.

The present application relates to a system patch processing method, apparatus, computer device, and storage medium. The method includes: in response to a system patch inspection instruction for a target system, obtaining the patch inspection execution frequency and the patch inspection execution time; according to the patch inspection execution frequency and the patch inspection execution time, performing an inspection operation on the patch installation situation of the target system to obtain a target system inspection result; in the case where the target system inspection result indicates that there is an abnormality in the patches of the target system, determining a full-scale patch abnormality list; according to the full-scale patch abnormality list, server application information, and human resource information table, determining a patch professional group matching result; in the case where there is a corresponding patch maintenance professional group for the determined patch professional group matching result, generating system patch maintenance information. Using this method can improve the efficiency of server vulnerability blocking, reduce hacker attacks, and improve the security of the server.

The invention provides a power plant network security situation awareness method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining the operation data of each unit of a power plant in a current time period and a plurality of historical time periods, the operation data comprising monitoring data and network data; determining a plurality of similar historical time periods based on the monitoring data of the current time period and the monitoring data of each historical time period, wherein the similar historical time periods are historical time periods which reach target similarity with the monitoring data of the current time period; based on the operation data in the current time period and each historical time period, determining the hacker attack expression degree of the current time period, wherein the hacker attack expression degree is used for quantifying the tendency degree of each unit to be subjected to a replay attack; determining the electric control anomalies of the units in the current time period based on the operation data of the current time period and the similar historical time periods, wherein the electric control anomalies are suitable for quantifying the abnormal degree of the energy conversion efficiency of each unit; and determining a crisis index of the unit based on the hacker attack performance degree and the electric control anomalous degree, and giving out an early warning according to the crisis index.

The invention relates to the technical field of intelligent equipment, and discloses a method and device for television cloud storage, a television and a storage medium. The method comprises the following steps: acquiring current webpage login request information of a current user through a generated access link of a data access webpage; receiving a current data access request of a current user under the condition that the current webpage login request information including the smart television account information is determined to be effective login information; and based on the television storage space matched with the access permission of the current user, performing a corresponding data access storage application according to the current data access request. Therefore, the cost of cloud storage service is saved for the user, the risk that the data is attacked by hackers and leaked after being stored on the cloud server can be reduced, and the security of data storage of the user is improved.

A trusted component is suggested to be added to off the shelf computing systems such as PCs or smartphone providing secure functions for access management and credential protection—safe authentication, maintaining session integrity and validation of content modification. An additional advantage of the solution that it detects malware / hacking attempts on first try allowing of taking action while oblivious to the malware / hacker to avoid retaliation.

To provide an anti-disengagement device for preventing a sling passed through a sling part of a hacker from accidentally coming off.SOLUTION: An anti-disengagement device 20 for a hacker 10 comprises an outer cylindrical body 21, an inner cylindrical body 22, a compression spring 23, and a cable tie 24. The outer cylindrical body includes an outer cylindrical protrusion 21f that can be fitted into one hook inner surface recess 17a, and an outer cylindrical inner diameter space 21b that accommodates the inner cylindrical body. The inner cylindrical body includes an inner cylindrical protrusion 22g that can be fitted into the other hook inner surface recess 17b, an annular groove 22e for locking the cable tie, and an inner cylindrical inner diameter space 22b that accommodates the compression spring. When the compression spring is compressed so that its axial length is shorter than the hacker inner width IW, the outer cylindrical protrusion and the inner cylindrical protrusion are fitted into the respective hook inner surface recesses, thereby achieving an attached state, which is held in place by the cable tie locked in the annular groove.SELECTED DRAWING: Figure 6

An embodiment of the present invention discloses a portable physical root. The portable physical root includes a cryptographic security chip, a system on chip, and an Ethernet interface; wherein, the cryptographic security chip is used to provide functions of public-private key generation, data encryption, and digital signature; the system on chip is used to provide a software operating system for the portable physical root to complete the interactive authentication between the portable physical root and the cloud host; the Ethernet interface is used to connect the portable physical root to the network and communicate with the trusted root of the cloud host. By adopting the technical solution of the embodiment of the present invention, the constructed portable physical root is used as a security control device for the cloud host to perform security authentication and security control on the cloud host, so as to effectively prevent hacker attacks, reduce the trust risk, and improve the portable mobility of the security control device.