379 results about "Honeypot" patented technology

A system and method for an AI-controlled sensor network for threat mapping and characterization. The system deploys a network of honeypots and sensors across various geographic locations and network segments, collecting and aggregating data on network traffic and potential threats. An AI orchestrator analyzes this data using advanced machine learning models, generating dynamic honeypot profiles and a comprehensive threat landscape. The system can adapt in real-time to emerging threats, optimize resource allocation, and provide actionable intelligence. By correlating data across multiple points, the system offers enhanced threat detection capabilities and proactive cybersecurity measures, surpassing traditional security information and event management (SIEM) tools.

The invention discloses a dynamic honey point collaborative intelligent threat trapping system and method based on a genetic algorithm in the technical field of network security, and the system comprises a multi-source information collection and dual-mode output module, a reinforcement learning strategy engine, a graph neural network prediction module, a digital twin simulation environment, a strategy verification and optimization module, and a real network defense execution module. A dynamic honey point deployment strategy is generated in real time through a reinforcement learning strategy engine, and the problem of strategy stiffness is solved; a third-generation non-dominated sorting genetic algorithm (NSGA-III) multi-objective optimization algorithm is used for coordinating honey point density adjustment, trip line sensitivity calibration and other actions; attacking path risks are quantified based on a threat scoring formula, digital twin environment pre-verification and high-risk node precise protection are driven, closed-loop linkage of threat perception, strategy optimization and active trapping is finally achieved, and the intelligent defense capability capable of achieving autonomous evolution is formed.

The invention discloses a network security analysis early warning system based on artificial intelligence, and the system comprises a data collection layer which captures full flow based on DPI, aggregates firewall logs, terminal behaviors and threat intelligence, and constructs a structured data pool; through TLS fingerprint identification of AI driving, the encrypted traffic is penetrated, and a sampling strategy is dynamically adjusted in combination with reinforcement learning. The intelligent analysis layer is used for carrying out cross validation on known threats and abnormal behaviors; the time sequence CNN extracts encrypted traffic features, and a novel threat detector is rapidly generated by using historical attack fragments in combination with a meta-learning framework; sHAP value driving dynamic feature selection and optimization feature vector input; the decision-making early warning layer is used for fusing multi-source features through a Bayesian network and generating 0-100 score risk scores; a self-adaptive threshold module is combined to adjust a score threshold in real time, and a high-risk event is pushed; the collaborative response layer is used for triggering a preset decision tree, deploying a GAN dynamic honeypot to trap an attacker and reversely tracing; the Neo4j visually restores the attack path, and blocking is executed after the threat is confirmed by a progressive response mechanism.

A method includes creating, via a server, a plurality of virtualized human personalities associated with respective human users; receiving, via the server, a cyberattack message; determining, via the server, the cyberattack message targets a human user of the respective human users; selecting, via the server, a virtualized human personality of the plurality of virtualized human personalities based on the virtualized human personality being associated with the human user targeted by the cyberattack message; and responding, via the server, to the cyberattack message using the virtualized human personality selected from the plurality of virtualized human personalities.

Systems and methods for protecting computing systems against ransomware attacks using AI-generated virtual file honeypots. Generative AI comprising a large language model generates virtual file honeypots automatically in response to attack vectors associated with suspect actors and ransomware families.

Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.

The invention discloses a network attack active trapping method based on intelligent scheduling, and the method comprises the steps: constructing a dynamic honeypot environment according to a real business system mirror image, simulating the interaction logic and data characteristics of a real business system, and generating a honeypot system; analyzing a network equipment log of an access source according to the security situation awareness platform, and capturing multi-dimensional features to identify attack traffic; dynamically generating a drainage strategy according to an identification result of the security situation awareness platform, and seamlessly switching attack traffic to a honeypot system through load balancing equipment; and recording an attack behavior chain in the honeypot system, extracting an attack tool fingerprint and tracking an attacker identity. Through dynamic simulation environment construction, intelligent traffic scheduling, full-chain traceability and intelligent resource management, high-simulation trapping, accurate attack shunting, credible electronic evidence chain generation and efficient resource utilization are realized, and the active defense efficiency is remarkably improved.

The invention discloses a market supervision data exchange platform migration and security enhancement method and system based on a credential environment, and relates to the technical field of network security. In the data migration process, the consistency and privacy protection of the data are ensured through Hash check and a multi-party security computing technology; a domestic commercial cryptographic algorithm and a quantum resistance encryption technology are introduced, so that the protection capability of the platform to existing security threats is effectively improved, and the resistance to future quantum computing threats is enhanced; an intrusion detection system and a virtual honeypot node are integrated, and a defense strategy is monitored and updated in real time in combination with a deep learning model, so that novel attack behaviors can be detected and coped with in real time; according to an intrusion detection alarm and a block chain audit result, a security policy and resource allocation are dynamically adjusted in combination with a machine learning technology, it is ensured that high-risk nodes are monitored in time, resource allocation is automatically optimized, and the resource utilization efficiency and security of the system are improved.

The invention provides a cheating defense method and device based on a honeypot technology and a medium, and the method comprises the steps: guiding an attacker to enter a honeynet environment when an attack behavior is detected; in response to an attacker entering the honeynet environment, forming an attack chain model based on a preset threat intelligence library according to an attack behavior of the attacker, and continuously evolving and optimizing the attack chain model according to the behavior of the attacker to ensure that the attack chain model is kept effective; the effective attack chain model is subjected to virtual verification of the honeynet environment, in the virtual verification process, different types of honeypot nodes cooperate to form a deep defense stage, and a response action with the highest rationality is executed on an attack behavior. According to the method, the device and the medium, the problems that most of the existing cheat defense methods based on the honeypot technology focus on the enhancement of the simulation degree of the methods, the methods are easy to be broken, the interaction between the honeypot and the attack behavior cannot be improved, and the effects in the aspects of hysteresis attack and capture attack are limited can be solved.

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

The invention discloses a method for evaluating honeypot agent data leakage based on federal DQN reinforcement learning, and the method comprises the steps: reasoning an action set executed by an agent from model parameter updating through employing an action leakage risk quantification technology based on a gradient non-zero item characteristic, the matching degree of the reasoned action set and the real action set is used as an action leakage risk index value; state leakage is evaluated step by step from two stages of coarse granularity reconstruction and fine granularity reconstruction by using a hierarchical element inversion evaluation technology of multi-time-step model parameter updating; and taking the similarity between the reconstruction state and the real state as a state leakage risk index value. According to the method, an important basis is provided for formulating a stronger privacy protection mechanism, meanwhile, a privacy enhancement technology in practical application is guided to be developed, and the relationship between model performance and data security is balanced.

The invention relates to the crossing field of industrial control system (ICS) safety and artificial intelligence, and particularly discloses a PLC high-interaction honeypot system based on multi-agent task splitting and RAG enhancement, which adopts a localized multi-agent collaborative architecture based on edge computing and is composed of a high-simulation equipment layer and an intelligent decision-making layer. The high-simulation equipment layer comprises a PLC dynamic mirror image, an HMI interface and a sensor data generator, and an active trapping environment is constructed through protocol fingerprint confusion and virtual and real data fusion technologies. The decision-making layer deploys a multi-agent task scheduling engine, integrates four kinds of agents including protocol analysis, behavior analysis, threat assessment and response generation, and realizes attack context perception and strategy dynamic generation based on a local RAG knowledge base. The load balancing agent dynamically allocates tasks according to equipment resources, and cooperates with offline knowledge update (USB flash disk encryption synchronization threat features) to form a closed-loop defense system, thereby ensuring physical isolation of an industrial network and realizing high-fidelity active defense.

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Anomalous events may be classified based on the monitored network traffic and attack models such that the classification determines that targets of the anomalous events may be currently subject to attacks by entities communicating on the networks. A honeypot trap may be provided in the networks based on the classified events such that the honeypot trap mimics characteristics of the targets. The portions of the network traffic associated with the honeypot trap may be monitored. Characteristics of the attacks may be determined based on the monitored portions of network traffic. Reports that include information based on the characteristics of the attacks may be generated.

The invention provides a honey array defense resource allocation optimization method based on self-game reinforcement learning, and relates to the technical field of network security defense. The optimization method comprises the following steps: deploying defense resources based on network topology, and establishing a mapping relationship between a host and the defense resources; performing attack and defense confrontation simulation based on the mapping relation to obtain an initial attack strategy and an initial defense strategy; constructing a Markov game model based on the initial attack strategy and the initial defense strategy; performing self-game reinforcement learning on attack and defense training of the Markov game model based on a depth deterministic strategy gradient algorithm; and carrying out value evaluation on the attack and defense training based on an Actor-Critic algorithm to obtain an optimal defense resource allocation strategy. By implementing the optimization method provided by the invention, the defense party and the attack party can perform self-game reinforcement learning, the defense strategy is dynamically adjusted in confrontation, and the defense effect is improved.

The invention relates to the field of network security, and provides a network security situation prediction system and method, and the method comprises the steps: carrying out the semantic analysis of network traffic data obtained by a traffic mirroring system and a honeypot log obtained by a honeypot system, so as to obtain a network traffic semantic feature and a honeypot log related semantic feature; and the two characteristics are combined and considered to realize the potential safety hazard judgment of the network. In this way, the security risk hidden behind the complex network behavior can be captured more accurately, and the network security monitoring capability can be improved.

In some examples, a system monitors input / output (I / O) operations to identify data matching a honeypot pattern. The system determines storage location information associated with the data identified as matching the honeypot pattern, and detects an access of the data at a storage location indicated by the storage location information. The system indicates a potential attack based on detecting the access of the data at the storage location indicated by the storage location information.

The invention provides a dynamic honeypot deployment and optimization method and system based on intelligent flow analysis, and belongs to the field of computer security and network security. The method comprises the following steps: collecting network traffic and preprocessing to obtain a feature vector; then, the trained random forest model is used for carrying out attack type identification on the network flow; clustering analysis is carried out on all the attack traffic, similar attack traffic forms clusters, priority ranking is carried out on the clusters, honeypots of corresponding positions and types are deployed according to matching rules in the sequence of the priorities of the clusters from high to low, and the attack traffic belonging to a certain cluster is introduced into the corresponding honeypot; a deep Q network is used in each honeypot for learning, and the optimal balance between the capture rate and the resource utilization rate is realized by modifying the configuration of the honeypot and observing the capture condition of attack traffic and the resource consumption of the honeypot. According to the method, intelligent deployment of the honeypot and dynamic configuration in the honeypot are realized, the attack capture rate of the honeypot is improved, and the resource utilization rate is maximized.

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Anomalous events may be classified based on the monitored network traffic and attack models such that the classification determines that targets of the anomalous events may be currently subject to attacks by entities communicating on the networks. A honeypot trap may be provided in the networks based on the classified events such that the honeypot trap mimics characteristics of the targets. The portions of the network traffic associated with the honeypot trap may be monitored. Characteristics of the attacks may be determined based on the monitored portions of network traffic. Reports that include information based on the characteristics of the attacks may be generated.

A lifelong learning intrusion detection system and methods are provided. The system may capture network data directed to a host node. The host node may include a honeypot. The honeypot may emulate operation of a physical or virtual device to attract malicious activity. The system may classify, based on a supervised machine learning model, the network data as being not malicious or not malicious. The system may classify, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous. The system may alter operation of the honeypot to induce malicious activity. The system may determine, after operation of the honeypot is altered, the honeypot is accessed. The system may retrain the supervised machine learning model and / or unsupervised machine learning model based the network data.

The invention relates to a digital twin honeypot generation and network attack containment method based on a voting system, and belongs to the technical field of network security. The attack introduction decision is automatically developed through the voting system, the authenticity, interactivity and dynamicity of the honeypot are enhanced through the digital twin technology, the attack luring capability of the honeypot system is enhanced, through the system, precise putting different from traditional honeypots is achieved, and the system is suitable for popularization and application. And the probability that hackers discover and attack the honeypot bait is greatly improved.

The invention discloses a network security threat detection system and method based on deep learning, and particularly relates to the field of network security trapping analysis based on a honeynet and a honeypot, and the method comprises the steps: collecting trapping node log data in a network security behavior trapping process; extracting a behavior event set including access time, request action types, parameter structures and node identifiers, organizing the behavior event set according to a timestamp sequence, and constructing a basic behavior node chain; and performing access sequence consistency check on the behavior node chain. A path map structure based on access tension evolution is constructed in a honeynet environment, a deep learning model is fused to execute trend reasoning and behavior disturbance prediction on a high-tension path segment, and a redundant path induction feedback mechanism is combined to realize preposed recognition and active trapping intervention on an attack path. The problem that high-concealment attacks cannot be perceived and responded in advance in a behavior window period is solved.

The invention provides a network attack tracing method and device based on honeypot trapping, equipment and a medium, and the method comprises the steps: inducing an attack source to initiate an attack behavior based on a pre-built honeypot system; in response to the attack behavior, entering the honeypot system, and obtaining clue data in the attack behavior; based on the clue data, performing traceability analysis on the attack source to obtain an analysis result of the attack source; and based on the analysis result, implementing countering measures on the attack source.

A computing platform may train a machine learning model to detect and analyze threat actor activities. The computing platform may generate dynamic honeypots and deploy the generated dynamic honeypots as adaptive defenses to threat actors in a computing environment. The computing platform may adapt to threat actor activities based on analyzed behavior of the threat actor and any identified tools used to by the threat actor to gain access to the computing system. The computing platform may cause redirection of the threat actor into a specific computing environment through generation and deployment of dynamic honeypots.

The invention provides an electric power honeypot construction method and system based on a large language model, and relates to the technical field of network security, and the method comprises the steps: constructing a virtual web server on an original web server, analyzing the request information of a user through a camouflage agent and a request filtering strategy, and dividing the user into a normal user and an attack user; extracting key semantic information according to inquiry information input by an attack user; performing association mapping on the key semantic information and an electric power knowledge graph to obtain an attack intention; according to the attack intention and the request information, virtual power service information is constructed through a large language model and fed back to the attack user, and attack behavior information is obtained; the attack type and the risk level of the attacking user are evaluated, the power deception strategy of the large language model is formulated based on the attack type and the risk level, and the virtual power service information is adjusted, and the technical problem that the defense security is reduced due to the static performance of the honeypot technology in the prior art can be solved.

The invention provides a cloud native application security protection and monitoring method and system for financial science and technology, and relates to the technical field of financial science and technology network security, and the method comprises the steps: obtaining multi-dimensional monitoring data, building a security threat knowledge graph, recognizing a high-risk attack path through a graph convolution network, generating a potential threat prediction result, and recognizing an abnormal behavior. And configuring a dynamic honeypot environment, recording behavior tracks of attackers, analyzing attack intentions and technical characteristics, and generating and deploying protection rules in real time. According to the invention, the safety protection capability of the financial cloud environment is improved, and intelligent threat prediction and active defense are realized.

The invention discloses an agent-free honeypot mapping method and device, and relates to the technical field of network security. The method comprises the following steps: analyzing metadata of core switching equipment, and establishing a domain-address mapping matrix; periodically detecting an address space, constructing an IP asset dynamic portrait and generating an asset state map; deploying a cross-domain traffic forwarding protocol stack and a virtual domain identifier mapping rule; deploying a software-defined virtual switching unit and accessing the virtual honeypot probe cluster; allocating idle addresses for the probes and establishing a binding relationship; and periodically detecting and triggering a self-healing process when an address conflict occurs. The device comprises a core exchange and domain management unit, an IP asset detection unit, a network protocol configuration unit, a probe virtualization management unit, an address resource scheduling unit and a system cooperative control unit. According to the method, agency-free and automatic deployment of the honeypot is realized, and the problems that a traditional scheme depends on agency software, deployment is complex and IP conflict processing lags are solved.

A honeypot network operation method and apparatus, a device and a storage medium are provided. An implementation of the method comprises: obtaining attack traffic for a service machine; forwarding the attack traffic to a honeypot container corresponding to the service machine, where a container address of the honeypot container is the same as a service address of the service machine, the service address is a network address of the service machine, and the container address is a network address of the honeypot container; and returning virtual data generated by the honeypot container, where the virtual data is data requested by the attack traffic, and the virtual data comprises the container address.

The present disclosure provides a threat intelligence detection method, device, equipment and medium based on honeypot trapping, which relates to the field of network security technology and aims to improve the threat detection and response capabilities of network security. The method includes: obtaining network topology data of an IPv6 network; generating an undirected graph based on the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent the connection relationship between the devices; based on the undirected graph, determining the target node based on the first parameter and the second parameter of each node, wherein the first parameter represents the importance characteristics of the node, and the second parameter represents the vulnerability characteristics of the node; based on the target node, deploying a honeypot trapping strategy, wherein the honeypot trapping strategy is used to simulate the vulnerabilities of the real system to attract attackers to actively attack; detecting threat intelligence according to the honeypot trapping strategy.

The invention discloses an industrial field network security honeypot simulation and threat trapping system, which comprises an industrial control system, the industrial control system comprises an industrial protocol simulation honeypot engine, an intelligent dynamic configuration module, a context awareness analysis module, an integrated response and blocking module, a threat intelligence and situation awareness platform, a physical layer defense subsystem and a compliance report generation module. The industrial protocol simulation honeypot engine is arranged at a key position in an industrial control system, the industrial protocol simulation honeypot engine is used for simulating communication behaviors of Modbus TCP / IP, OPC UA and Profinet, the industrial protocol simulation honeypot engine dynamically adapts to equipment start and stop and protocol parameter changes, the industrial protocol simulation honeypot engine simulates an industrial environment, and the industrial control system is connected with the industrial control system. Intrusion and attack behaviors for the industrial system are induced and captured. Through cooperation of multiple modules, safety protection of the industrial control system is comprehensively improved, risks are reduced, stable operation is ensured, compliance requirements are met, and competitiveness is enhanced.

The invention discloses an attack trapping and analyzing method and system based on a honeynet, and relates to the technical field of attack analysis, and the method comprises the steps: collecting attack interaction data and an associated attack chain trajectory set; dividing attack behavior units, and constructing a behavior space attitude matrix; constructing a two-dimensional behavior relationship graph, performing interpolation enhancement of sub-time granularity, and raising the dimension of the interpolated behavior node into a three-dimensional semantic space; performing attack path trend analysis on the attack behavior unit, and constructing an attack path bending rule model; and inputting parameters such as the attack chain trajectory set and behavior nodes in the three-dimensional semantic space into the attack path bending rule model, outputting a trapping response strategy, and dynamically adjusting the honeynet environment. According to the invention, the type and position of the honeypot can be automatically adjusted according to the attack behavior change, the structure definition and processing precision of the attack behavior data are effectively improved, and the attack behavior identification result can be conveniently and directly used for trapping strategy optimization.