7773 results about "Internet traffic" patented technology

A system and method for an AI-controlled sensor network for threat mapping and characterization. The system deploys a network of honeypots and sensors across various geographic locations and network segments, collecting and aggregating data on network traffic and potential threats. An AI orchestrator analyzes this data using advanced machine learning models, generating dynamic honeypot profiles and a comprehensive threat landscape. The system can adapt in real-time to emerging threats, optimize resource allocation, and provide actionable intelligence. By correlating data across multiple points, the system offers enhanced threat detection capabilities and proactive cybersecurity measures, surpassing traditional security information and event management (SIEM) tools.

The invention provides a network attack and defense decision support method and system based on artificial intelligence, and relates to the technical field of network attack and defense, and the method comprises the steps: obtaining network topology information and equipment configuration information, constructing a network environment digital twinborn model, collecting network flow data and security logs, and extracting features through a deep learning model. Generating a network security situation assessment report, analyzing the attack graph by using a graph neural network, identifying a target node and generating an initial defense strategy set, generating a plurality of candidate defense schemes by using a multi-target optimization algorithm based on a validity assessment result of a defense strategy, and performing security and feasibility analysis on the candidate defense schemes, the method comprises the steps of selecting an optimal defense scheme, refining the optimal defense scheme into specific implementation steps, generating alternative schemes for coping with different attack conditions, presenting the optimal defense scheme and the alternative schemes through a visual interface, and providing a decision basis and a risk assessment report.

The invention provides a communication network operation and maintenance fault positioning and tracking method and system, relates to the technical field, and belongs to the technical field of communication network fault diagnosis. According to the method, historical operation data, including network flow data, performance index data and alarm log data, of communication network equipment are collected, fault feature vectors are generated through training of a deep learning model, and a fault feature knowledge base is constructed; receiving operation data reported by equipment in real time to perform feature extraction, and performing similarity matching based on the fault feature knowledge base to determine a fault type; and analyzing a fault propagation path by adopting a graph traversal algorithm, determining fault root cause equipment by calculating a fault probability score of an equipment node, and generating a fault tracking report. According to the invention, accurate positioning and rapid diagnosis of communication network faults are realized, the fault processing efficiency is improved, and the network operation and maintenance cost is reduced.

The embodiment of the invention provides a network flow anomaly monitoring method and device based on a BiLSTM-Att network, and the method comprises the steps: obtaining network flow time sequence data, system resource use data and service call topological data, constructing a multi-modal time sequence feature matrix through employing a sliding time window method, calculating the importance score of each feature in the traffic feature subset, the resource feature subset and the service feature subset through an information gain algorithm, and screening the most discriminative feature based on a score threshold to construct a fusion feature subset; inputting the fusion feature subset into a set bidirectional long short-term memory-attention network, performing multi-level analysis on target features, performing comprehensive evaluation on a detection result by adopting a confidence-based multi-view decision fusion method, and generating a detection report containing an anomaly level, an anomaly type and an anomaly reason; according to the invention, the efficiency and accuracy of network flow anomaly monitoring based on the BiLSTM-Att network can be effectively improved.

The invention provides a network security penetration detection method and system based on artificial intelligence, and the method comprises the steps: firstly obtaining real-time network flow data containing multi-dimensional communication behavior records and protocol metadata of a target network system, and then extracting network behavior sequence features capable of describing communication behavior time relevance and a protocol interaction mode from the network flow data; inputting the network behavior sequence features into a pre-trained multi-modal threat prediction model, generating a potential attack vector prediction result containing an attack intention label, penetration path probability distribution and a threat level score, and dynamically verifying the potential attack vector prediction result based on a threat knowledge base, and finally, generating a self-adaptive defense strategy according to the penetration threat detection result, triggering defense interface deployment of a target network system, updating attack mode characteristics and a defense rule set of a threat knowledge base, and realizing intelligent and efficient network security penetration detection and defense.

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

The invention provides an information network security self-defense method and system based on trusted computing, and the method comprises the steps: constructing a trusted computing platform which comprises the steps: deploying a trusted platform module TPM, building a trusted software stack TSS, and implementing a trusted network connection TNC; designing a self-defense architecture, wherein the self-defense architecture comprises deployment of a network layer, an application layer and a data layer defense system, integration of an intelligent sensing system and establishment of a central control and decision center; network traffic and user access behaviors are monitored, and embedded attack behaviors are preprocessed; performing anomaly detection on the network flow and the user access behavior by applying a machine learning algorithm; calculating a real-time risk score based on the anomaly detection result, and generating a security situation awareness report; and based on the security situation awareness report, defining a threat level and a response level, and executing automatic defense.

The invention discloses a network line intelligent operation and maintenance monitoring management system and method. The method comprises the steps that an intelligent network monitoring and optimizing system regularly collects network equipment information through a protocol, and a monitoring agent collects server and machine room environment data; processing data in real time by adopting distributed storage and a stream processing framework; predicting a network fault by adopting threshold monitoring and a machine learning model, and identifying a bottleneck and scheduling resources based on flow analysis; in combination with deep packet inspection and an AI algorithm, network traffic is monitored in real time, security threats are identified, and IPS system protection is deployed; a repair operation is automatically triggered through a self-healing strategy, and backup resources are started; the AI engine analyzes historical and real-time data, generates network topology and link state visual content, and automatically generates reports, optimization and decision support; according to the intelligent operation and maintenance monitoring management system and method for the network line, a fault tree analysis and decision support system is introduced, and a plurality of fault reasons are intelligently analyzed and repair measures are automatically executed.

The invention relates to the technical field of network security, in particular to a network security big data state evaluation method based on pattern recognition, which comprises the following steps of: extracting multi-modal features from a network flow log, a system event log, a host behavior log and threat intelligence data, generating a feature matrix, performing feature dimensionality reduction by adopting an auto-encoding network, and obtaining a network security big data state evaluation result; carrying out attack behavior classification and abnormal mode identification in combination with unsupervised clustering and a graph neural network; constructing an attack transition probability matrix based on a Markov model; forming a time sequence attack chain; predicting an attack development trend; and a dynamic protection instruction is issued to the safety equipment. According to the method, the unknown attack detection capability can be improved, the time sequence attack traceability is enhanced, the security situation assessment is optimized, and the method is suitable for security situation awareness in cloud computing, industrial internet and large-scale network environments.

The invention provides a network attack risk mapping assessment method and system, and relates to the technical field of network attack risks, and the method comprises the steps: collecting a network flow data packet to extract a multi-dimensional attack feature vector, employing a deep neural network to carry out feature learning to obtain an attack type recognition result and an attack intensity assessment value, and constructing an attack feature standard model; based on the attack type identification result and the attack strength evaluation value, combining an asset weight coefficient, a vulnerability hazard level and a vulnerability utilization difficulty coefficient to construct an asset vulnerability evaluation model; and performing association analysis on the real-time attack feature data and the asset vulnerability assessment score, constructing a risk mapping matrix, calculating a comprehensive risk score, and generating risk early warning information. According to the invention, accurate identification, dynamic assessment and timely early warning of the network attack risk are realized, and the accuracy and real-time performance of risk assessment are improved.

The invention provides a network security protection method and system applied to regional digital and intelligent asset businesses, and the method comprises the steps: collecting asset data flows of a plurality of asset business nodes in a target region, carrying out the threat feature extraction of the asset data flows based on a preset threat knowledge graph, and obtaining a threat feature extraction result; generating a dynamic threat feature vector corresponding to the asset service node; inputting the dynamic threat feature vector into a pre-trained dynamic protection model, and outputting a real-time protection strategy adaptive to the asset service node through a multi-layer decision network in the dynamic protection model; performing strategy execution on the network flow of the asset service node based on the real-time protection strategy, generating a strategy execution result and feeding back the strategy execution result to the dynamic protection model; and performing adaptive optimization on decision parameters of the dynamic protection model according to a strategy execution result, and generating an updated dynamic protection model for a protection decision of a next round of asset business nodes.

A method is provided for encrypted network traffic analysis. The method includes capturing network traffic data; calculating entropy of said data to classify traffic as encrypted or non-encrypted; applying statistical and sequential feature hybridization on encrypted traffic to extract comprehensive features; analyzing the features using a neural network model to identify encrypted traffic types and detect anomalies; and refining the analysis based on entropy and neural network insights through a feedback loop.

The invention provides an artificial intelligence enhanced distributed denial of service attack defense method and system, and relates to the technical field of artificial intelligence, and the method comprises the steps: collecting a data packet through a network flow collection module, extracting basic feature information, and obtaining a behavior feature vector through a deep learning feature extraction model; inputting the behavior feature vector into a pre-trained multilayer attention mechanism neural network model, calculating an attack probability score and marking potential attack traffic; performing clustering analysis on the potential attack traffic to calculate a hazard level, and generating a defense strategy according to the hazard level; and executing the defense strategy through the defense equipment, and dynamically optimizing the defense strategy by using a reinforcement learning algorithm based on defense effect feedback. According to the method, the attack traffic can be accurately identified, the defense strategy is adaptively optimized, and the accuracy and efficiency of distributed denial of service attack defense are effectively improved.

The invention provides an intrusion detection and response method and system for a satellite internet target range, and relates to the technical field of network security technologies, and the method comprises the steps: carrying out the multi-dimensional real-time collection of the network flow of the satellite internet target range, carrying out the self-adaptive multi-scale feature extraction, constructing a network behavior baseline model, and positioning and recognizing the abnormal flow. Deploying an anomaly detection node based on edge calculation, performing preliminary screening at a track end, performing multi-angle association, and outputting an anomaly event report; a distributed intelligent honeypot is activated, deep interaction is induced, the information collection amount is maximized, multi-modal data is obtained, and multi-dimensional attack feature vectors and behavior sequences are generated; historical defense empirical data are integrated, a method of combining reinforcement learning and a genetic algorithm is utilized, a defense strategy is coordinated, a defense process is generated, and the defense process is recorded through a block chain and fed back to a network behavior baseline model.

The invention provides a network traffic anomaly detection model training method and device and a readable storage medium, and the method comprises the steps: extracting a traffic statistical feature vector according to original network traffic data, and generating an initial mixed data set; generating a confrontation disturbance sample output enhanced feature matrix based on the initial mixed data set; constructing a self-adaptive feature fusion rule based on the enhanced feature matrix, embedding asset association degree parameters into an attention calculation layer of a feature encoder, and outputting encoding features fusing threat intelligence; inputting the coding features fused with the threat intelligence into a pre-constructed initial detection model, generating false report and missing report correction labels based on the suspicious traffic fragments, and outputting an adversarial sample correction data set; and performing adversarial training on the initial detection model through the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection. According to the invention, the detection precision, the anti-interference capability and the real-time defense response capability of the detection model to novel attacks can be improved.

The invention relates to the technical field of information security, in particular to a power distribution Internet of Things cloud side end collaborative interaction security protection system, which comprises a network flow monitoring module, an abnormal flow identification module, a security threat response module, a network attack early warning module, a behavior pattern analysis module and an access authority management module. According to the method, the network flow data is collected and analyzed in real time, the abnormal flow recognition speed and accuracy are enhanced, the security threat response speed and efficiency are improved, measures are taken in time at the early stage of a problem, the risks of data leakage and network attacks are reduced, and the timeliness of defense measures is improved by combining security threat response and network attack early warning; by analyzing the relevance between threat events, the complex multi-stage attack activity is effectively predicted and identified, the access data and the communication mode of the equipment are monitored in real time, and the access authority and the trust level are adjusted, so that the security protection is more targeted and flexible, and the management efficiency of the risk equipment is improved.

The invention provides a network malicious traffic detection and analysis method and system, and the method comprises the steps: obtaining suspected malicious traffic slice data of network traffic data according to a network traffic feature library, and carrying out the attack mode correlation analysis according to an abnormal value detection result based on the suspected malicious traffic slice data to obtain an abnormal threat level, after an initial traffic management strategy is automatically generated based on a preset inference engine, multi-dimensional feature data obtained by sequentially carrying out noise reduction on suspected malicious traffic slice data and feature extraction based on a feature engineering technology are input into a malicious traffic detection model for malicious traffic identification to obtain a suspected zero-day attack sample; and according to the zero-day attack type of the suspected zero-day attack sample, a malicious traffic prevention and control strategy is obtained for adjusting the initial traffic management strategy to generate an optimal traffic management strategy. According to the method, the change of the flow mode and the attack means can be sensed in a self-adaptive manner, the hidden attack mode is deeply mined, and the zero-day attack can be quickly and accurately identified and blocked.

The invention discloses a lightweight malicious network traffic detection method based on heterogeneous modal feature fusion, and mainly solves the problems of low feature extraction efficiency and insufficient single modal feature representation of the existing method. Comprising the following steps: acquiring and optimizing a network flow data set, preprocessing the network flow data set, and extracting and generating spatial feature, time sequence feature and behavior pattern feature vectors; an improved self-attention mechanism network is constructed, a lightweight heterogeneous modal feature fusion model LMF is designed, multi-modal feature deep fusion is performed through dynamic weight distribution, a lightweight classification model is trained, and the model is utilized to detect network malicious traffic. Through the lightweight heterogeneous modal feature fusion model LMF and in combination with a dynamic weight distribution mechanism, spatial distribution, time sequence dependence and behavior semantic information of network traffic are deeply mined, data processing efficiency, malicious traffic detection accuracy and system robustness are improved, and the method is suitable for efficient malicious traffic identification and defense in the field of network security.

The invention relates to the technical field of network security, in particular to a network security analysis method and system based on big data. Comprising the following steps: collecting related multi-source heterogeneous data of a network, and carrying out standardized processing such as cleaning and de-noising; network analysis is carried out based on the preprocessed data, network traffic is analyzed in real time by using machine learning and deep learning algorithms, and abnormal conditions are detected; constructing a risk prediction model according to a network analysis result and related information, and predicting a future network security risk level; if the risk level exceeds the threshold value, determining a security event source and a responsibility subject through data tracing; and finally, generating a safety response strategy according to risk prediction and data traceability results, and performing disposal. The corresponding system covers the modules of data acquisition, preprocessing, network analysis, risk prediction, data tracing, security response and disposal and the like, and all the modules work cooperatively to form a complete network security analysis and guarantee system, so that the stable operation of the network system is guaranteed.

The invention relates to the technical field of network security, and discloses a DDoS attack real-time detection and traceability analysis method based on a knowledge graph. The system comprises a data acquisition module, a dynamic knowledge graph construction module, a dynamic knowledge graph updating module, an anomaly detection module, an attack chain traceability module and a visualization module. Network flow data is collected in real time, a dynamic knowledge graph with a network entity as a node and a communication relation as an edge is constructed, a dynamic model is combined to analyze the node state change rate, abnormal nodes are accurately detected, and attack paths are identified and attack sources are positioned through reverse derivation and path weight optimization technologies. Visual results generated by the system support visual display and analysis of abnormal behaviors, and meanwhile, a structured report is provided, so that a manager can make a decision quickly and conveniently. According to the method, the real-time performance of DDoS attack detection, the traceability accuracy and the operability of result analysis in the complex network are improved.

A computerized method is disclosed that includes operations of obtaining network traffic data between a source device and a destination device, applying a set of one or more security rules to a plurality of metrics of the network traffic data to obtain a subset of network traffic metrics, applying a first trained machine learning model to the subset of network traffic metrics to generate a feature vector through feature extraction of the subset of network traffic metrics, and evaluate the feature vector for a presence of beaconing and classify the subset of network traffic metrics, and responsive to the classifying of the subset of network traffic metrics, generating a flag for a system administrator. The plurality of metrics include at least one or more of packet size, packet transmission rate, or a ratio of (i) packet size for inbound packets and (ii) packet size for outbound packets.

The invention relates to the technical field of server load management and dynamic resource scheduling, and discloses a server load state evaluation method based on a dynamic evaluation algorithm, which comprises the following steps: data acquisition: acquiring performance index data, log data and network flow data from a multi-modal data source of a server; data preprocessing: performing time alignment, data cleaning, feature extraction and normalization processing on the acquired data; and self-supervised learning modeling: extracting feature representation from the multi-modal data through a self-supervised pre-training task, wherein the self-supervised pre-training task comprises a time sequence covering prediction task. Through multi-modal data fusion and self-supervised learning, the dynamic characteristics of the server load are accurately extracted, real-time load classification, anomaly detection and trend prediction are realized, the evaluation precision and real-time performance are significantly improved, and at the same time, a resource scheduling strategy of rule driving and reinforcement learning is combined, the server resource allocation efficiency is optimized, and the overload risk is reduced.

A method for managing edge devices includes: monitoring network traffic between an edge device (ED), an edge node (EN), and a cloud device (CD) to obtain a first dataset; monitoring an activity performed on the ED to obtain a second dataset; analyzing the first dataset to generate a network traffic analysis output (NTAO); analyzing the second dataset to generate an activities analysis output (AAO); performing a first tagging of the ED under as either a secured devices category or an unsecured devices category based on the NTAO, AAO, and a first identifier; performing a second tagging of the ED under a corresponding unsecured devices sub-category; upon tagging the ED and based on the AAO, making a determination that the activity is a malicious activity; and implementing a security policy to disrupt a user of the ED.

The invention relates to the technical field of information security data processing, and discloses an information security analysis method and system based on big data, and the method comprises the steps: S1, collecting multi-source heterogeneous security related data which comprises a business log, a user behavior track, network traffic, an application program interface calling record, an identity authentication log and a real-time security data flow, preprocessing the collected data to obtain standardized data; and S2, performing entity identification, event extraction and relationship mining based on the standardized data, and constructing a cross-modal threat knowledge graph containing security entity nodes and associated edges. The method solves the problem of monitoring blind areas caused by lack of dynamic association mining capability among data in a traditional method, and particularly aims at distributed, low-frequency and multi-stage hidden attacks, the scheme can accurately recover an attack chain and identify high-risk threats through dynamic matching and path reasoning of a knowledge graph, and the method has a good application prospect. And the detection coverage rate and accuracy in a complex attack scene are remarkably improved.

The invention provides an industrial control network security service security guarantee system based on behavior analysis, which belongs to the technical field of industrial control network security, and comprises a multi-source data fusion acquisition module, a dynamic behavior modeling engine, a federal learning analysis cluster, an attack chain prediction module, a self-adaptive protection strategy executor and a model evolution feedback ring, wherein the multi-source data fusion acquisition module synchronously acquires industrial control network flow (including OPC UA / Modbus / DNP3 protocol analysis), equipment operation logs, user operation behavior fingerprints and physical interface state data, and the physical interface state data comprises electrical characteristic fluctuation monitoring of USB / network interfaces. According to the scheme, through multi-technology fusion and closed-loop design, the problems of static performance, single-dimension analysis defects and response lag of a traditional industrial control security scheme are effectively solved, a comprehensive protection system with dynamic modeling, intelligent decision making, privacy protection and continuous optimization is constructed, and the security and service reliability of an industrial control network are remarkably improved.

The invention discloses a network security defense method and system based on incremental network attack analysis learning. The method comprises the following steps: collecting initial network flow data, and extracting a feature vector; and collecting real-time network flow data, performing segmentation processing based on a sliding time window, extracting time sequence association features from the segmented data, and matching the time sequence association features with the feature library to identify potential attacks or abnormal behaviors. And when the time sequence correlation feature is not matched with the feature library, marking the time sequence correlation feature as a candidate novel attack feature, calculating a mahalanobis distance between the time sequence correlation feature and a known attack feature to determine the attack variability, and dynamically adjusting the weight of the time sequence correlation feature. And inputting the adjusted feature weight and the real-time flow feature into a deep reinforcement learning detection model, and generating and updating a network security defense strategy. The scheme of the invention can effectively identify novel attack behaviors, dynamically respond and optimize defense strategies, and improve network security.

Techniques for mobile network information sharing via extended Berkeley Packet Filter (eBPF) for zero trust security are disclosed. In some embodiments, a system / process / computer program product for mobile network information sharing via eBPF for zero trust security includes monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications; extracting meta information associated with the session using the agent executed on a network element in the core mobile network; sending the extracted meta information to a security platform located outside of the core mobile network; and enforcing a security policy on the session at the security platform based on the extracted meta information to apply granular-based security in the core mobile network based on a security policy.

The invention discloses a deep reinforcement learning-based network traffic optimization scheduling method suitable for periodic traffic characteristics. The method comprises the following stages: collecting historical periodic traffic data; a network state is monitored in real time through an SDN controller, and historical periodic flow data including time delay, bandwidth utilization rate and load information are acquired; data preprocessing: performing cleaning, normalization and time sequence segmentation on the collected historical traffic data; constructing an LSTM model, constructing the LSTM model by using the preprocessed historical data, and defining an input feature and an output tag; training an LSTM model, training the LSTM model by using the training set data, and generating traffic prediction data of a next period; constructing a state space, fusing the predicted traffic data with the real-time traffic data, and constructing the state space; training a DQN model, and training a deep Q network (DQN) model by using the constructed state space; network topology and link state information are obtained, the current network topology is obtained through a topology discovery module of the SDN controller, and the bandwidth utilization rate, time delay and packet loss probability information of a link are collected in real time through a flow monitoring module; large flows and small flows are distinguished; scheduling the small flow by using the ECMP; and scheduling the large flow by using the DQN model.

The invention discloses an internet data security protection method and system based on an intelligent algorithm, and relates to the technical field of security protection. During system operation, user behavior data are collected in real time through log recording, a sensor and an API interface, the real-time operation behavior of a user is monitored, the interaction mode and transaction behavior of the user on a platform are analyzed, and the security of the user is improved. Calculating and acquiring a user behavior safety coefficient Yhxw, a data transmission safety coefficient Sjcs and a risk protection response coefficient Fxfh, identifying potential fraudulent behaviors, performing dynamic risk assessment by combining user historical behaviors, a transaction amount, a geographic position and data of payment equipment, performing threshold comparison to obtain an assessment scheme, and during login and transaction, combining multiple identity verification means to obtain a risk protection result; according to the method, user identity verification is carried out, security of login behaviors is dynamically monitored, network traffic and platform logs are analyzed, abnormal access and malicious requests or DDOS attacks are detected in real time, and abnormal behaviors or attacks are automatically identified and prevented.

A network attack prediction method, device, computer equipment and storage medium are provided. The network attack prediction method includes: performing preprocessing, time series modeling and data feature analysis on the network traffic data set; dividing the network traffic data set into a normal traffic data set and an attack traffic data set; initializing parameters of the improved grey wolf algorithm; constructing a prediction model and initializing parameters of the prediction model; using the grey wolf optimizer GWO search strategy to obtain a first candidate of the optimal grey wolf; using the hunting DLH search strategy to obtain another candidate of the optimal grey wolf, selecting an optimal candidate; updating Xi(t) with the optimal candidate; judging whether to iterate to the maximum iterations; obtaining an optimal parameter combination of the prediction model and training the prediction model; obtaining an optimized convergent prediction model and identifying anomalies caused by network attacks.