57 results about "Intrusion prevention system" patented technology

A method implemented by a cloud-based system includes steps of, responsive to connecting to a user device with a user associated with a first tenant of a plurality of tenants, obtaining security policies for the user that are configured for the tenant, wherein the security policies for the user are the same regardless of connection type, location of the user, and device type and operating system of the user device; stream scanning traffic between the user device and the Internet based on the security policies, wherein the security policies are for firewall and intrusion prevention functions; and one of allowing and blocking the traffic based on the stream scanning.

An intrusion prevention system can be embedded in an industrial controller to detect possible attacks on the corresponding physical system of the industrial controller. The intrusion prevention system can analyze the payload of network packets received at the industrial controller and predict what harm the payload of the network packet could cause to the physical system if executed by the industrial controller. To predict how the payload of a network packet may affect the physical system, the intrusion prevention system can perform a simulation with the payload of the network packet. The simulation can incorporate a model of the physical system, a copy of the logic used by the industrial controller and information relating to the current state of the system. The result of the simulation can be new predicted states for the physical system that can be evaluated to determine if a safety violation has occurred.

The embodiment of the invention discloses an animal invasion prevention system and method for a transformer substation, and the system comprises a control module which controls a driving module to drive an animal in a first driving mode when determining animal invasion according to a sound signal, and determines the type of the invaded animal according to an infrared signal when the animal cannot be driven away according to the first driving mode, the distance between the invading animal and the substation equipment is determined to determine a driving mode, and the driving module is controlled to drive the animal according to the determined driving mode; and the control module also determines an escape path of the animal according to an infrared image shot by the infrared sensor after determining that the animal is driven away according to the sound signal and the infrared sensor, and controls the monitoring module to perform damage detection on the substation equipment on the escape path. According to the invention, efficient identification, intelligent driving and preventive damage detection of animal invasion behaviors are realized, electric power accidents such as short-circuit tripping caused by equipment faults are avoided, and stable operation of a transformer substation is guaranteed.

Systems and methods for monitoring network communications of low-level devices and sensors in an industrial control system (ICS) environment. A cloud-native application containerization platform allows for security visibility in the lower OT levels of the Purdue model, including by network traffic inspection in an active intrusion prevention system (IPS) mode or a passive intrusion detection system (IDS) mode.

The invention discloses an intrusion prevention system used in a meta universe environment, which relates to the technical field of information security and comprises a virtual identity verification module, a virtual asset protection module, a virtual scene integrity verification module, a behavior analysis and threat detection module, a real-time response and recovery module and a security policy management module. According to the invention, by setting a multi-layer defense mechanism, through virtual identity verification, virtual asset protection, scene integrity verification, behavior analysis and other multi-layer defense mechanisms, the system can comprehensively cover various security threats in the universe, it is ensured that a user is protected in each link in the virtual world, and AI and ML technologies are introduced at the same time, so that the security of the user is improved. The system can dynamically adapt to complex virtual interaction scenes and detect and respond to threats in real time, meanwhile, the system can continuously optimize the protection model through the self-adaptive learning function so as to cope with new attack means, and high real-time performance and self-adaptability are achieved.

The invention provides an exception handling method and device, which are applied to the technical field of network security and are used for improving the security performance of an intrusion prevention system. The method comprises the steps of detecting whether an abnormal log appears in logs of the heterogeneous redundant system, and if yes, obtaining the abnormal log; the abnormal log is used for indicating that a novel attack which cannot be intercepted by an intrusion prevention rule appears in the heterogeneous redundant system; extracting flow information and session information related to the attack from the abnormal log; the flow information and the session information are input into a rule model, feature extraction is conducted on the flow information and the session information through the rule model, a first rule is generated based on the extracted features, and the first rule is used for intercepting the novel attack; and updating an intrusion prevention rule of the heterogeneous redundant system based on the first rule.

The invention aims to provide a method and equipment for identifying a complex attack combination, and the method specifically comprises the steps: obtaining the target security event information of vehicle equipment about an intrusion protection system, and enabling a security attack corresponding to the target security event information to comprise a target attack sequence composed of a plurality of attack units; identifying the security event information according to the attack detection database, and determining whether the target attack sequence is the same as or similar to an attack template stored in the attack detection database; and if not, determining that the target attack sequence contained in the target security event information is a complex attack combination. According to the method, the security event information of the intrusion protection system in the vehicle equipment is identified through the attack detection database, and the complex attack combination in the security event information is determined, so that the protection capability of the intrusion protection system is improved, and a better safe driving environment is provided for a driver.

The invention discloses a decentralized robot cluster anti-intrusion system and method, and the method is characterized in that the decentralized robot cluster anti-intrusion method comprises the following steps: a plurality of robot entities and sensing equipment jointly form a decentralized network without a central server, all the devices in the network record a unified state log together and are used for updating state information of all the robots and the devices in the network in real time; before communication between robot entities is carried out, one-time identity verification is carried out through a short-distance physical channel, and a temporary session key is generated; when any one robot entity needs to declare or update the own state, verifying the authenticity of the physical state declared by the robot entity by executing a state proving protocol; according to the method, a decentralized directed acyclic graph network architecture is adopted, all robot entities maintain state logs together, and the single-point fault risk of a traditional centralized server is thoroughly eliminated.

The invention relates to the technical field of network security, in particular to a network security data analysis method and system based on a large model and a medium. According to the technical scheme, the network security data analysis method based on the large model comprises the following steps: acquiring a multi-source heterogeneous log in real time from a firewall, an intrusion detection system or an intrusion prevention system, a Web application firewall, a server operating system and a service application through a distributed acquisition agent; performing data cleaning on the original log: removing repeated entries, filling missing fields, unifying a timestamp format, and extracting key structured fields including a source IP address, a target IP address, an operation type and a user ID; and performing deep semantic analysis on the cleaned log by using a pre-training large model based on a Transform architecture, and generating vectorized feature representation fused with context semantics. The semantic understanding accuracy of security terminologies is remarkably improved, and the misjudgment defect caused by domain knowledge deficiency of a traditional model is thoroughly overcome.

A method of providing cloud-based security services includes receiving, at one or more distributed processing nodes in a cloud-based system, network traffic from a plurality of endpoints associated with at least one tenant; applying, by each distributed processing node, at least one cloud-based security inspection function configured to detect threats or enforce policy controls in the received network traffic; determining, via a policy engine whether to block, allow, or further analyze the network traffic based on per-tenant security policies; logging, in a cloud-based logging repository, inspection results, policy decisions, and rule matches for subsequent reporting and analytics; and updating the security inspection function at the distributed processing nodes, in real time, with newly discovered threat signatures and policy changes to provide continuous protection across the cloud-based system.

To provide an entry prevention system with improved convenience.SOLUTION: An entry prevention system comprises: an entry prevention fence 30 capable of being switched between a locked state and an unlocked state; a determination unit for determining whether a person who is going to pass through an entrance door to a specific area is an adult or a child; an entry prevention control unit capable of switching processing between entry prevention stop processing to place the entry prevention fence 30 in the locked state and entry prevention execution processing to place the entry prevention fence 30 in the locked state and switch the entry prevention fence 30 to the unlocked state when the determination unit determines that the person is an adult, or to maintain the locked state of the entry prevention fence 30 when the determination unit determines that the person is a child; a work detection unit 20 for acquiring information related to an action in the specific area; and a specific action detection unit for detecting that a specific action is being performed in the specific area. The entry prevention control unit executes the entry prevention execution processing when the specific action has been detected, and executes the entry prevention stop processing when the specific action has not been detected.SELECTED DRAWING: Figure 1

The application relates to a rule-matching-based intrusion prevention system adaptive protection method and device. Three table items, a blacklist table, a whitelist table and a shunting table, are embedded in the data processing flow of a rule-matching-based NIDS system, and the three table items are provided with strategies for addition and deletion, so that the system can discard and release some high-concurrent-connection-causing traffic in advance in the early stage of traffic processing based on the original data processing flow, relieve the processing pressure of the system, and effectively solve the system abnormality problem caused by high-concurrent-connection. Compared with the prior art, the application has the remarkable advantages that the system abnormality problem caused by high-concurrent-connection can be effectively solved without affecting the original flow.

The invention belongs to the technical field of network security, and particularly relates to a cloud platform security network architecture which comprises an edge protection layer, a flow scheduling layer, a dynamic isolation layer, an encryption storage layer and a security control center. The edge protection layer realizes traffic abnormity identification through intelligent firewall group dynamic strategy cooperation and a behavior perception intrusion prevention system; the traffic scheduling layer drives load balancing by using a transfer learning algorithm fused with spatio-temporal characteristics; the dynamic isolation layer generates an access control rule based on the SDN micro-segmentation firewall according to the topology change; the encryption storage layer optimizes SM9 encryption through a regional key management cluster; and the safety management and control center realizes global risk management and control based on situation awareness and hierarchical response. According to the invention, the problems of insufficient cross-domain dynamic protection, contradiction between encryption efficiency and security and the like in a traditional scheme are solved, a full-chain collaborative protection system from traffic access to security management and control is formed, and the security, continuity and intelligent management and control level of cross-domain services of a cloud platform are improved.

The invention provides a hydropower station flood discharge affected zone intrusion prevention system based on unmanned aerial vehicle inspection. Comprising the steps of system and platform connection, task planning and route selection, unmanned aerial vehicle take-off and real-time monitoring, target identification and processing, task ending and data processing and the like. And the unmanned aerial vehicle management and control platform and the client are connected through the private local area network to realize secure transmission and sharing of data. The system provides a preset route library and an on-site planning function, and diversified inspection requirements are met. And the unmanned aerial vehicle takes off autonomously according to a preset route, acquires video data in real time and returns the video data to the control platform. And the AI recognition system analyzes the video in real time, recognizes an abnormal intrusion target and triggers an early warning process. And after the inspection task is finished, the unmanned aerial vehicle automatically returns, and the management and control platform integrates the inspection data to generate an inspection report. Efficient, safe and intelligent inspection of the unmanned aerial vehicle is realized, and the inspection efficiency and accuracy of industrial places such as power plants are improved.

An intrusion prevention system, computer-implemented method, computer system and computer program for protecting a network are provided. The system comprises one or more intrusion detection systems. The system further comprises a packet analyser for routing packets within the network that are received from another work. The packet analyser is configured to: receive a packet destined for a computer system within the network; extract one or more features relating to the packet; use a classification model to determine whether the packet is malicious based on the extracted features; prevent delivery of the packet to the computer system in response to determining that the packet is malicious; and deliver the packet to at least one of the intrusion detection systems in the absence of a determination that the packet is malicious. The one or more intrusion detection systems are configured to provide a notification to the packet analyser of any packets that they determine to be malicious. The packet analyser is further configured to train the classification model based on the notification from the one or more intrusion detection systems.

The invention belongs to the field of network security monitoring, and particularly relates to a network intrusion path modeling method and system based on artificial intelligence, and the method comprises bait flow isolation, intrusion prevention and encryption prevention. According to the scheme, a lightweight path agent mechanism is adopted, a prediction path is constructed, path agent nodes are reused, key paths instead of nodes of the whole network are selectively monitored, memory and calculation overhead are remarkably reduced, temporary fluctuation and real attacks are effectively distinguished in combination with an exponential smoothing prediction and voting mechanism, malicious node recognition precision is improved, and malicious node recognition efficiency is improved. High-precision intrusion detection and self-adaptive fault tolerance in a resource-constrained environment are realized; a high-frequency rule priority matching mechanism is introduced, a linkage mechanism of a firewall, an intrusion detection system and an intrusion prevention system is constructed, invalid traffic is intercepted, attacks are traced, an authorized node safely obtains a secret key based on a standardized API interface, the protection efficiency is remarkably improved, and the data transmission safety and the secret key management convenience are enhanced.

This invention discloses a deep learning-based drone intrusion prevention system, comprising the following modules: a data acquisition module for acquiring and preprocessing real-time monitoring data; a target detection and localization module for identifying and localizing drone targets using an improved RTMDet target detection algorithm; a drone behavior prediction module for time-series modeling using the Mamba model; an intrusion behavior determination module for determining whether intrusion criteria are met using preset rules; a multimodal data fusion module for fusing data from different sensors; a threat assessment module for threat assessment using an improved DETR model; a countermeasure selection and execution module for selecting and executing matching countermeasures based on threat levels; and a feedback and monitoring module for monitoring the effectiveness of countermeasures and adjusting strategies in real time. This invention combines deep learning models and multi-sensor data fusion to effectively improve the accuracy and robustness of the drone intrusion prevention system.

The application provides a method and device for deploying an IPS rule and a processing device, which are used for ensuring that an IPS rule is deployed on a target network device more stably and conveniently. The method for deploying an IPS rule provided by the application comprises the following steps: obtaining a target IPS rule which is to be deployed on a target network device; analyzing the target IPS rule and compiling the target IPS rule into a target state machine; and deploying the target state machine in the memory of an IPS rule library of the target network device, so that the target network device loads the rule content of the target IPS rule.

The invention discloses a communication system and equipment applied to network security. The communication system comprises terminal equipment, network relay equipment, a communication optical cable and a server, the terminal equipment is an upper computer, and a firewall and an intrusion prevention system are arranged on the terminal equipment; the network relay equipment comprises a switch and a router, and the switch and the router are used for forwarding electric (optical) signals; the invention relates to the technical field of communication systems, a highly integrated structure is adopted, a firewall and an intrusion prevention system are arranged on a terminal device and a server, an optical cable data protection unit is integrated on one side of the server, the optical cable data protection unit is used for remotely monitoring an optical cable, data stealing is avoided, and the communication efficiency is improved. Aiming at the optical cable data stealing means at the present stage, whether the optical cable data is stolen or not is detected by depending on the on-off condition of the optical cable and attenuation of optical fiber signals, and then the optical cable data is protected through the protection structure, so that the network security is improved.

A computer-implemented method for detecting control plane intrusions in a communications network, comprising: accessing a list of pre-defined traffic signatures, each traffic signature representing a non-malicious control plane network traffic pattern; monitoring network traffic within the control plane; comparing the monitored network traffic to the list of pre-defined traffic signatures to determine whether the monitored network traffic matches any signatures in the list of pre-defined traffic signatures; responsive to determining that the monitored network traffic does not match any signatures in the list of pre-defined traffic signatures, classifying the monitored network traffic as a potential security risk.

The invention discloses an intrusion prevention system, operation and maintenance management equipment and a traffic anomaly detection method thereof. The traffic anomaly detection method comprises the following steps: acquiring to-be-identified traffic data; the traffic anomaly detection model trained by the method is used to identify the traffic data to be identified, and the abnormal event corresponding to the traffic data to be identified is identified, and the abnormal event comprises a network attack.

Systems and methods for enhancing API security by identifying anomalous activities in a cloud environment are provided. In one example, the lack of awareness of an external API with respect to how calls to the external API may affect a cluster of a container orchestration platform is addressed. For instance, the views of the external and internal APIs may be combined to achieve better API security by correlating external API calls with undesirable behavior or other anomalies arising in the internal API. Responsive to identifying such undesirable behavior, information (e.g., a host, a source IP, a user, a specific payload) associated with the offending external API call may be added to a network security feature (e.g., a deny list, an IPS, or a WAF) utilized by the external API to facilitate performance of enhanced filtering of subsequent external API calls by the external API on behalf of the internal API.

The embodiments of the present application disclose a service request processing method, device, storage medium and electronic device, the method comprising obtaining a first service request message representing a normal service request, and a second service request message representing a malicious service request; performing difference extraction processing on the first service request message and the second service request message to obtain first difference data; generating an intrusion defense strategy based on the first difference data, the intrusion defense strategy is used to defend against the malicious service request in a website application-level intrusion defense system. The embodiments of the present application can automatically generate an intrusion defense strategy, which can be applied to an application-level intrusion defense system, thereby ensuring the communication security of data in many application scenarios such as Internet of Vehicles, blockchain, and network security.

The embodiment of the present application relates to the technical field of computer network, and discloses a host compromise detection method, device and equipment, the method is applied to a firewall, comprising: obtaining the service traffic of a to-be-detected host; performing feature extraction on the service traffic of the to-be-detected host to obtain feature information of the service traffic of the to-be-detected host; matching the feature information with a compromise feature library, and in the case that the feature information matches the compromise feature library, determining that the to-be-detected host is a compromised host, wherein the compromise feature library comprises an intrusion prevention system (IPS) feature library and / or a virus feature library. The technical scheme of the present application can improve the detection accuracy of the compromised host.

The invention discloses a host security risk vulnerability visual management system, which relates to the technical field of network host security, and adopts the technical scheme that the host security risk vulnerability visual management system comprises a host security vulnerability management system, and the output end of the host security vulnerability management system is connected with a host security vulnerability detection system; the output end of the host security vulnerability detection system is connected with a host security vulnerability risk monitoring and analysis system, the output end of the host security vulnerability risk monitoring and analysis system is connected with a host dangerous vulnerability alarm system, and the output end of the host dangerous vulnerability alarm system is connected with a security vulnerability intrusion protection system. The output end of the security vulnerability intrusion protection system is connected with a security vulnerability patch repair system, and the output end of the security vulnerability patch repair system is connected with a security vulnerability disposal system. And after retest is completed, the host can be retested, so that vulnerability residues are prevented.

A computer-implemented method for detecting control plane intrusions in a communications network, comprising: accessing a list of pre-defined traffic signatures, each traffic signature representing a non-malicious control plane network traffic pattern; monitoring network traffic within the control plane; comparing the monitored network traffic to the list of pre-defined traffic signatures to determine whether the monitored network traffic matches any signatures in the list of pre-defined traffic signatures; responsive to determining that the monitored network traffic does not match any signatures in the list of pre-defined traffic signatures, classifying the monitored network traffic as a potential security risk.

The present invention provides a wireless airspace intrusion prevention system, method and device. Among them, the system includes: a monitoring subsystem for performing wireless environment monitoring on the wireless airspace of a target proprietary network host to obtain wireless monitoring data; a data analysis subsystem for analyzing key features in the wireless monitoring data; a threat identification subsystem for attempting to identify intrusion behaviors according to the key features; and a defense response subsystem for automatically adjusting defense strategies according to the behavior changes of the intrusion behaviors if the attempt to identify the intrusion behaviors is successful. The wireless airspace intrusion prevention system, method and device of the present invention perform wireless environment monitoring on the wireless airspace of a target proprietary network host to obtain wireless monitoring data, extract key features in the wireless monitoring data, identify intrusion behaviors based on the key features, and adaptively adjust defense strategies according to the changes of the identified intrusion behaviors, improving the network security of the proprietary network and reducing losses.

The present invention provides a wireless intrusion prevention system, a wireless network system including the system, and an operating method for the wireless network system. The wireless intrusion prevention system includes: an access point; multiple terminals that transmit wireless frames to or receive wireless frames from the access point via a wireless network; and a wireless intrusion prevention system that monitors the wireless frames. The wireless intrusion prevention system transmits a connection release request to a specific terminal among the multiple terminals and prevents the access point from responding to the specific terminal.

Disclosed is a multilayer deception defense system for cyber threat detection and response. The disclosed multilayer deception defense system according to an embodiment comprises: a real network; a deception network corresponding to the real network; and a monitoring and response system for monitoring and responding to a cyber attack on one of the real network or the deception network. The real network includes a firewall, an intrusion prevention system, an intrusion detection system, and a real system. The real system includes a deception token, a honey credential, an application layer, an application log, a database, and a web server. The deception network includes a honey pot, an intrusion prevention system, an intrusion detection system, and a honey pot system. The honey pot system includes a deception token, a honey credential, an application layer, an application log, a database, and a web server.

This invention discloses a layered adaptive network intrusion prevention system and method for resource-constrained edge computing scenarios, comprising: an edge rapid perception layer that collects multimodal data, quickly screens it, and generates structured natural language descriptions; an edge intelligent judgment layer that receives the structured natural language descriptions, performs semantic reasoning through a dynamically fine-tuned large-scale language model, and outputs threat judgment results; a fog-layer regional collaborative aggregation layer that acquires de-identified information generated from the threat judgment results, performs privacy-preserving aggregation and correlation analysis, and outputs regional threat reports and high-value samples; and a cloud-based cognition and evolution layer that generates synthetic threat data based on high-value samples, performs quality control screening, fine-tunes the screened data to obtain new adapters, and distributes them to the edge intelligent judgment layer. This invention achieves adaptive detection, privacy protection, and continuous evolution in resource-constrained environments, improving the defense capability against unknown attacks.