3683 results about "Ip address" patented technology

The invention discloses a network security threat research and judgment method, system and device and a storage medium, and the method comprises the following steps: S1, obtaining network traffic, terminal logs, application program interface calling records and threat intelligence data in real time, carrying out the standardized cleaning and format conversion of the data, and building a unified data lake; s2, matching, identifying and determining threats through a preset known threat feature library, constructing a normal behavior baseline by using an unsupervised learning algorithm, and marking suspicious events deviating from the baseline; s3, for the suspicious event marked in the step S2, mining a potential attack path and an attack intention by combining knowledge graph technology associated asset information, a historical attack chain and a homologous IP address; and S4, based on the attack success probability, the influence asset importance and the diffusion speed, calculating a threat level by adopting a fuzzy comprehensive evaluation model, and generating a research and judgment report containing disposal suggestions.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system, and the method comprises the following steps: extracting a source IP address and a target IP address based on a network behavior record, carrying out the statistics of the number of used ports, the transmission direction and the time interval value, analyzing the direction change times and the time interval difference, and screening abnormal communication pairs. And generating an abnormal communication pair set. According to the invention, through analyzing port usage, transmission direction and time interval value, deeply mining communication features, screening abnormal communication pairs and improving identification accuracy, dividing a time sequence window, analyzing rate fluctuation and frequency distribution, locking an unstable time window, combining with a multi-dimensional data classification behavior mode, and extracting a switching path and priority, a multi-dimensional data classification behavior mode is combined. Potential threat paths are identified independently, global threat situations are identified through node interaction relation statistics and correlation analysis and an expansion range, threat assessment precision and efficiency are enhanced, and comprehensive and reliable risk protection capability is provided for network managers.

The invention relates to a network attack tracing method, system and device based on a user portrait, and a medium. The attack tracing method comprises the following steps: collecting interactive behavior data of a user in a Web page; performing compression and serialization processing on the interaction behavior data to generate a structured interaction log file; collecting fingerprint data of the user terminal and performing standardization processing to generate a fingerprint feature vector; based on the structured interaction log file and the fingerprint feature vector, generating a user unique identifier containing a risk level tag; performing clustering analysis on the interaction behavior data according to the unique identifier of the user, identifying an abnormal behavior mode of the abnormal user and marking an attack type; acquiring a public network IP address of an abnormal user, and positioning a geographic position in combination with an IP database; and constructing an attack traceability report based on the user unique identifier of the abnormal user, the abnormal behavior mode, the public network IP address and the geographic position. According to the invention, the user portrait can be accurately constructed, and the network attack behavior can be effectively identified and traced.

The invention belongs to the technical field of communication transmission, and discloses a PLC networking data acquisition system and method based on an edge gateway, and the system comprises a dynamic virtual isolation module which is used for identifying and classifying different PLC devices through the deployment of an SDN controller and the adoption of a deep packet inspection technology, automatically distributing the different PLC devices to a virtual subnet, and obtaining a virtual IP; each virtual subnet isolates the PLC equipment with the same IP address through a virtual switch and a virtual router; recording the virtual IP and actual physical network port information of the PLC equipment through a mapping table, and establishing a network topology view; the multi-protocol analysis module is used for connecting the edge gateway and the PLC equipment based on a network topology view, carrying out protocol analysis by integrating a PLC communication protocol library and adopting FPGA hardware acceleration, and reading PLC networking data from the PLC equipment in real time; and the flexibility and the expandability of data acquisition can be improved.

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

In a cloud computing environment, a cross-tenant access security measure monitors conditional access policies for changes or additions that hamper or threaten an authorized access from an assistant tenant user to a focus tenant. Some cross-tenant access security tracks role assignments to detect rogue roles, or detect hampering role changes. In some cases, focus tenant events and assistant tenant events are correlated in an audit. In some cases, the authorized access is a zero standing time bound access. In some cases, the authorized access is constrained to an IP address range, or constrained to login from a managed device, or both. In some cases, assets are excluded from managed response remediation actions. In some, managed response is modulated by product-specific Role Based Access Control. In some, repeated logins are avoided, to permit faster managed responses.

Methods and systems for providing network connectivity are disclosed. In an embodiment, a method for providing network connectivity involves receiving from a Mobile Network Operator (MNO) an access ID, an IP address, and an Access Point Name (APN) at a SASE domain, wherein the access ID, the IP address, and the APN correspond to a wireless device, updating IP address-to-tenant mappings at the SASE domain in response to the access ID, the IP address, and the APN, and forwarding traffic received at the SASE domain from the wireless device via the MNO according to the updated IP address-to-tenant mappings.

The invention provides a cloud platform docking service implementation method, system and device based on an adaptation layer and a medium, belongs to the technical field of cross-platform resource management and service integration, and particularly relates to a method for configuring an adapter for each cloud platform and mapping an API (Application Program Interface) of the platform to a standard RESTful API interface; performing standardization processing on interface return formats of different cloud platforms through a data conversion module, converting a heterogeneous format into a unified format, and outputting a unified data format; packaging and abstracting services of different cloud platforms; identity authentication is realized by randomly generating a secret key in cooperation with an encryption and decryption algorithm, and a verification mechanism of a source request IP is preset; and recording an operation log and an error log in the docking process, and recording an interface calling frequency, a requester IP and error information of an abnormal logic node. According to the method, the adaptation layer is introduced, the isomerism of the bottom cloud platform is shielded, and unified interfaces and services are provided, so that efficient and flexible cloud platform docking is realized.

The invention discloses an aggregation analysis method for whole-network file and external black and grey production detection. The method comprises the following steps: S1, collecting original data related to black and grey production and generating structured log data; s2, constructing a heterogeneous graph containing multiple types of nodes such as files, IP addresses, domain names and accounts; s3, constructing node feature vectors and fusing node type information; s4, inputting a heterogeneous graph neural network to extract node cross-type aggregation features; s5, inputting the adaptive multi-channel graph convolutional network, and combining the structure attention and the attribute attention to generate a high-order semantic representation of the node; and S6, based on the semantic residual error and the path structure, reasoning and identifying a high-risk node and a propagation path map thereof. According to the method, graph neural modeling and behavior path reasoning capabilities are fused, and the method is suitable for black-gray link detection and abnormal node identification tasks in a large-scale network environment.

The invention provides a cross-platform network speed measurement and adaptive path switching method and device and a storage medium. The method comprises the following steps: receiving a target domain name and a multi-source DNS server list; extracting historical network quality data corresponding to the environment identifier and each candidate IP address, inputting the historical network quality data into a link quality prediction model to obtain a prediction score of each candidate IP address, and screening according to a preset threshold to obtain a target IP subset; performing active detection of limited times on each IP address in the target IP subset to obtain a detection index; calculating the comprehensive score of each IP address based on the prediction score and the detection index, determining the optimal IP address with the highest comprehensive score, and recording the DNS server address of the optimal IP address; and establishing a network connection path according to the optimal IP address, and providing a DNS server address of the optimal IP address for a service layer. According to the method and the device, the cross-platform maintenance cost can be reduced, the real-time performance and the performance overhead are considered, the path is dynamically optimized, and rapid connection switching is realized.

The invention relates to the field of network security, and discloses a problem line determination method based on IP address classification and identification, which comprises the following steps of: collecting public network IP behavior data in a network flow log, extracting multi-dimensional characteristics such as a time regularity entropy value, a protocol diversity proportion, target port dispersity and a request rate change rate, and determining a problem line according to the extracted multi-dimensional characteristics; constructing an IP association graph fusing feature similarity, time synchronism and physical position constraints; an abnormal IP group is identified by adopting a community division algorithm, and the detection sensitivity is adaptively optimized according to a real-time network load and a historical false alarm rate in combination with a dynamic threshold adjustment mechanism based on a PID feedback control model; the attack type is judged through protocol-port mapping and Mahalanobis distance statistics, alarm information containing an abnormal IP list, a time window and a classification result is generated, and the alarm information is linked with safety equipment to execute a defense strategy. According to the method, the defects of a traditional method in the aspects of multi-dimensional attack recognition, dynamic environment adaptation and cooperative attack detection are overcome.

The invention discloses a door lock and card cooperative processing method and system, and the method comprises the steps: triggering a robot calling process according to preset times of doorbell button operation detected by a first door lock and read neighbor RFID card information, verifying a matching result of an RFID card and a resident registration form, and generating an authority verification passing signal; calculating a target multicast address based on the ID number of the RFID card, and converting the ID number of the RFID card into a false source IP address to obtain a communication parameter set; sending an IGMPv3 report message to the router according to the communication parameter set; according to the triggering operation of the same RFID card detected by the assisted second door lock, an assistance multicast request message is generated, the (S, G) forwarding table item is matched through the router and forwarded to the first door lock, the first door lock sends an assistance confirmation message to the second door lock, and robot calling authorization is completed. By utilizing the embodiment of the invention, efficient, safe and low-delay cross-door-lock cooperative operation can be realized.

The present disclosure relates to: a communication technique for a 5G communication system for supporting a higher data transmission rate higher a 4G system; and a system therefor. According to an embodiment of the present disclosure, a method for a first network node in a wireless communication system may be disclosed, the method comprising the steps of: receiving, from a second network node, a policy and charging control (PCC) rule and fully qualified domain name (FQDN)-based information that indicate any one of traffic detections via DNS message reporting or a DNS resolution; generating a DNS message processing rule on the basis of the FQDN-based information; transmitting the DNS message processing rule to a third network node; and receiving, from the third network node, an FQDN and an IP address for the FQDN, wherein the FQDN and the IP address are identified by the third network node via detection of a DNS response message on the basis of the DNS message processing rule.

The invention provides an access control method and system based on multi-type intelligent locks and a storage medium. The mobile intelligent lock sends an intelligent door lock ID to the community access control by responding to close-range contact between the mobile intelligent lock and the community access control; the intelligent door lock and the community access control are registered in the lock management platform; the mobile intelligent lock records a corresponding intelligent door lock ID; sending a door lock IP address request message to the lock management platform according to the community access control; the request message comprises an intelligent door lock ID; the lock management platform determines an intelligent door lock IP address according to the door lock IP address request message and returns the intelligent door lock IP address to the community access control; a face image carrying the mobile intelligent lock is obtained through a community access control, a verification message is sent to the IP address of the intelligent door lock, and the community access control is controlled to be opened according to a verification result. Compared with the prior art, the access control system facilitates access of community members, and meanwhile, the access control system does not need to retain face features of each family member, so that privacy is protected.

The invention relates to the technical field of network security, in particular to a non-cooperative network attack tracing method based on multiple stages. The method comprises the following steps: providing security verification for network equipment and a terminal in a traceability process based on a collaborative authentication code, and ensuring credibility and integrity of the traceability process; converting the network attack into behavior feature data based on the feature extraction of the attack behavior; extracting event-level features, revealing a sequential relationship and a dependency relationship of attack behaviors, and identifying a potential attack mode; performing time alignment on the events by using causal analysis to form a standardized causal chain; performing multi-dimensional feature fusion in combination with a Transform network and an NLP pre-training model, and identifying an attack mode; an IP address database, a self-built organization library and a code author library are combined, and a multi-cascade CNN structure is adopted to carry out attack source positioning and attacker tracing. According to the invention, through multi-level feature analysis, accurate identification and traceability of complex network attacks are realized.

The invention discloses a server network card test method, system and device and a medium. The method comprises the following steps: creating a plurality of network namespaces in a server; mapping physical network cards of the server to different network namespaces respectively; creating one or more pairs of veth virtual network cards among different network namespaces; network parameters are configured, an IP address is configured in each network namespace, and a routing rule is established; a bandwidth test is executed, large-flow data packets are sent among different network namespaces, the throughput rate of data transmission is measured, and the actual bandwidth performance of the network card is calculated; recording the parameters of the data packet in the test process, and analyzing the performance bottleneck of the physical network card; and outputting a bandwidth test report according to the recorded and analyzed data. According to the method, the network card is isolated by using the network namespace in the single server, and the virtual network card is used for realizing data forwarding to complete the bandwidth test of the network card, so that an additional server is not needed, the test cost is remarkably reduced, and the test efficiency is improved.

The present invention discloses an IP generation method, device, equipment and medium, and relates to the technical field of EOPS printing system, so as to solve the technical problem of low reliability and stability of network environment in existing EOPS printing scenarios. The method includes obtaining basic data of node devices for which IP addresses are to be generated; generating hash seeds according to unique identification numbers and network port MAC addresses; performing hash calculations based on hash seeds to obtain hash values; mapping hash values ​​to preset IP address ranges to obtain initial IP addresses; performing IP address conflict detection on the initial IP addresses based on the ARP protocol; when there is a conflict in the initial IP address, increasing the generation data of the hash seeds by preset values ​​in sequence, and generating new IP addresses based on the hash seeds with the increased preset values, until the new IP addresses do not conflict with the IP addresses of other node devices, and obtaining the target IP address. The IP generation method provided by the present invention is used to avoid conflicts between the generated IP addresses and other devices, and improve the reliability and stability of the network.

A secure web gateway for a cloud computing environment comprises a data plane component, comprising: a front-end domain name service (DNS) configured to receive an inbound DNS request and map an IP address of the DNS request to a policy identification value corresponding to a customer policy and a plurality of plugin modules utilized by the front-end DNS to process the DNS request according to the mapping of the IP address from which the DNS request originates to the policy identification value. The secure web gateway further comprises a control plane component that provides the customer policy to the front-end DNS and configures the IP address to permit access to a DNS service according to the customer policy.

The invention discloses a non-contact cooperative scheduling door opening method and system based on an intelligent lock platform, and the method comprises the steps: searching an owner APP-ID which can be currently accessed by a visitor APP-ID according to an unlocking request message and a visitor information table; if the number of the owner APP-IDs which can be accessed currently does not exceed the preset number, the unlocking request message is forwarded to the owner APP which can be accessed currently according to the IP address of the mobile phone where the owner APP-IDs are located; the NFC-ID in the mobile phone message is read according to the door lock, the APP-ID of the visitor and the IP of the mobile phone are searched, and whether the APP-ID of the visitor is within the access validity period or not is judged; if yes, the door lock IP address is searched, the door lock IP address is put into the door lock reading mobile phone message, and the current first door lock reading mobile phone message is forwarded to the corresponding owner APP, so that the owner APP dispatches the corresponding door lock to open the door. By utilizing the embodiment of the invention, a more efficient, safer and more convenient access management scheme can be provided.

The invention discloses a text and image fused online comment toxicity detection and filtering method and system, and relates to the technical field of natural language processing, and the method comprises the steps: extracting a semantic vector of a comment text through a RoBERTa-Marge model; the visual features of the image are extracted through an OfficientNet-V2 model; aligning heterogeneous modal features by adopting a double-flow contrast loss function; self-adaptive decision making of culture sensitivity: loading a regional sensitive rule table according to a user IP address, and dynamically adjusting symbolic semantics; calculating an intimacy correction factor based on the social relationship between the publisher and the receiver; and performing context weighted toxicity scoring, calculating a user historical behavior weight, and outputting a final toxicity probability. According to the method, a deep dynamic mapping mechanism of text and visual features is constructed, heterogeneous features are extracted through RoBERTa-Large and OfficientNet-V2 double-flow architectures, semantic space alignment is forced by utilizing comparative learning, and the problem of image-text splitting detection in the traditional technology is solved.

The invention discloses a network security detection system and method based on machine learning, and relates to the technical field of network security. Through multi-dimensional behavior feature fusion and risk assessment, the input speed, error rate and mouse track behavior data are collected in real time according to an event monitoring technology, and in combination with the staying duration and path jump features of a browsing stage, the network security detection system and method based on machine learning are obtained. And space-time alignment and depth feature embedding are realized by using a multi-modal feature fusion model, a uniquely mapped user portrait is generated, and the limitation of traditional static voucher verification is broken through. A fingerprint proofreading block is constructed through an IP address and equipment information, matching degree verification is carried out on the fingerprint proofreading block and a historical credible library, and behavior feature baseline threshold analysis is combined, so that double risk assessment of a hardware environment and an operation behavior is realized, and the anomaly recognition accuracy is remarkably improved. The dynamic evolution of the potential associated risk user scale is tracked in real time, and quantitative early warning and active prevention and control of risk diffusion are realized in combination with historical data analysis.

The invention discloses an optimal service discovery method based on explicit multicast assistance, a medium and equipment. The method comprises the steps that a user side obtains an IP address list of a target server through DNS query and caches the IP address list; based on the real-time network topology, generating a shortest path tree from a user side to all target servers by using a Dijkstra algorithm; an explicit multicast message with a head carrying a target IP list is constructed, and the intermediate router splits the message into unicast or sub-multicast messages according to a next-hop interface; and the user side determines the optimal server by monitoring the first effective response message. According to the method, traditional multicast addresses are replaced by explicit multicast, address resources are saved, network repeated traffic is reduced, meanwhile, dynamic path tree optimization and an intelligent message splitting mechanism are combined, service discovery delay is remarkably shortened, the method is suitable for high-concurrency scenes such as a distributed CDN, the Internet of Things and video live broadcast, bandwidth consumption is effectively reduced, and service reliability is improved.

The invention relates to the technical field of data security, and particularly discloses a real-time data desensitization method and system based on context awareness, and the method comprises the steps: intercepting an HTTP / HTTPS request through a gateway, and extracting a user authentication token, URL parameters, an IP address, a timestamp and request body data in a request header; analyzing user role information based on the user authentication token, extracting access environment characteristics based on an IP address and a timestamp, and performing sensitive field identification and grading on request volume data to determine a data sensitive level; according to the user role information, the access environment characteristics and the data sensitivity level, matching a predefined desensitization strategy template through a rule engine, and generating a real-time desensitization strategy containing a field-level desensitization instruction; verifying the access authority based on the user authentication token, and dynamically adjusting the desensitization degree in combination with the access environment characteristics; and according to the real-time desensitization strategy and the desensitization strength, performing real-time desensitization processing on the sensitive fields in the corresponding data.

The invention discloses a data processing method and device and a nonvolatile storage medium. The method comprises the following steps: collecting a plurality of network data packets forwarded by a plurality of network nodes in a cloud platform of a private network; in the plurality of network data packets, counting the amount of data sent by each application program under the same source IP address within a preset time range; acquiring application priority information and application load information of each application program under the same source IP address, and determining an application score of the application program; and obtaining a load index of the network node at the target moment, and under the condition that the load index is greater than a preset threshold value, performing shunting processing on target traffic corresponding to the target application program under the target source IP address forwarded by the network node. According to the method and the device, the technical problems that the route for forwarding the data request of each access unit to the exclusive cloud is not reasonable enough and the efficiency is low due to the lack of an effective node load monitoring mechanism and a dynamic routing adjustment strategy are solved.

Examples of the present disclosure describe systems and methods for zero trust domain name system (DNS) (ZTDNS) based networking. A computing device implementing ZTDNS based networking blocks any outbound connections that are not included in a list of trusted IP addresses. The list of trusted IP addresses is updated in response to the computing device receiving from a trusted DNS server an IP address corresponding to a DNS request. In some examples, the ZTDNS based networking intercepts and evaluates outbound communications for applications that implement a custom application DNS client. In other examples, the ZTDNS based networking intercepts and evaluates outbound communications for virtual environments. The outbound communications for both the custom application DNS client and the virtual environments are proxied through a local DNS client of the computing device.

The invention relates to the technical field of security vulnerability analysis, in particular to a big data-based security vulnerability management method, which comprises the following steps of: constructing a real-time data acquisition strategy, capturing an internal source network equipment log, a server running state and application system flow data through a distributed log collection component, and storing the internal source network equipment log, the server running state and the application system flow data; meanwhile, vulnerability information of the exogenous threat intelligence platform is synchronized through an API interface; constructing a dynamic risk assessment model, and updating the risk assessment of the security vulnerability in real time by taking the four-dimensional model [IP address, service type, port number and software version] as a reference; and triggering a response strategy according to risk value grading, wherein the response strategy comprises automatic isolation of high-risk equipment, dynamic configuration of firewall rules and generation of a repair work order. According to the invention, through the synergistic effect of real-time data acquisition, dynamic asset modeling, intelligent risk assessment, a hierarchical response mechanism and a closed-loop verification system, the accuracy, efficiency and defense capability of security vulnerability management are significantly improved.

A system and associated methods provide solutions for end-to-end privacy and per-hop routing and policy decision in multi-hop and Software-Defined Wide Area Networks (SD-WANs) by leveraging unique SDWAN edge identities of edge devices. The system enables end-to-end encryption between traffic source and destination sites using IPsec ESP tunnel mode, with System IPs as the outer IP addresses. The system further enables per-hop integrity protection using IPsec AH transport mode, with WAN IPs as the outer IP addresses. By having some information encrypted between a source device and a destination device and other information encapsulated between hops (e.g., between source device and an intermediate device), the system enables route and policy lookup based on destination site System-IP, along with integrity protection based on SLA-class in packet metadata for independent path selection at intermediate hops.

The invention discloses an unmanned aerial vehicle communication data feature extraction method and an unknown type intrusion detection method. Physical layer information and network layer information of an unmanned aerial vehicle are acquired; wherein the physical layer information comprises the position, attitude, height and command type of the unmanned aerial vehicle, and the network layer information comprises an IP address, a port number, a protocol type and packet metadata; constructing an unmanned aerial vehicle state feature vector according to the physical layer information and the network layer information of the unmanned aerial vehicle; based on the trained CNN branch network, extracting communication data features used for intrusion detection in the unmanned aerial vehicle state feature vectors; a double-branch network structure of the convolutional neural network and the time sequence convolutional network is provided, a loss function is improved, an information entropy regularization item is introduced, efficient detection and distinguishing of unknown attack samples are achieved, the network structure has the advantages of being high in calculation efficiency and light in weight, and the method is suitable for large-scale popularization and application. The method is suitable for being deployed in resource-limited edge computing scenes such as unmanned aerial vehicles.

A sending node may send a network message to a multicast IP address. The sending node and a recipient node may be in communication via a plurality of intermediary nodes. The recipient node may receive a number of copies of the network message that corresponds to a number of equal cost paths between the sending node and the recipient node. The recipient node may send a reply to each of the copies of the network message to the sending node. The sending node may provide the replies to a collector module, which may use the replies for network analytics, network monitoring, machine learning, and the like.

The invention relates to a malicious website identification method and system based on IP address feature analysis, and belongs to the technical field of network security, and the method comprises the steps: collecting network flow data of an IP address through a network flow log, a firewall log and a DNS query record, and carrying out the preprocessing; constructing an IP dynamic graph structure by taking the IP addresses as nodes and the communication relationship between the IP addresses as edges according to the preprocessed network flow data; the IP dynamic graph structure is coded through a graph attention network, the complex relation between nodes is captured, the time sequence characteristics of IP address behaviors are captured in combination with a long and short-term memory network, and a behavior mode of the nodes is constructed; and calculating a reconstruction error and a local outlier factor LOF of the node according to a behavior pattern of the node, calculating an abnormal score of the IP address, and when the abnormal score is higher than a dynamic abnormal detection threshold, performing deep analysis by combining domain name characteristics, webpage content characteristics and network access behavior characteristics of the website, and identifying the malicious website.