68 results about "Is security" patented technology

Techniques for providing a language model to detect and remedy a security incident are described. A language model is deployed to respond to prompts from network operators. The language model receives a prompt from the network operator indicating actions to take based on trigger events. When a trigger event occurs, the language model receives a description of a potential security incident and identifies indicators of compromise in the description. The language model calls one or more other models to analyze the indicators and receives from the one or more other models, information indicating that the potential security incident is a real security incident, and outputs a prompt to the network operator to approve confirmation of the security incident.

The invention relates to the technical field of intelligent terminal cloud security, in particular to an intelligent terminal cloud security protection system and behavior characteristic analysis system, which comprises an access / output unit, a request unit, an authentication and identification unit, a traceability tracking unit, a judgment and analysis unit and a shielding protection unit, the output end of the access / output unit is in communication connection with the input ends of the request unit and the authentication and identification unit; according to the method, the data needing to be downloaded by the intelligent terminal can be simulated and analyzed in advance, whether the data are safe or not can be obtained according to analysis, most of the data downloaded by the intelligent terminal are safe data, and the simulation analysis module can perform simulation analysis through sandbox operation and historical efficiency comparison (S value calculation). Encryption confusion attacks (for example, ransomware is disguised as a normal file) are accurately identified, and the missing report rate is reduced to be lt; and through modular architecture design, multi-modal data fusion and an intelligent decision-making mechanism, full-process closed-loop protection from data acquisition to threat response is realized.

Certain aspects of the disclosure concern a computer-implemented method for improved data security in large language models. The method includes receiving a prompt query entered through a user interface, extracting a plurality of named entities from the prompt query and classifying the plurality of named entities into respective entity classes, tagging the plurality of named entities to be security compliant or security noncompliant based on the respective entity classes, and responsive to finding that one or more named entities are tagged to be security noncompliant, generating an alert on the user interface.

Provided are security encryption algorithm identification method and system, including: an electronic device having a software app, a downloadable storage unit for storing a dynamic-link library (DLL), and a scanning module for scanning the DLL to obtain DLL filename information; a cryptography DLL list, with the scanning module comparing the DLL filename information according to the cryptography DLL list to generate security encryption algorithm library (SEAL) filename information and being linked to a SEAL corresponding to the SEAL filename information to retrieve SEAL version information from a metadata of the SEAL; a specified SEAL storage unit having a plugin-equipped SEAL downloadable by the scanning module from the specified SEAL storage unit according to the SEAL filename information and version information and dedicated to replacing the SEAL; and a specified storage unit disposed in the electronic device to store log files created when the software app calls the plugin-equipped SEAL.

Apparatus and method for role-based register protection. For example, one embodiment of an apparatus comprises: one or more processor cores to execute instructions and process data, the one or more processor cores to execute one or more security instructions to protect a virtual machine or trusted application from a virtual machine monitor (VMM) or operating system (OS); an interconnect fabric to couple the one or more processor cores to a device; and security hardware logic to determine whether to allow a read or write transaction directed to a protected register to proceed over the interconnect fabric, the security hardware logic to evaluate one or more security attributes associated with an initiator of the transaction to make the determination.

The invention discloses a cloud office access control system based on a zero-trust architecture, and belongs to the technical field of cloud office security, and the system comprises a zero-trust architecture module which is used for monitoring and obtaining related data information when a user accesses; the risk monitoring module is used for judging whether the zero-trust architecture module has a security vulnerability hidden danger or not; the risk assessment module is used for assessing the security risk of the login; the user behavior analysis module is used for judging whether the login access user has an abnormal risk or not according to the acquired related data information; and the decision module executes a corresponding decision according to the judgment result. According to the invention, the user behavior after normal login can be monitored through the user behavior analysis module, and analysis is carried out according to the related data information generated by the login behavior to judge whether the access user has an abnormal risk, so that the abnormal risk can be processed in time, resources in the cloud office system are prevented from being continuously stolen, and the user experience is improved. Therefore, the security of information resources is effectively protected.

A communication method includes: obtaining security information of a first tag and one or more operation command security policies of the first tag, where the security information is security information that has been executed, and includes a first authentication policy and / or a first security policy; receiving a first operation command from an application function (AF) entity; determining a second authentication policy and / or a second security policy of the first tag based on the security information and a first operation command security policy included in the one or more operation command security policies, where the first operation command security policy corresponds to the first operation command; and sending a first command to a second device, where the first command includes the second authentication policy and / or the second security policy, and a tag identifier of the first tag.

The application discloses a kind of based on device code's risk scanning method, system and computing device, comprising: obtaining a device code, the device code is obtained from first device, and the device code is sent from first device to second device;Wherein, the device code includes at least one software code;Generate an update record;Wherein, the update record includes the relationship record between the device code and the first device and / or the second device;When detecting that there is security risk in the device code, according to the update record, scanning result is sent to the first device and / or the second device.The application can automatically send scanning result to user by the update record generated automatically, improve the efficiency and accuracy of risk scanning.

The application discloses a 5G core network element device with a security control function, characterized in that the device comprises a data acquisition and processing module, a global security analysis module and a unified decision control module; the data acquisition and processing module collects security monitoring data of a base station, a core network and a terminal and stores the data into a database; the global security analysis module performs correlation analysis on the data in the database and transmits analysis results to a unified configuration and display system; the correlation analysis method is as follows: if all the collected security monitoring data are security events, the security events are subjected to multivariate security event correlation analysis to form global security events; otherwise, a plurality of alarm data clusters are formed by performing multivariate alarm data correlation on the monitoring alarm information, and then a deep clustering event recognition method is used to convert the correlation analysis results into global security events; and the unified decision control module generates corresponding security disposal decisions based on the warning levels corresponding to the global security events and delivers the decisions to a PCF network element.

The invention provides a security detection method and system based on a network application firewall (WAF). The method comprises the following steps: starting security detection processing under a current limiting model; analyzing at least one attribute parameter associated with the security detection in the first user request; aiming at each analyzed attribute parameter, executing the following steps: representing an analysis result of the attribute parameter by using a preset number; different analysis results of the attribute parameters correspond to different numbers; determining a risk probability of the first user request using each number representing a result of analysis of the attribute parameter of the first user request; and when the risk probability is greater than a preset risk probability threshold, performing security detection on the first user request, otherwise, not performing security detection and directly sending the first user request to the Web server. According to the method, security detection analysis is carried out according to the specific values / contents of the digits instead of the attribute parameters, so that computing resources are greatly saved and the efficiency is greatly improved on the premise of ensuring that which user requests need to be subjected to security detection are distinguished.

The invention relates to a security verification method, device and equipment, a readable storage medium and a program product. The method is applied to gateway equipment. The method comprises the following steps: firstly, receiving a control request which is sent by a control terminal and is used for controlling target equipment by the control terminal, then, acquiring physical layer feature information of the control request, and finally, performing security verification on the control terminal according to the physical layer feature information and historical physical layer feature information of the control terminal, determining a security verification result, and sending the security verification result to the control terminal. The safety verification result is used for indicating whether the control terminal is a safety terminal. By adopting the method, identity authentication can be performed on the control terminal, and potential safety hazards caused by counterfeiting of attackers are avoided.

To enable a risk to a target system to be evaluated due to vulnerability of security countermeasure software.SOLUTION: An information processing system 1 comprises a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, and an output unit 18E. The first identification unit 18B identifies a menace type which can be addressed by installed software, the installed software being security countermeasure software that has been installed in a target system 30, among the security countermeasure software to which vulnerability has been reported. The first calculation unit 18C calculates a first risk value when addressing menace of the identified menace type by the installed software. The second calculation unit 18D calculates a second risk value when not addressing the menace of the identified menace type by the installed software. The output unit 18E outputs damage possibility information including risk value change information showing a change of the second risk value with respect to the first risk value.SELECTED DRAWING: Figure 2

An information processing apparatus includes a collection unit for inputting instruction information used to collect information related to a security incident, into a model that generates and outputs an answer based on an input instruction and causing the model to collect answer information related to the security incident and an extraction unit for extracting information indicating the security incident and information indicating an organization to be a subject of the security incident, based on the answer information.

The present invention discloses a computer security operation and maintenance service system, which specifically relates to the field of computer security management technology, and includes a security response monitoring module, a response analysis module, an identification module, an anomaly analysis module, an early warning module, and an operation adjustment module. The security response monitoring module monitors vulnerability processing response information in real time and transmits it to the response analysis module; the response analysis module performs analysis and transmits the results to the identification module; the identification module determines whether there are security risks; the anomaly analysis module analyzes the risks and transmits the results to the early warning module; the early warning module issues a high-risk or low-risk early warning signal and transmits it to the operation adjustment module; the operation adjustment module intelligently adjusts the sampling frequency of the low-risk signal, and performs risk level judgment on the high-risk signal and executes the corresponding strategy; the present invention can timely discover and respond to potential security threats by intelligently regulating and early warning the computer's vulnerability processing response information, thereby improving the overall security of the system.

The present invention discloses a method for rapid side-channel attack analysis of Dilithium, belonging to the technical field of information security. The Gaussian mixture difference method is used to detect leakage, and the detection and selection of feature points are completed; the signature information is used to classify the actual leakage involving the private key, and the difference in distribution is used to recover the private key in the normal domain. The present invention solves the problem of large time overhead in existing non-template attacks under small-sample leakage. Using the side information leakage generated by a small number of signatures, the complete private key can be recovered within a few minutes under a high noise level. Compared with existing leakage detection methods, the Gaussian mixture difference method can complete the detection and selection of feature points without obtaining sensitive intermediate values. The present invention can be used to detect whether the cryptographic device and cryptographic chip are safe and reliable, such as in the fields of bank cards in financial economy, digital currency physical cards, and mobile phone chips in mobile communication, to detect whether there are security risks in the device.

A computer-implemented method includes making an analytics-based determination that a water vessel has moved from one region to another region. The computer-implemented method also includes changing, within a security system and responsive to the determining, security monitoring of the water vessel from a first monitoring mode to a second monitoring mode, and the second monitoring mode being more sensitive than the first monitoring mode in relation to a measured velocity of the water vessel being a conditionally defined trigger for at least one analytics-based alarm within the security system.

Methods, systems, and computer storage media for providing security incident management using a security graph layering engine in a security management system. Security incident management is provided using the security graph layering engine that include multi-layer security graph that supports querying a security graph using a multi-layer representation of data associated with security graph. In operation, a security graph associated with a plurality of security resources in a cloud environment is accessed. Based on accessing the security graph, a multi-layer security graph is generated. The multi-layer security graph is a multi-layer representation of the security. The multi-layer security graph is deployed. A security query associated with the multi-layer security graph is accessed. The security query is executed based on the multi-layer security graph, executing the security query generates a query result. The query result is communicated to a security incident management client to cause display of the security query results.

An integrated circuit device includes a hardware processor. The integrated circuit device is safety certified. The hardware processor is capable of executing a hypervisor and a real-time operating system (RTOS). The hypervisor is a level 1 hypervisor and is safety certified. The RTOS is safety certified and operates as a first guest machine of the hypervisor. The RTOS is capable of performing a safe operation for a functional safety feature.

This disclosure relates to a device control method, apparatus, electronic device, storage medium, and program product. The method includes: in response to a first device receiving a target operation instruction, determining a target control instruction, wherein the target control instruction is used to instruct a second device to perform a target operation, the second device being at least one device in a device domain where the first device resides, and the first device being a core device in the device domain; and sending the target control instruction to the second device. In this disclosure, the first device and the second device are located in the same device domain. Control between two devices in the same device domain is secure. Therefore, when the first device controls the second device in its device domain to perform a target operation, no additional authentication is required, thus improving the convenience of cross-device control while ensuring its security.

A method for managing a selection of an inference workload placement based on security considerations includes obtaining, by a variant selection agent of a workload placement service and from a front-end device, a request for an inference payload associated with an inference workload implementing a generative artificial intelligence (AI) model, and in response to the request: performing payload classification on the request to determine a variant selection for the inference workload, making a determination that the variant selection is a secured variant in response to the determination, transferring the request to the secured variant, wherein the secured variant executes an instance of the inference workload on a secured production environment, obtaining the inference payload from the secured variant, and providing the inference payload to the front-end device.

Methods, systems, and computer storage media for providing security event management using a security map tiering engine in a security management system. Security event management is provided using a security map hierarchy engine that includes a multi-layer security map that supports querying the security map using a multi-layer representation of data associated with the security map. In operation, a security map associated with a plurality of security resources in a cloud environment is accessed. A multi-layer security map is generated based on the access security map. The multilayer security map is a multilayer representation of security. And deploying the multi-layer security map. A security query associated with the multi-layer security map is accessed. And executing the security query based on the multi-layer security map, and executing the security query to generate a query result. The query results are transmitted to a security event management client to cause a secure query result display.

According to an embodiment, an information processing system includes one or more hardware processors. The one or more hardware processors are configured to: identify a threat type capable of being countered by installed software being security countermeasure software installed in a target system, from among security countermeasure software with a reported vulnerability; calculate a first risk value when a countermeasure is taken by the installed software for a threat of the identified threat type; calculate a second risk value when no countermeasure is taken by the installed software for the threat of the identified threat type; and output damage potential information including risk value change information representing a change in the second risk value with respect to the first risk value.

The invention is in the field of computer technology. The invention describes an architecture of a safety automation system and a method for safely autonomously operating a technical device. The architecture solves the problem that every possible Byzantine error, whether caused by an accidental malfunction of hardware, a design error in software or an intrusion, must be identified and contained, so that no safety-relevant event occurs. The architecture consists of four largely independent subsystems, which are arranged hierarchically and each form an encapsulated fault containment unit. At the top of the hierarchy is the safety subsystem, i.e. the fault-tolerant decision subsystem, which executes simple software on fault-tolerant hardware. The other three subsystems are unsafe because they contain complex software. It is empirically difficult to find all design errors in a complex software system and to prevent intrusions. Due to redundancy and diversity, every error of the unsafe subsystems is masked so that no safety-critical malfunction occurs.

The invention discloses a software and hardware compatibility method based on an Internet of Things information security chip, and relates to the technical field of software and hardware compatibility, and the method comprises the steps: generating an optimal temporary security communication protocol through a dynamic protocol generation algorithm according to an available security capability intersection list and a composite environment identification code, a special security communication channel is established between an information security chip and a software layer by using an optimal temporary security communication protocol, after the security communication channel is established, the running states of the information security chip and a main processor are monitored in real time, a running state snapshot data block is obtained, and when a security task to be processed exists, the information security chip and the main processor are subjected to the snapshot data block. And according to the running state snapshot data blocks of the information security chip and the main processor, splitting the security task into an information security chip sub-task and a main processor sub-task, and executing scheduling allocation. According to the software and hardware cooperation method based on dynamic environment perception, a software and hardware cooperation security guarantee with stability, security and high efficiency is provided for complex and changeable application scenes of the Internet of Things.

An automated driving system includes a security companion subsystem to access data generated at a compute subsystem of the automated driving system, which indicates a determination by the compute subsystem associated with an automated driving task. The security companion subsystem determines whether the determination is safe based on the data. The security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.

The present application relates to a kind of target trajectory generation method based on multi-path security video, belong to technical field.The present application is oriented to the target trajectory generation problem in security video, in view of the current situation that target loss caused by single target detection and re-identification, matching degree is not high, provide a kind of target trajectory generation method based on multi-path security video.For multi-path security video, there are four important features:one is that there is security area overlap and target appears repeatedly in multiple places in multi-path video;Second, there is a connection or adjacent relationship in the security area of multi-path video;Third, video is stream data, not video clip, and the matching range is wider;Fourth, the application feasibility of target space-time association is stronger.Therefore, the present application makes full use of the four features of security video and auxiliary information, based on multi-path video, multi-method fusion, multi-target correlation, to improve the accuracy of target tracking and trajectory generation, improve the re-identification precision.

The invention discloses an intelligent fault diagnosis and processing method and system for a refrigerating system. The method comprises the steps that operating parameters of an internal auxiliary system and an external auxiliary system of the refrigerating system are collected; acquiring a current working condition reference parameter, and identifying as abnormal when the internal parameter deviates from the reference overlimit; causal analysis is carried out by combining external parameters, and fault roots and types are judged; if the monitoring data are invalid, calculating a virtual substitution value by using thermodynamic coupling parameters to maintain operation; if the security risk performance declines, actively adjusting the control parameters to compensate the performance loss; and if the fault is a safety risk fault, shutdown is executed. According to the method, false alarms are reduced through the working condition self-adaptive benchmark, fault sources are accurately distinguished through cross-system cooperation, a fault-tolerant mechanism is established to avoid unnecessary shutdown, and conversion from passive maintenance to active operation and maintenance is achieved.

A cloud security control platform and method enforces security controls across multiple cloud environments, services and disparate teams while providing a frictionless “Permissions on Demand” mechanism for approvals and exceptions. In contrast to the prior art, security is evaluated on a permission by permission basis, with the default being that all permissions are denied and then only given to a particular identity on an as-needed basis. This approach reduces the security risks associated with the vast capabilities available in Public Cloud environments and permits an organization that uses the platform to grant access, approve exceptions and delegate approvals with the appropriate compliance.

A method, computer program product, and system in which a secure interface control configures a hardware security module for exclusive use by a secure guest. A secure interface control ("SC") obtains a configuration request for configuring a hardware security module (HSM) from a given guest (via a hypervisor) of guests managed by the hypervisor. The SC determines whether the HSM has already been configured to a particular guest of one or more guests, but based on determining that the HSM is not configured to the particular guest and is a secure guest, the SC cancels the establishment of the configuration of the HSM by exclusively limiting access of the guest to the HSM to the given guest. The SC logs in the given guest to the HSM by utilizing a secret of the given guest. The SC obtains a session code from the HSM and maintains the session code.