33 results about "Misuse detection" patented technology

A method for permission misuse detection and data leakage in a serverless cloud environment, comprising the steps of providing a Permission Misuse Detection (PMD) model that is adapted to utilize the cloud provider's native monitoring tools to detect abnormal behavior of serverless applications; filter log records that represent an interaction between a resource and the initiating entity; transform the records into a sequence of tokens; transform a predefined number of sequential tokens into an n-gram model; predict the last token in the sequence, to detect an anomaly. The method uses a Graph Representation of Logs for Access Detection (GR-LAD) model that is adapted to aggregate the log records and builds graph representations of the cloud services; learn the interactions between services and detect anomalies in such interactions by using graph theory features. A Compromised Function Detection (CFD) model is used to: generate multivariate sequences to represent each serverless function instance as a flow of the function's internal operations, using high-resolution logging of the serverless functions; analyze the sequences, to detect anomalies within the function flow itself, and within individual events in the function.

The invention employs three distinct models, each tailored to offer the most accurate prediction in determining whether a given medical insurance claim qualifies as a fraud, waste, or abuse case. These models operate independently, yet their outputs are combined to ensure a comprehensive evaluation. The invention assigns weights to the votes cast by each model, reflecting their relative importance and reliability. This weighted approach ensures that the final classification-whether the case is fraud, waste, or abuse—is based on a balanced consideration of all available evidence. The result is a robust and dependable system that can handle the complexities of fraud detection, waste management, and abuse prevention in a variety of settings, including financial institutions, healthcare organizations, and government agencies.

The invention discloses an automatic detection method, system and device for Python language password API misuse and a medium. In the scheme provided by the invention, an abstract syntax tree is reconstructed in combination with Python language characteristics, the abstract syntax tree is reconstructed according to the Python language characteristics, node representation is simplified while function consistency is guaranteed, and the probability of misuse of the Python language password API misuse is lowered. Therefore, the false alarm rate and the missing report rate are reduced in the subsequent taint analysis process; meanwhile, a static taint analysis technology is utilized, taint propagation in the process and between functions is carried out based on reconstruction of an abstract syntax tree, and all password API misuse rules are covered through a taint detector, so that a detected password API misuse instance is determined. Generally speaking, the method fills up the blank that no password API misuse detection for the Python application program exists at present, and plays an important supporting and promoting role in the field of password application security evaluation.

The invention relates to the field of software engineering, and discloses an API misuse detection method based on a hypergraph neural network in order to improve the accuracy of an API misuse detection result, which comprises the following steps of: S1, constructing a labeling code set containing an API correct use sample and a misuse sample; s2, constructing an API use graph according to the abstract syntax tree structure of the source code; s3, generating an API use hypergraph based on the API use graph; s4, introducing a hypergraph attention mechanism, and training a hypergraph neural network to obtain an API misuse detection model; and S5, converting a source code to be detected into a hypergraph structure, and inputting the hypergraph structure into the trained hypergraph neural network to obtain an API misuse detection result. According to the method, the hypergraph neural network is applied to API misuse detection, hyperedges are used for capturing high-order dependence and complex interaction relations in source codes, diversified API use modes can be processed, and the accuracy of a detection result can be improved.

The embodiment of the invention discloses a cryptography misuse detection method and device. A specific embodiment of the method comprises the following steps: performing ontology knowledge detection and enhancement processing on original query information according to a cryptography misuse ontology knowledge base; performing initial detection on the code query enhancement information; according to a preliminary detection result, performing iterative detection on a knowledge base knowledge fragment sequence and a source code included in the code query enhancement information; generating a code detection analysis report according to the code iteration detection result and the source code; generating a target code misuse information set according to the high-confidence candidate misuse information and the code detection analysis report; and according to the cryptography misuse ontology knowledge base, filling the target code misuse information set into the structured misuse information report template to obtain a structured misuse information report. According to the embodiment, the efficiency and accuracy of overall detection are remarkably improved while the high call rate is ensured.

The present invention relates to a method and system for detecting misuse of intelligent contract libraries based on large language models and static analysis. The method includes: extracting library misuse information; constructing a prompt method of generate-then-select; using the prompt method to perform intelligent contract detection of the large language model, obtaining a preliminary detection result as part of the next input for result iterative feedback optimization to obtain a target large language model; creating a static matching BCSSM structure; performing weighted matching on the detection results of the target large language model and the static matching structure, and outputting a final detection result. By constructing a prompt method to use the large language model for intelligent contract detection, and utilizing the code parsing and logical reasoning capabilities of the large language model as well as static matching, it is possible to more accurately detect the library misuse patterns carried by intelligent contracts. Applied to the development and maintenance stages of intelligent contracts, it can achieve more secure intelligent contracts.

A double-branch deep neural network uncertainty evaluation method comprises the steps that a double-branch quantitative evaluation data set and a double-branch feature extraction model based on a convolutional neural network are constructed, and the double-branch feature extraction model comprises an anomaly detection branch and a misuse detection branch; a first Gaussian process quantization module is arranged behind the anomaly detection branch, and a second Gaussian process quantization module is arranged behind the misuse detection branch; inputting a training set and a test data set to the anomaly detection branches in the trained double-branch feature extraction model, and inputting training set data and test data to the trained misuse detection branches; the first Gaussian process quantification module and the second Gaussian process quantification module are used for evaluating the output of each branch by using an uncertainty quantification method based on the Gaussian process, outputting the Gaussian process uncertainty quantification evaluation results of each branch, and carrying out weighted fusion on the Gaussian process uncertainty quantification evaluation results as a final uncertainty quantification result; and grading and visual display are carried out. According to the invention, the credibility of evaluation is improved.

The application discloses a resource management API constraint extraction method and system based on a large language model, and belongs to the technical field of software automation analysis. In order to solve the illusion problem caused by directly using a large model to analyze API constraints, the application extracts function declarations and resource management sentences from API documents; constructs a multi-dimensional prompt template to obtain API allocation judgment results and reasoning processes; extracts core predicates of reasoning text and performs consistency verification to correct illusions; structures function declarations and extracts resource object types in combination with semantics; searches for paired release functions by taking the object types as constraints, and outputs API pairs; and finally performs resource misuse detection based on the API pairs through static analysis. The application can significantly reduce model output errors, improve release function searching accuracy, has strong anti-illusion ability and high automation degree.

The invention discloses a Java cryptography API misuse detection method based on taint analysis, which comprises the following steps: S1, setting a taint analysis rule according to the type of cryptography API misuse; s2, processing a to-be-detected target program to obtain a result IR for static analysis; s3, performing pointer analysis on the IR generated in the step S2 in combination with a target program code, and generating a pointing flow graph and a method calling graph of the to-be-detected target program; and S4, on the basis of the pointing flow graph and the method calling graph obtained in the step S3, performing taint analysis driven by pointer analysis on the IR generated in the step S2, analyzing a program path through which a taint flow passes, and detecting whether misuse occurs according to different types of cryptographic API misuse rules. Compared with a traditional Java cryptography API misuse detection method, the Java cryptography API misuse detection method introduces taint analysis to establish the taint flow of the API related parameters from the creation point to the use point, so that Java cryptography API misuse is detected, and the Java cryptography API misuse detection method has the advantages of being complete in detection capacity and high in detection precision.

The invention relates to a misuse detection method and device of an encrypted API and terminal equipment. The method comprises the following steps: constructing an encrypted API knowledge graph; extracting an encrypted API file from the to-be-detected item file; respectively performing control flow analysis and data flow analysis on the encrypted API file to obtain function call information and static variable information of the encrypted API file; and inputting the encrypted API knowledge graph, the encrypted API file, the function call information and the static variable information into an encrypted API agent for encrypted API misuse detection to obtain a detection report of the to-be-detected item file. Through application of the method and the device, the problems of relatively high false alarm rate and missing report rate of an encrypted API misuse detection method depending on rules in related technologies are solved, and the technical effect of improving misuse detection accuracy of the encrypted API is realized.

The invention provides a cloud identity abuse recognition system and method based on runtime data and static analysis. The method comprises the following steps: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor configured to detect corresponding data of a runtime process executing on the workload; detecting an original disk associated with the workload; generating a checkable disk based on the original disk; checking the network security object in the checkable disk; detecting an event in a log of the cloud computing environment based on the identifier of the workload; checking an identity object in the code object, wherein the code object is used for deploying a workload in the cloud computing environment; associating the runtime process with the event based on the identity object, the network security object, and the identifier of the workload; and generating an enrichment log including the identifiers of the runtime processes.

The invention relates to an intelligent contract library misuse detection method and system based on a large language model and static analysis. The method comprises the following steps: extracting library misuse information; constructing a cue word method of first generation and second selection; performing intelligent contract detection of the large language model by using a cue word method, and performing result iteration feedback optimization by taking an obtained preliminary detection result as a part of next input to obtain a target large language model; creating a static matching BCSSM structure; and performing weighted matching on the detection results of the target large language model and the static matching structure, and outputting a final detection result. According to the method, the big language model is used for intelligent contract detection through a prompt word construction method, the library misuse mode of the intelligent contract can be accurately detected through code analysis and logical reasoning ability and static matching of the big language model, the method is applied to the development and maintenance stages of the intelligent contract, and the safer intelligent contract can be achieved.

An API misuse detection method based on library source code and client source code mining is proposed. First, a frequent subgraph mining algorithm is used to mine frequently occurring API usage patterns in client code as API usage pattern constraints. Second, an abstract syntax tree is constructed by collecting all methods of each target API class and its parent classes in the library source code, and then an inference strategy is used to extract API library source code constraints. The two types of constraints are then represented as an API usage graph, followed by constraint merging and optimization. Finally, a graph matching algorithm is used for API misuse detection. The degree of suspicion of misuse is calculated based on the obtained candidate API misuses, thus achieving API misuse detection. This invention utilizes third-party library source code to mine more comprehensive and accurate API constraints, effectively solving the problem of insufficient comprehensiveness and information in API constraints from client code, and significantly improving the recall and precision of API misuse detection.

The invention belongs to the technical field of information, and discloses an LLM-based API misuse detection method, which comprises the following steps of: 1, receiving a target code snippet to be detected, performing static analysis, and extracting a called target API; 2, generating a first cue word for extracting API knowledge according to the set API structured information and the first cue word template, and inputting the first cue word to LLM to obtain API knowledge related to the target API; 3, generating a second cue word for misuse judgment according to the API knowledge and the second cue word template; 4, respectively inputting the second prompt words into the plurality of LLMs, and performing joint decision according to the output results of the LLMs to obtain the misuse judgment result of the target API; and 5, for the APIs judged to be misused, generating third cue words according to misuse judgment results, the third cue word templates and API knowledge, inputting the third cue words into the LLM for further automatic restoration, and obtaining restoration suggestions for the misused APIs. The misuse detection method does not depend on manual data marking, is high in detection accuracy and can provide automatic repair.

The application discloses an API misuse detection method and device based on frequent subgraph mining, and the method comprises the following steps: a data set containing a plurality of API source codes is constructed, and at least one API path is generated from each API source code; based on the occurrence frequency of each subgraph in all API paths, an API path mode set corresponding to the data set is obtained; the API path of a to-be-detected source code is subjected to subgraph matching with the API path mode set, so as to obtain an API misuse detection result of the to-be-detected source code. The application can reduce the cost of manual work, expand the detection range, and enhance software security.

The present invention provides an API misuse detection method based on historical code change information, which belongs to the field of software engineering technology. The method first pulls the historical code change information of the open source project from the code hosting tool, and extracts the repair information related to the API misuse. The AUG before and after the program repair is used to reversely extract the program mutation operator, rather than manually designing the mutation operator, so as to effectively and efficiently generate a large number of program sets containing API misuse. After the API misuse set passes the test suite as a test case, the information in the termination trace stack is analyzed. If the termination stack trace information is not caused by the target API misuse, or also contains information caused by other API misuses, it means that the original program contains API misuse. It avoids learning the correct API usage pattern from a large number of programs and improves the efficiency of API misuse detection.

The application relates to the field of software engineering, and discloses an API misuse detection method based on a hypergraph neural network, which aims to improve the accuracy of API misuse detection results, and comprises the following steps: step S1, constructing a labeled code set containing API correct use samples and misuse samples; step S2, constructing an API use graph according to the abstract syntax tree structure of source code; step S3, generating an API use hypergraph based on the API use graph; step S4, introducing a hypergraph attention mechanism, training a hypergraph neural network, and obtaining an API misuse detection model; and step S5, converting the source code to be detected into a hypergraph structure, inputting the hypergraph structure into the trained hypergraph neural network, and obtaining an API misuse detection result. The application applies the hypergraph neural network to API misuse detection, uses hyperedges to capture high-order dependencies and complex interaction relationships in source code, can process diversified API use modes, and can improve the accuracy of detection results.

This invention discloses a method and system for detecting cryptographic misuse in open-source software based on a large language model, belonging to the field of computer data processing technology. First, the source code of the program under test is parsed to generate a hierarchical function call graph, and file-level components containing call points are selected. Then, a first cue word guides the large language model to determine whether the component is related to cryptographic functions, and a second cue word identifies the user-defined key cryptographic function for the relevant component. Next, parameter analysis and backward data flow tracing are performed on the function to generate function call path slices. Then, a third cue word guides the large language model to analyze the slices, generating a preliminary set of cryptographic misuse reports. Finally, a fourth cue word guides the large language model to calibrate the preliminary reports in conjunction with the code slices, outputting the final misuse report. This invention integrates the advantages of static analysis and a large language model, enabling more comprehensive detection of cryptographic misuse and effectively reducing the false positive rate.

The application discloses a kind of Python language password API misuse automated detection method, system, equipment and medium, in the scheme provided by the present application, combined with Python language feature reconstruction abstract syntax tree, reconstruct abstract syntax tree according to Python language feature, while guaranteeing function consistency Simplify node representation, to reduce false positive rate and false negative rate in subsequent taint analysis process;Meanwhile, using static taint analysis technology, based on the reconstructed abstract syntax tree, the process and inter-function taint propagation are carried out, and all password API misuse rules are covered by the taint detector, so as to determine the detected password API misuse instance. Overall, the present application fills the blank of the current password API misuse detection for Python application, and has important support and promotion effect on password application security evaluation field.

The invention relates to the technical field of information security, and provides a binary executable file password misuse detection method based on dynamic compilation traceability, which comprises the following steps of: performing local static analysis on an input binary executable file, positioning a sensitive function in the binary executable file and calling a self-defined function of the sensitive function; performing dynamic variation traceability on the parameters of the sensitive function, performing execution by changing parameter values and combining under-constraint dynamic symbols, tracing a real source of the parameters, and performing code accessibility verification in the traceability process to obtain an execution result of the sensitive function; and performing mode matching and constraint solution on the obtained execution result according to a predefined cryptographic security rule, judging whether a password misuse behavior exists or not, and outputting a detection log. Through the technical means of combining dynamic variation traceability and local static analysis, the effect of efficiently and accurately detecting the password misuse behavior in the binary file on the premise of avoiding path explosion is achieved.

The application discloses a kind of method and system for detecting application program interface misuse, belong to computer software technical field.The present application is to solve the technical problems that the API use specification depends on manual writing, the coverage is insufficient, the misuse detection capability is limited, mainly using the call chain analysis based on seed specification, key variable flow tracking, data flow verification and iteration expansion mechanism, automatically generating API use specification, and being used for static detection program API calling behavior not following specification.The present application can realize the efficient identification and accurate report of API misuse behavior, improve the security and reliability of software system.

The invention relates to a solution for handling malware infections in which participant-side terminal equipment (TE) (1) of a communication network or terminal devices operated on it have been infected with malware designed to integrate them into a botnet for the purpose of remote control by a computer-based attack facility (CA) (4). When an internet session is initiated by a TE (1) using a network address of a CA (4) previously identified and registered as malicious by network facilities of an abuse detection and treatment subsystem (MBS) (3) of the network operator, the TE (1) initiating this session is registered as an infected TE (1) under a unique identifier within the communication network for the automated triggering of further technical measures.This is achieved by network facilities (2) of an addressing subsystem ASS returning a defined IPv6 exchange address of the network operator to the TE (1) for the malicious network address of the CA (4) used at the start of the session, thereby causing the TE to specify its own IPv6 address as the sender address when transmitting further session data. This is then registered by specially trained network facilities of the MBS (3) together with a timestamp.

The application discloses an API misuse detection method and system based on a large language model, and belongs to the technical field of software security. In order to solve the problem that API misuse detection in the prior art relies on manual rules and has a limited coverage, the application mainly generates API usage specifications by analyzing API source codes based on a large language model, verifies the correctness of the specifications by automatically constructing API calling codes that violate the specifications and combining dynamic execution and static analysis means, and then generates refined usage specifications and constructs detection codes to realize misuse identification. The application can automatically detect API misuse behaviors in application software, including null pointer dereferencing, memory leakage and double release, and the like, and improves the security and robustness of software.

The invention discloses a password misuse detection method and device supporting automatic rule derivation and cross-library analysis, a medium and a product, and relates to the field of information security, and the method comprises the steps: obtaining a use rule of a basic password library, and carrying out the formalized expression of the use rule, and obtaining a password rule constraint library; function constraints are mapped to a function name matching detection method; a detection method for mapping parameter constraints and member variable constraints to data flow analysis; obtaining a complete to-be-detected item source code and a go.mod file; the intermediate representation is converted into an intermediate representation in a static single assignment form; judging whether the position of the calling function is in a blacklist or not, and if yes, giving an alarm; aiming at the parameter constraint, obtaining a first slicing criterion and a corresponding runtime value; acquiring a second slicing criterion and a corresponding runtime value according to the member variable constraint; predicate judgment is carried out, and if judgment conditions are not met, an alarm is given; and obtaining a data flow analysis result and carrying out constraint derivation. According to the invention, high-precision cryptography misuse detection can be realized.

This application discloses a cryptographic misuse detection method, device, medium, and product that supports automatic rule derivation and cross-library analysis, relating to the field of information security. The method includes: obtaining the usage rules of a basic cryptographic library and formalizing them to obtain a cryptographic rule constraint library; a detection method that maps function constraints to function name matching; a detection method that maps parameter constraints and member variable constraints to data flow analysis; obtaining the complete source code and go.mod file of the project to be detected; and converting them into an intermediate representation in the form of a static single assignment; determining whether the calling function location is on a blacklist, and if so, generating an alarm; obtaining a first slicing criterion and its corresponding runtime value for parameter constraints; obtaining a second slicing criterion and its corresponding runtime value for member variable constraints; performing predicate judgment, and generating an alarm if the judgment condition is not met; and obtaining data flow analysis results and performing constraint derivation. This application can achieve high-precision cryptographic misuse detection.

The present disclosure provides a distributed multi-utility monitoring system and method for optimizing at least two distinct utility subsystems. The system comprises a plurality of sensor nodes configured to acquire physical operational parameters, a communication gateway, and an edge computing device for validation, normalization, and synchronization of heterogeneous datasets. A centralized analytics server performs cross-domain correlation analysis to generate predictive mitigation outputs. The system integrates electricity, water, and gas distribution networks, monitoring gas-specific parameters such as press we, flow rates, and leak indicators. A fraud, waste, and abuse (FWA) detection module identifies anomalous consumption patterns indicative of tampering or unauthorized usage. Temperature-controlled asset monitoring ensures cold chain integrity with predictive failure alerts and regulatory compliance logging. A central machine learning engine drives predictive optimization and data-driven decision-making, while a reporting interface surfaces actionable insights and recommendations to operators. By utilizing a distributed architecture from edge to centre, the system enables technical correlation between disparate utility infrastructures to enhance operational efficiency, sustainability, fraud prevention, and proactive infrastructure management across multiple domains.

The invention belongs to the cross technical field of network security, computing power management and artificial intelligence application, and particularly relates to a computing power abuse detection system for an intelligent computing network. Comprising a data acquisition module, a network flow attack detection module, a resource load anomaly detection module and a risk judgment module, the data acquisition module acquires traffic data and load data, pushes traffic characteristics to the network traffic attack detection module, and pushes load indexes to the resource load anomaly detection module; the network traffic attack detection module transmits a traffic abnormal signal to the risk judgment module; the resource load anomaly detection module transmits load anomaly data to the risk judgment module for reporting; the risk judgment module performs abnormality level calculation based on the double abnormal states, and triggers execution of a response strategy matched with the abnormality level so as to cut off the risk of abuse of the computing power; according to the method, the accuracy and integrity of abuse detection of computing power are enhanced, and the dynamic scene response speed, the cross-domain generalization ability and the attack evolution adaptability are improved.

The application discloses a kind of based on graph structure code slice detection android cryptography misuse method and device, method includes the following steps: to the Android application to be detected is reversed, and source code is obtained;The source code program dependency graph of Android application is obtained and graph structure slice is carried out, and encrypted misuse candidate graph structured code slice is obtained;Characterize cryptography misuse candidate graph structured code slice, and its graph information is characterized as the data set learned as neural network model;Neural network model training is carried out using data set;The trained neural network model is used to detect Android application, and cryptography misuse result is output.The application extracts graph structure source code slice according to cryptography misuse characteristics by source code program dependency graph, and cryptography misuse detection work is carried out using graph neural network model after graph structure slice information is characterized, to realize the detection of encryption misuse of Android application, and the potential threat of encryption misuse in Android application is discovered in time.

In one aspect, a computerized method for detecting data abuse and data exfiltration in a data store or a data lakes cloud warehouse, comprising: identifying a plurality of Command and control (CnC) channels in an enterprise data cloud infrastructure; identifying and detecting malicious compressed data transfers and encrypted data transfers; implementing a destination analysis from within the data store; and implementing data abuse detection and prevention operations.

The invention relates to a cryptographic API combination misuse detection method and system based on automatic rule extraction. The method comprises the steps that a cryptographic API sequence is extracted from a project source code based on data flow and control dependency analysis; a correct use mode is automatically extracted from the cryptographic API sequence through a sequence mode mining algorithm; the cryptographic API combination misuse is detected based on the correct usage pattern. The method has a more accurate detection effect, does not need data set marking and manual participation, has more lightweight preparatory work and a higher automation degree, can automatically extract correct cryptography API misuse detection rules for different actual projects, and can meet the use requirements of programming, testing and safety analysis personnel.