18 results about "Misuse detection" patented technology

The embodiment of the invention discloses a cryptography misuse detection method and device. A specific embodiment of the method comprises the following steps: performing ontology knowledge detection and enhancement processing on original query information according to a cryptography misuse ontology knowledge base; performing initial detection on the code query enhancement information; according to a preliminary detection result, performing iterative detection on a knowledge base knowledge fragment sequence and a source code included in the code query enhancement information; generating a code detection analysis report according to the code iteration detection result and the source code; generating a target code misuse information set according to the high-confidence candidate misuse information and the code detection analysis report; and according to the cryptography misuse ontology knowledge base, filling the target code misuse information set into the structured misuse information report template to obtain a structured misuse information report. According to the embodiment, the efficiency and accuracy of overall detection are remarkably improved while the high call rate is ensured.

A double-branch deep neural network uncertainty evaluation method comprises the steps that a double-branch quantitative evaluation data set and a double-branch feature extraction model based on a convolutional neural network are constructed, and the double-branch feature extraction model comprises an anomaly detection branch and a misuse detection branch; a first Gaussian process quantization module is arranged behind the anomaly detection branch, and a second Gaussian process quantization module is arranged behind the misuse detection branch; inputting a training set and a test data set to the anomaly detection branches in the trained double-branch feature extraction model, and inputting training set data and test data to the trained misuse detection branches; the first Gaussian process quantification module and the second Gaussian process quantification module are used for evaluating the output of each branch by using an uncertainty quantification method based on the Gaussian process, outputting the Gaussian process uncertainty quantification evaluation results of each branch, and carrying out weighted fusion on the Gaussian process uncertainty quantification evaluation results as a final uncertainty quantification result; and grading and visual display are carried out. According to the invention, the credibility of evaluation is improved.

The application discloses a resource management API constraint extraction method and system based on a large language model, and belongs to the technical field of software automation analysis. In order to solve the illusion problem caused by directly using a large model to analyze API constraints, the application extracts function declarations and resource management sentences from API documents; constructs a multi-dimensional prompt template to obtain API allocation judgment results and reasoning processes; extracts core predicates of reasoning text and performs consistency verification to correct illusions; structures function declarations and extracts resource object types in combination with semantics; searches for paired release functions by taking the object types as constraints, and outputs API pairs; and finally performs resource misuse detection based on the API pairs through static analysis. The application can significantly reduce model output errors, improve release function searching accuracy, has strong anti-illusion ability and high automation degree.

The invention relates to a misuse detection method and device of an encrypted API and terminal equipment. The method comprises the following steps: constructing an encrypted API knowledge graph; extracting an encrypted API file from the to-be-detected item file; respectively performing control flow analysis and data flow analysis on the encrypted API file to obtain function call information and static variable information of the encrypted API file; and inputting the encrypted API knowledge graph, the encrypted API file, the function call information and the static variable information into an encrypted API agent for encrypted API misuse detection to obtain a detection report of the to-be-detected item file. Through application of the method and the device, the problems of relatively high false alarm rate and missing report rate of an encrypted API misuse detection method depending on rules in related technologies are solved, and the technical effect of improving misuse detection accuracy of the encrypted API is realized.

The invention provides a cloud identity abuse recognition system and method based on runtime data and static analysis. The method comprises the following steps: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor configured to detect corresponding data of a runtime process executing on the workload; detecting an original disk associated with the workload; generating a checkable disk based on the original disk; checking the network security object in the checkable disk; detecting an event in a log of the cloud computing environment based on the identifier of the workload; checking an identity object in the code object, wherein the code object is used for deploying a workload in the cloud computing environment; associating the runtime process with the event based on the identity object, the network security object, and the identifier of the workload; and generating an enrichment log including the identifiers of the runtime processes.

An API misuse detection method based on library source code and client source code mining is proposed. First, a frequent subgraph mining algorithm is used to mine frequently occurring API usage patterns in client code as API usage pattern constraints. Second, an abstract syntax tree is constructed by collecting all methods of each target API class and its parent classes in the library source code, and then an inference strategy is used to extract API library source code constraints. The two types of constraints are then represented as an API usage graph, followed by constraint merging and optimization. Finally, a graph matching algorithm is used for API misuse detection. The degree of suspicion of misuse is calculated based on the obtained candidate API misuses, thus achieving API misuse detection. This invention utilizes third-party library source code to mine more comprehensive and accurate API constraints, effectively solving the problem of insufficient comprehensiveness and information in API constraints from client code, and significantly improving the recall and precision of API misuse detection.

The invention belongs to the technical field of information, and discloses an LLM-based API misuse detection method, which comprises the following steps of: 1, receiving a target code snippet to be detected, performing static analysis, and extracting a called target API; 2, generating a first cue word for extracting API knowledge according to the set API structured information and the first cue word template, and inputting the first cue word to LLM to obtain API knowledge related to the target API; 3, generating a second cue word for misuse judgment according to the API knowledge and the second cue word template; 4, respectively inputting the second prompt words into the plurality of LLMs, and performing joint decision according to the output results of the LLMs to obtain the misuse judgment result of the target API; and 5, for the APIs judged to be misused, generating third cue words according to misuse judgment results, the third cue word templates and API knowledge, inputting the third cue words into the LLM for further automatic restoration, and obtaining restoration suggestions for the misused APIs. The misuse detection method does not depend on manual data marking, is high in detection accuracy and can provide automatic repair.

The application discloses an API misuse detection method and device based on frequent subgraph mining, and the method comprises the following steps: a data set containing a plurality of API source codes is constructed, and at least one API path is generated from each API source code; based on the occurrence frequency of each subgraph in all API paths, an API path mode set corresponding to the data set is obtained; the API path of a to-be-detected source code is subjected to subgraph matching with the API path mode set, so as to obtain an API misuse detection result of the to-be-detected source code. The application can reduce the cost of manual work, expand the detection range, and enhance software security.

The application relates to the field of software engineering, and discloses an API misuse detection method based on a hypergraph neural network, which aims to improve the accuracy of API misuse detection results, and comprises the following steps: step S1, constructing a labeled code set containing API correct use samples and misuse samples; step S2, constructing an API use graph according to the abstract syntax tree structure of source code; step S3, generating an API use hypergraph based on the API use graph; step S4, introducing a hypergraph attention mechanism, training a hypergraph neural network, and obtaining an API misuse detection model; and step S5, converting the source code to be detected into a hypergraph structure, inputting the hypergraph structure into the trained hypergraph neural network, and obtaining an API misuse detection result. The application applies the hypergraph neural network to API misuse detection, uses hyperedges to capture high-order dependencies and complex interaction relationships in source code, can process diversified API use modes, and can improve the accuracy of detection results.

This invention discloses a method and system for detecting cryptographic misuse in open-source software based on a large language model, belonging to the field of computer data processing technology. First, the source code of the program under test is parsed to generate a hierarchical function call graph, and file-level components containing call points are selected. Then, a first cue word guides the large language model to determine whether the component is related to cryptographic functions, and a second cue word identifies the user-defined key cryptographic function for the relevant component. Next, parameter analysis and backward data flow tracing are performed on the function to generate function call path slices. Then, a third cue word guides the large language model to analyze the slices, generating a preliminary set of cryptographic misuse reports. Finally, a fourth cue word guides the large language model to calibrate the preliminary reports in conjunction with the code slices, outputting the final misuse report. This invention integrates the advantages of static analysis and a large language model, enabling more comprehensive detection of cryptographic misuse and effectively reducing the false positive rate.

The invention relates to the technical field of information security, and provides a binary executable file password misuse detection method based on dynamic compilation traceability, which comprises the following steps of: performing local static analysis on an input binary executable file, positioning a sensitive function in the binary executable file and calling a self-defined function of the sensitive function; performing dynamic variation traceability on the parameters of the sensitive function, performing execution by changing parameter values and combining under-constraint dynamic symbols, tracing a real source of the parameters, and performing code accessibility verification in the traceability process to obtain an execution result of the sensitive function; and performing mode matching and constraint solution on the obtained execution result according to a predefined cryptographic security rule, judging whether a password misuse behavior exists or not, and outputting a detection log. Through the technical means of combining dynamic variation traceability and local static analysis, the effect of efficiently and accurately detecting the password misuse behavior in the binary file on the premise of avoiding path explosion is achieved.

The application discloses a kind of method and system for detecting application program interface misuse, belong to computer software technical field.The present application is to solve the technical problems that the API use specification depends on manual writing, the coverage is insufficient, the misuse detection capability is limited, mainly using the call chain analysis based on seed specification, key variable flow tracking, data flow verification and iteration expansion mechanism, automatically generating API use specification, and being used for static detection program API calling behavior not following specification.The present application can realize the efficient identification and accurate report of API misuse behavior, improve the security and reliability of software system.

The application discloses an API misuse detection method and system based on a large language model, and belongs to the technical field of software security. In order to solve the problem that API misuse detection in the prior art relies on manual rules and has a limited coverage, the application mainly generates API usage specifications by analyzing API source codes based on a large language model, verifies the correctness of the specifications by automatically constructing API calling codes that violate the specifications and combining dynamic execution and static analysis means, and then generates refined usage specifications and constructs detection codes to realize misuse identification. The application can automatically detect API misuse behaviors in application software, including null pointer dereferencing, memory leakage and double release, and the like, and improves the security and robustness of software.

The present disclosure provides a distributed multi-utility monitoring system and method for optimizing at least two distinct utility subsystems. The system comprises a plurality of sensor nodes configured to acquire physical operational parameters, a communication gateway, and an edge computing device for validation, normalization, and synchronization of heterogeneous datasets. A centralized analytics server performs cross-domain correlation analysis to generate predictive mitigation outputs. The system integrates electricity, water, and gas distribution networks, monitoring gas-specific parameters such as press we, flow rates, and leak indicators. A fraud, waste, and abuse (FWA) detection module identifies anomalous consumption patterns indicative of tampering or unauthorized usage. Temperature-controlled asset monitoring ensures cold chain integrity with predictive failure alerts and regulatory compliance logging. A central machine learning engine drives predictive optimization and data-driven decision-making, while a reporting interface surfaces actionable insights and recommendations to operators. By utilizing a distributed architecture from edge to centre, the system enables technical correlation between disparate utility infrastructures to enhance operational efficiency, sustainability, fraud prevention, and proactive infrastructure management across multiple domains.

The invention belongs to the cross technical field of network security, computing power management and artificial intelligence application, and particularly relates to a computing power abuse detection system for an intelligent computing network. Comprising a data acquisition module, a network flow attack detection module, a resource load anomaly detection module and a risk judgment module, the data acquisition module acquires traffic data and load data, pushes traffic characteristics to the network traffic attack detection module, and pushes load indexes to the resource load anomaly detection module; the network traffic attack detection module transmits a traffic abnormal signal to the risk judgment module; the resource load anomaly detection module transmits load anomaly data to the risk judgment module for reporting; the risk judgment module performs abnormality level calculation based on the double abnormal states, and triggers execution of a response strategy matched with the abnormality level so as to cut off the risk of abuse of the computing power; according to the method, the accuracy and integrity of abuse detection of computing power are enhanced, and the dynamic scene response speed, the cross-domain generalization ability and the attack evolution adaptability are improved.

The application discloses a kind of based on graph structure code slice detection android cryptography misuse method and device, method includes the following steps: to the Android application to be detected is reversed, and source code is obtained;The source code program dependency graph of Android application is obtained and graph structure slice is carried out, and encrypted misuse candidate graph structured code slice is obtained;Characterize cryptography misuse candidate graph structured code slice, and its graph information is characterized as the data set learned as neural network model;Neural network model training is carried out using data set;The trained neural network model is used to detect Android application, and cryptography misuse result is output.The application extracts graph structure source code slice according to cryptography misuse characteristics by source code program dependency graph, and cryptography misuse detection work is carried out using graph neural network model after graph structure slice information is characterized, to realize the detection of encryption misuse of Android application, and the potential threat of encryption misuse in Android application is discovered in time.

In one aspect, a computerized method for detecting data abuse and data exfiltration in a data store or a data lakes cloud warehouse, comprising: identifying a plurality of Command and control (CnC) channels in an enterprise data cloud infrastructure; identifying and detecting malicious compressed data transfers and encrypted data transfers; implementing a destination analysis from within the data store; and implementing data abuse detection and prevention operations.

The present application relates to a kind of cryptography API combination misuse detection method and system based on rule automatic extraction.The method includes: extracting cryptography API sequence from project source code based on data flow and control dependency analysis;Correct use mode is automatically extracted to cryptography API sequence by sequence pattern mining algorithm;Cryptography API combination misuse is detected based on correct use mode.The present application has more accurate detection effect, does not need to mark data set and manual participation, has more lightweight preparation and higher automation degree, while different actual projects can automatically extract correct cryptography API misuse detection rule, can meet the use demand of programming, testing and security analyst.