77 results about "Multiple attack" patented technology

The embodiment of the invention provides a coupling network asynchronous dynamic intermittent safety control method and system, and the method comprises the steps: obtaining multiple attack signals comprising an injection attack signal and a replacement attack signal after building a dynamic model of a following network, a target network and a state error variable; and setting an intermittent controller according to the dynamic network model and the multiple attack signals, and setting a dynamic mechanism based on an exponential function to convert a state error variable into an interval control function. Wherein the interval control function is used for realizing security mean square synchronization control between the following network model and the target network model. According to the method, the asynchronous anti-attack intermittent dynamic cooperative control strategy oriented to the complex coupled network can be constructed based on an average intermittent control rate and dynamic event trigger threshold coupling method by utilizing a node self-adaptive dual spoofing attack probability model, and the problems of difficulty in multi-attack modeling and insufficient control strategy collaboration can be relieved.

A computer-implemented method for monitoring a computer network is provided, the method comprising: storing a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; storing one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determining a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generating a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitoring events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. A computer system including at least one processor and memory storing computer program code configured to perform the said method, and a computer program or computer readable medium comprising instructions that when executed by a computer system cause the computer system to perform the said method are also provided.

The invention discloses a side channel attack method and attack system based on manifold learning. The method comprises the following steps: collecting a target power consumption trace of a target chip during operation, a corresponding sub-key set and a clone power consumption trace of a clone chip; according to the cloned power consumption trace, obtaining an explicit mapping relation function by depicting an explicit manifold learning model, and constructing a plurality of attack templates through Hamming weight classification; based on the explicit mapping relation function and the attack template, calculating the product of the probability density value of each sub-key; and taking the sub-key with the product of the maximum probability density value as a correct key so as to realize side channel attack based on manifold learning. According to the method, the explicit mapping relation function is obtained by depicting the explicit manifold learning model to perform dimension reduction and feature extraction on the target power consumption trace, so that complex interest point selection can be replaced, the complexity of attacking the password chip protected by the mask is reduced, and the attack success rate is also greatly improved.

The invention discloses a large model output data security detection method and system based on adversarial attacks. The method comprises the following steps: constructing and optimizing a strategy space containing a plurality of attack strategies, and grading and sorting the strategies to improve the attack efficiency; generating a single-strategy antagonism prompt by the attack model according to the optimized strategy space, and performing effectiveness evaluation and feedback correction on the prompt by the judgment model; inputting a prompt passing the evaluation into the target large model to obtain a response, and performing malicious degree scoring on the response by the judgment model; and if the single-strategy attack is not successful, introducing an optimization mechanism based on a genetic algorithm, generating a more complex multi-strategy antagonism prompt through strategy variation and crossover, and carrying out iterative attack until the target large model is successfully broken into the prison. According to the method, the security defects of the large model can be efficiently and comprehensively detected in a self-adaptive and multi-strategy attack mode.

The embodiment of the present application provides a method and system for asynchronous dynamic intermittent safety control of a coupled network. The method can obtain multiple attack signals including injection attack signals and replacement attack signals after establishing a dynamic model of a follower network, a target network, and a state error variable, and set an intermittent controller according to the dynamic network model and the multiple attack signals, and then set a dynamic mechanism based on an exponential function to convert the state error variable into an interval control function. The interval control function is used to achieve safe mean square synchronization control between the follower network model and the target network model. The method can utilize a node-adaptive double deception attack probability model, based on the average intermittent control rate and the dynamic event trigger threshold coupling method, to construct an asynchronous anti-attack intermittent dynamic collaborative control strategy for complex coupled networks, which can alleviate the difficulties in modeling multiple attacks and the lack of coordination of control strategies.

The invention provides a Chinese large language model safety evaluation system and method based on dynamic extension and a bottom-taking mechanism, and belongs to the field of natural language processing and artificial intelligence. On the basis of an existing benchmark test data set, an attack test data set is generated by combining a large language model with multiple attack methods, and attack test data is generated for a request rejected to respond by the model by utilizing a fine-tuned expert model through a bottom-out mechanism; constructing a corresponding false positive test data set, inputting the attack test data set and the false positive test data set into the Chinese large language model to be evaluated, and reasoning to obtain an output result; and finally, carrying out multi-dimensional evaluation on an output result and automatically generating a report. The method has good expandability and adaptability, a test data set can be dynamically expanded, emerging security threats can be followed up, and anaphylaxis and generation of harmful content can be effectively avoided; and a more flexible, comprehensive and efficient solution is provided for security assessment of the Chinese large language model.

The invention provides an attack data generation and large model training method and device, equipment and a storage medium, and belongs to the technical field of artificial intelligence, and the method comprises the steps: inputting guide content into an attack language model to obtain an attack prompt, determining the attack prompt with the highest attack success rate as a target attack, and collecting attack data related to the target attack prompt. According to the method, the attack language model is excited by the initial guide content to generate diversified attack prompts, and the most effective attack prompt is screened out based on the attack success rate to serve as the target attack prompt for data collection, so that various attack prompts can be automatically generated, and the workload of manually designing the attack prompts is reduced; in addition, the validity and quality of the collected attack data can be ensured through a screening mechanism, and a rich and accurate data basis is provided for subsequent model security evaluation and attack strategy optimization, so that potential vulnerabilities of the target language model can be found more comprehensively, and the security and reliability of the model are improved.

The invention belongs to the technical field of network security detection, and particularly relates to a QinQ network security test method and system, a terminal and a storage medium, and the method comprises the steps: constructing a QinQ network security test environment comprising an attack simulation module, a traffic monitoring module and a security evaluation module; the method comprises the following steps: generating a test data packet containing multiple attack types through an attack simulation module, injecting the test data packet into a to-be-tested QinQ network, collecting processing behavior data of the QinQ network on the test data packet in real time through a flow monitoring module, analyzing the processing behavior data through a security evaluation module, and generating a security score and a vulnerability report of the QinQ network; s4, optimizing a label verification mechanism and an access control strategy of the QinQ network according to the vulnerability report, and repeatedly executing the steps S2 to S4 until the security score reaches a preset threshold value; and the security protection capability of the QinQ network on a label processing layer can be comprehensively detected.

The invention relates to a recognition method and device for an attack path of a vehicle, the vehicle and a storage medium, and the method comprises the steps: generating a data flow diagram of a target vehicle through the system data of the target vehicle, defining components in the data flow diagram, so as to determine a dependency relationship and attributes between the components, converting the data flow diagram into an attribute diagram in combination with the dependency relationship and attributes; inputting the attribute graph into a pre-constructed path recognition model to obtain a plurality of attack paths of the target vehicle; and carrying out attack feasibility scoring on the plurality of attack paths, and bringing the high-risk attack paths meeting a preset high feasibility condition into a calculation pool so as to screen out a target attack path from the calculation pool. Therefore, the technical problems that in the related technology, for a complex data flow diagram, part of attack paths are easy to omit through manual identification, so that the finally identified attack path is not necessarily optimal, the formulation of final security measures is influenced, and the network security of the vehicle is not favorably guaranteed are solved.

The present disclosure relates to a network attack identification method and device and electronic equipment, and relates to the technical field of network security, wherein the method comprises: acquiring network security data of a network asset, constructing a knowledge graph of the network asset based on the network security data, and performing detection rule conversion processing based on the knowledge graph to generate corresponding attack detection rules; detecting whether the rule features of the attack detection rules can correctly identify attack behaviors or abnormal behaviors, and detecting whether the rule coverage of the attack detection rules meets the expected detection target; if the rule features can correctly identify attack behaviors or abnormal behaviors, and the rule coverage meets the expected detection target, then attack subgraphs for different network assets are generated based on the attack detection rules, so as to identify network attacks against different network assets by using multiple attack subgraphs. Through the present scheme, attack behaviors of specific assets can be effectively associated, and threats and attack scenarios faced by specific assets can be comprehensively understood.

This application provides a network attack defense method, apparatus, intrusion detection device, and storage medium. Applied to an intrusion detection device, the device maintains multiple attack rules, each labeled with an attack chain tag. The attack chain tag indicates the attack chain to which the attack rule belongs. The method includes: performing intrusion detection on network traffic to determine a first attack rule that the network traffic has hit; the first attack rule is labeled with a target attack chain tag; querying at least one second attack rule labeled with the target attack chain tag from the multiple attack rules; sending the first and second attack rules belonging to the same attack chain to a firewall, so that the firewall performs attack defense according to a protection policy; the protection policy is generated based on the first and second attack rules. The firewall can also perform pre-defense against subsequent attack behaviors based on the attack rules associated with the attack chain, thereby improving the firewall's defense effectiveness.

The invention relates to an attack prediction model training method and device of a power secondary system, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: generating a plurality of pieces of attack chain data according to attack alarm data of each security device in the power secondary system; taking the last attack action information in each piece of attack chain data as a target label of each piece of attack chain data, and taking other attack action information in each piece of attack chain data as input data of each piece of attack chain data; the other attack action information is attack action information except the last attack action information in each piece of attack chain data; and taking each piece of attack chain data as a training sample, and training the attack prediction model of the power secondary system according to the target label and the input data to obtain the trained attack prediction model of the power secondary system. By adopting the method, the prediction performance of the prediction model on multi-step attacks can be improved.

The present invention relates to the technical field of digital information transmission, and in particular to a method for reconstructing a network attack scenario based on device fingerprints in a 5G private network scenario, which includes the following steps: capturing the traffic that triggers the alarm and storing it as a pcap package, generating a list of data packets corresponding to each IP address and traffic; marking the network flow through a five-tuple of <source address, destination address, source port, destination port, timestamp>; extracting the direction and length of the traffic in the network flow as a temporary fingerprint; extracting temporary fingerprints with similar time from a fingerprint database, determining the twin IP, and thus outputting a twin IP list of the attacked IP address; searching for related attack fragments based on the twin IP list, associating multiple attack fragments, and reconstructing the attack scenario. The present invention can associate multiple attack fragments and restore the complete attack scenario without relying on the access rights of the control plane network element, thereby helping analysts to carry out analysis activities such as attack classification and attack prediction.

The present invention discloses a threat detection method, device and equipment based on an APT attack graph. The method of the present invention includes the steps of APT attack graph generation, intrusion alarm collection, attack path identification, APT attack detection, and evidence chain reconstruction. The present invention reduces the real-time attack analysis overhead by designing an APT attack graph and pre-analyzing attack actions according to network and system information; evaluates attacks from multiple angles such as harmfulness and necessity to ensure the comprehensiveness of threat detection, and designs an attack path scoring method to achieve global attack analysis; associates attack behavior traces to form an evidence chain, and uses a gray list to associate multiple attack entities to achieve accurate positioning of the attack impact range. By combining the three capabilities of APT attack prediction, detection and monitoring, the problem of threat alarm fatigue is effectively combated, and the robustness of zero-day vulnerability exploit detection is improved, so that the present invention can efficiently and accurately detect APT attacks.

The present application relates to the field of game technology, and in particular to a method, device, equipment and medium for determining the position of a target object in a game scene. In the method, a server receives multiple attack requests for a target object sent by multiple clients, determines a first attack request as a reference, and a target client; sends first information to the target client to instruct the target client to determine the knockback position of the target object, thereby solving the server load problem; the server receives the knockback position sent by the target client, and sends second information carrying the knockback position to other clients in an area of ​​interest, thereby instructing any other client to display the target object at the knockback position on its own client, thereby solving the problem of inconsistent position of the target object in the game scene and the problem of server network bandwidth delay, thereby reducing game delay and improving the user's gaming experience.

A method, system, and computer-readable media for modeling cyberspace operations and the effects thereof. Network and connectivity data for an operational environment model may be retrieved from a network scan. Likelihood data that a network element takes a plurality of possible configurations may be mapped. Determination of a probability of effect of a capability acting on the network element may be based on the likelihood data and uncertainties associated with the capability. Multiple attacks within the operational environment model may be modeled to determine an attack path therethrough. Functional modeling techniques to model functional impacts of attacks on an operational environment model are also disclosed.

The invention provides a network attack model training and detection method and device, electronic equipment and a medium, and relates to the technical field of network security. According to the specific implementation scheme, based on a preset causal relationship mechanism, a connection relationship between two nodes which are the same as any relationship in the causal relationship mechanism is searched in log data of a target network, and a plurality of connection relationships are obtained; based on the multiple connection relations, a first causal relation graph is constructed, and the first causal relation graph comprises multiple nodes and multiple edges formed by connecting every two nodes; deleting nodes and edges related to the non-attack chain in the first causal relationship graph to obtain a second causal relationship graph; based on the second causal relationship graph, multiple attack sequences are determined, the attack sequences comprise triple events arranged according to the time sequence, and each triple event comprises a source node, an edge and a destination node; and training to obtain a target network attack model based on the plurality of attack sequences.

The invention relates to the technical field of data security, and discloses a power relay protection device attack defense method and device, and the method comprises the steps: distributing a budget of a power relay protection device and a system-level budget, and taking the minimum expected energy loss of a system as an optimization target according to the failure probability of the power relay protection device. Therefore, the defense capability of each power relay protection device is improved, a power relay protection device set with the maximum system loss is determined by taking the system loss maximization in multiple attack scenes as a target, and the system loss of the system in the worst attack scene is minimized in combination with a defense budget distribution layer and an attack strategy analysis layer. And minimization of the recovery time after the system is attacked is taken as an optimization target, so that the protection capability of the system when multiple relay protection devices are attacked at the same time is improved, and the problem that the defense effect is insufficient in a complex and changeable attack scene in the prior art is solved.

The invention belongs to the technical field of terminal security, and discloses an attack detection method and device, equipment and a storage medium. According to the method, the process behavior of the target process is matched with the initial detection condition of each preset attack behavior chain; if the initial detection condition is successfully matched with the initial detection condition of any preset attack behavior chain, taking the successfully matched preset attack behavior chain as a target behavior chain; constructing a detection condition list according to the target behavior chain; and if the subsequent process behavior of the target process meets each detection condition in the detection condition list, judging that the high-risk attack is detected. The process behaviors of the processes in the terminal are monitored and matched with the multiple attacks included in the preset attack behavior chains corresponding to the advanced threat programs, so that it is ensured that the terminal can find whether high-risk attacks exist or not in advance, misjudgment of single behavior detection is avoided, and the safety of the terminal is improved. Therefore, the terminal can automatically detect whether the attack exists or not, and the dependence on the server is reduced.

The application provides a few-shot attack mode recognition method based on a large language model, comprising: constructing a classification prompt for recognizing a to-be-recognized attack behavior data instance to obtain a coarse classification label; constructing a pseudo-instance generation prompt for generating a pseudo-instance related to the coarse classification label; combining the to-be-recognized attack behavior data instance, the coarse classification label and the pseudo-instance to construct a few-shot reference example; obtaining a fine classification label according to the few-shot reference example; and sorting the fine classification label to obtain a relevance sorting result of an attack mode recognition label and the to-be-recognized attack behavior data instance. The method improves the recognition accuracy of complex and rare attack modes through the construction of a few-shot classification reference example and the recognition of a fine classification label. The method can recognize multiple attack mode recognition labels related to a specific attack behavior from multiple-source heterogeneous attack behavior data, and improves the accuracy and flexibility of attack behavior threat analysis.

The invention discloses a communication resource allocation method based on a master-slave game, and belongs to the technical field of communication, and the method comprises the steps: building a master-slave game model between a system model and a multi-attack model through optimizing an attack strategy and a defense strategy; according to the defense strategy, the attack strategy set and the attack revenue function, taking defense revenue minimization as a first optimization target, and calculating an optimal attack strategy; according to the optimal attack strategy, the defense strategy set and the defense revenue function, by taking defense revenue maximization as a second optimization target, calculating an optimal defense strategy; and solving a second optimization target to obtain an equilibrium solution of the master-slave game model, determining a synchronization coefficient of a tie line, constructing a coefficient matrix of a state space of a control region, and calculating a control gain which enables the control region to be asymptotically stable. The problems that in the prior art, when an attack occurs, a resource allocation strategy cannot be adjusted in time, and attack damage is difficult to defend are solved.

The invention belongs to the technical field of network security, and particularly relates to a Web application firewall vulnerability detection method based on load variation injection. Comprising the following steps: constructing a unified attack grammar rule base covering multiple attack types; analyzing the original attack load into an abstract syntax tree; carrying out semantic reservation load variation based on the syntax tree to generate a semantic equivalent variation load; performing protection rule detection on the Web application firewall, analyzing a detection result and performing pruning operation on the syntax tree; a Monte Carlo tree search algorithm is utilized, a rule detection mechanism is combined, and a variation path with a high success rate is dynamically evaluated and preferentially tested so as to efficiently generate an antagonistic load capable of bypassing WAF detection; according to the method, the problems of attack failure, low black box test efficiency and insufficient coverage of a single attack type caused by semantic destruction in the prior art are solved, and the WAF rule base vulnerability can be systematically evaluated.

The utility model relates to the technical field of fighting robots, and provides a bionic multi-weapon fighting robot which comprises a robot body, walking wheels, a driving mechanism, weapon arms, first motors and attack wheels, the walking wheels are rotationally connected to the robot body, the two first motors are arranged above the front ends of the two weapon arms respectively, and the driving mechanism is connected with the attack wheels. The first motor is in driving connection with the attack wheels, a plurality of oblique teeth are arranged on the circumferences of the attack wheels at intervals, the two attack wheels are located below the front ends of the two weapon arms correspondingly, impact blocks are arranged at the front ends of the weapon arms, the rear ends of the two weapon arms are hinged to the front end of the machine body correspondingly, and the driving mechanism is arranged on the machine body. The driving mechanism is in driving connection with the two weapon arms and used for driving the two weapon arms to be close to and separated from each other. The attack function that clamping attack is carried out through the two weapon arms, grinding or smashing and other damage is carried out through the attack wheel is achieved, the attack diversity is improved, multiple attack actions are carried out at the same time, and the attack effectiveness is also guaranteed.

A method, apparatus, and computer-readable storage medium for voiceprint spoofing defense include: acquiring a speech signal to be verified; extracting multi-dimensional features from the speech signal to obtain a multi-dimensional feature vector, wherein the multi-dimensional feature vector includes at least speech text content features, identity features, sound quality features representing recording or synthesis traces, liveness features representing the physiological characteristics of the sound source, and adversarial perturbation features; fusing the multi-dimensional feature vector to obtain a joint feature vector; inputting the joint feature vector into a pre-trained joint risk decision model to obtain a spoofing risk score; and determining the verification result of the speech signal to be verified based on the comparison result of the spoofing risk score and a preset threshold. This application can effectively detect multiple attack modes such as replay attacks, speech synthesis attacks, and adversarial example attacks simultaneously; and accurately detect high-quality spoofing attacks.

The present disclosure provides a data processing method, apparatus, device, and machine-readable storage medium, the method comprising: receiving security alarm logs; grouping security alarm logs associated with the same attack source IP into a group, calculating the attack characteristics associated with the attack source IP associated with each security alarm log in the group according to preset rules based on the security alarm logs in the same group; performing clustering calculations based on the attack characteristics associated with each attack source IP, and obtaining an attacker profile based on the calculation results. Through the technical solution of the present disclosure, the security alarms reported by the security device are analyzed based on the attack events of each attack source, and the attack behavior characteristics of the attack source on a single target are extracted. The attack behavior of the attack source on multiple attack targets is then calculated and analyzed, and the attack behavior characteristics of the attack source are extracted. On this basis, each attack source is classified using clustering calculations, and finally an attacker profile is obtained, which is efficient and accurate.

The invention discloses a method for determining the number of attacks. The method comprises the following steps: acquiring a plurality of target objects to be attacked by a first object; numbering the plurality of target objects to obtain a plurality of pieces of number information corresponding to the plurality of target objects; in response to the multiple pieces of number information, acquiring a first time period when the first object attacks any first target object in the multiple target objects starting from the target position; after the first target is attacked, acquiring a plurality of second time periods when the first target attacks a plurality of target objects except the first target object; acquiring a plurality of attack values of the first object attacking a plurality of other target objects except the first target object; the technical problem that the number of cluster aircrafts cannot be attacked in a short time due to the fact that the attack sequence of the cluster aircrafts cannot be determined when the airborne fixed directional load attacks the cluster aircrafts is solved.

The invention relates to the technical field of network security, in particular to a network elastic modeling evaluation method and system for multiple attacks, and the method comprises the steps: taking a target system network suffered from external attacks as a tested object, determining the performance index of the tested object, and collecting the performance index data in the operation process of the target system network according to the performance index; drawing a performance index curve according to the performance index data, and confirming key parameters in the performance index curve; constructing piecewise differential equations of different continuous attack time periods and carrying out integral solution; and fitting the target system network performance function by using the performance index data, solving the to-be-estimated parameters through alternate optimization, obtaining a final target system network performance function, and performing quantitative evaluation on the attack influence of each time period by using the final target system network performance function. According to the method, the elastic performance condition of the system under external attacks can be represented more accurately, and a finer improvement strategy is provided for improvement of the elastic capability of the system.

Techniques for providing a confidence rating for an attack technique tag and a guidance for improving the confidence rating are described. An attack technique analytics engine receives telemetry data, a notification that an attack has been detected using an attack detection source, the notification including an attack technique tag indicating an attack technique used in the attack, and attack technique data including a likelihood of a particular attack technique, from among multiple attack techniques, occurring determined using a particular attack detection source from among multiple attack detection sources. Based on the telemetry, the attack technique tag, and the attack technique data, a confidence rating that the attack corresponds to the attack technique is determined. The attack detection source and attack technique are analyzed to determine a guidance for improving the confidence rating, and the rating and guidance are appended to the attack technique tag.

The ammunition is used on a drone interceptor to combat other drones. The ammunition fires a propeller snare. Ammunition comprises multiple charges with separate electric activation for a multiple attack possibility. The rope forms an air barrier from the moment the shot is fired, it allows the target's propeller to become entangled at a short distance. Twisting the rope increases the likelihood of entanglement on the target. The design of the projectile reduces the likelihood of ricochet. Projectile filled with extra length of rope, it increases the likelihood of entangling the target's propeller. The ammunition is attached to the activation unit. The activation unit is attached to the weapon carrier. The low weight of the weapon allows it to be used on small interceptor drone.

A computer-implemented method for monitoring a computer network is provided, the method comprising: storing a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; storing one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determining a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generating a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitoring events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. A computer system including at least one processor and memory storing computer program code configured to perform the said method, and a computer program or computer readable medium comprising instructions that when executed by a computer system cause the computer system to perform the said method are also provided.