243 results about "Network activity" patented technology

The invention provides a remote office network security protection method and system based on big data, and the method comprises the steps: firstly obtaining network activity data, including traffic, equipment states and user behavior data, of a plurality of terminal equipment in a remote office scene, and then carrying out the multi-dimensional security feature analysis of the network activity data, after a dynamic security feature set containing traffic, device fingerprints and behavior pattern features is generated, abnormal behaviors are identified through a multi-layer anomaly detection model, a detection result with an anomaly type and confidence is output, a target protection strategy is matched from a preset library according to the result, the weight is dynamically adjusted in combination with the anomaly confidence, and a real-time protection strategy instruction is generated. And finally, executing a protection strategy instruction to synchronously regulate and control network connection, equipment permission and a user access path, and feeding back regulated and controlled network state data to optimize abnormal identification logic, thereby realizing comprehensive and intelligent remote office network security protection.

Various disclosed embodiments are directed to deriving, via a language model, a summary of data by converting or encoding table data into one or more natural language sentences, which are then used as input to the language model for generating the summary. One or more embodiments are additionally or alternatively directed to deriving, via a language model, a response to a user question or command via a chat interface by providing the language model with the generated summary as input. In this way, for example, the language model can use the summary as a prompt or other target context for providing a response.

Techniques for detecting and protecting claimable non-existent domains are disclosed. A system, process, and / or computer program product for detecting and protecting claimable non-existent domains includes monitoring network activity using a network security device, detecting that a session is querying a claimable non-existent domain using a domain name system (DNS) security service, and performing an action in response to the session querying the claimable non-existent domain.

Media, methods, and systems are provided for matchmaking for in-person, virtual, and hybrid events are disclosed. Event attendees may be added to a networking pool When the networking pool reaches a capacity, the event attendees may be added to other event attendees. Networking events may be one-to-one meetings or group meetings. Group meetings may be dedicated to a topic. Event attendees may be matched to other attendees or to a group meeting based on interest and behavioral data associated with the event attendee. When the networking event ends, the event attendees may be added back into the networking pool for further networking events.

The present disclosure relates to a user equipment comprising the following. Processing circuitry of the UE operates a monitoring function that involves monitoring for reception of a first downlink control information, DCI, message on a downlink control channel, wherein the first DCI message is for informing the UE on activation or deactivation of a network-side discontinuous transmission and / or reception, DTX / DRX, function. The processing circuitry monitors for reception of the first DCI message in one or more monitoring occasions during a first DCI monitoring window associated with a network active time period of the network-side DTX / DRX function. The processing circuitry monitors for reception of the first DCI message in one or more monitoring occasions during a second DCI monitoring window associated with said network active time period, said second DCI monitoring window being subsequent to the first DCI monitoring window.

Systems and methods of generating fraud detection models and controlling network permissions of one or more systems within a network environment are disclosed. A network activity dataset comprising data representative of network activity within a network environment is received and at least one co-controlled system in the network activity dataset is identified by implementing a trained fraud detection model configured to receive the network activity dataset and output a fraud determination for each system having at least a first role in the network activity data. The fraud determination represents a likelihood of a system having the first role engaging in a co-controlled network activity. In response to identifying the at least one co-controlled system, one or more permissions of the at least one co-controlled system for operating within the network environment are modified.

The invention relates to the technical field of network security, and discloses a network traffic anomaly detection method and system based on a knowledge graph, and the network traffic anomaly detection method comprises the following steps: protocol perception metadata feature extraction: extracting metadata features which do not involve content privacy from encrypted network traffic through a deep packet inspection technology, comprising flow statistical characteristics, time sequence characteristics and connection relation characteristics; multi-level knowledge graph construction: based on the extracted metadata features, according to a network architecture, respectively constructing corresponding knowledge graphs on a device layer, a gateway layer and a cloud layer, and respectively representing device behaviors, network activities and global security information; the method does not depend on flow decryption operation, effective recognition of abnormal behaviors in the encrypted flow is achieved only by analyzing the metadata features of the network flow, and therefore the detection accuracy is improved.

The invention relates to the technical field of network communication and route management, in particular to an intelligent router flow management method for a home scene, which comprises the following steps that: a home router collects network activity data of equipment, including data flow size, connection frequency and equipment type, performs cleaning and formatting processing, and stores the data flow size, the connection frequency and the equipment type; formatted device behavior data is generated. According to the method for analyzing the behavior data of the home network equipment based on the long and short-term memory network, the prediction precision of the periodicity and dependency of user behaviors is improved, and the allocation of bandwidth resources is more prospective and dynamic. Specifically, resources can be automatically adjusted according to predicted data requirements, and particularly in the peak period of requirements, it is ensured that key applications such as video conferences and online education preferentially obtain necessary network resources. According to the flow management technology, the overall operation efficiency of the network is improved by optimizing bandwidth utilization and reducing network congestion.

Risk engine using key performance indicators, including: monitoring network activity associated with a customer to identify one or more infrastructure risks; calculating, based on the identified one or more infrastructure risks, a key performance indicator (KPI); and presenting, via a user interface, a comparison of a risk metric associated with the customer to one or more other risk metrics corresponding to one or more cohorts of the customer selected based on a variable input to a user interface element of the user interface.

The invention relates to the technical field of information resource security management, and particularly discloses a security management method and system based on computer information resources and a storage medium, and the method comprises the steps: obtaining user identification information of a user, extracting a reference evaluation information set, analyzing a user behavior abnormal evaluation value, and judging a user behavior tag. If the user behavior label is judged to be in a potential risk mode, communication end current limiting is carried out, abnormal secondary verification is started, a user behavior abnormal verification evaluation value is analyzed, user behavior label re-judgment is carried out, and user permission locking measures are determined. Potential risks can be perceived in time, the situation that potential safety hazards are gradually expanded under the condition that the potential safety hazards are not perceived is avoided, and the user permission locking accuracy is improved. For a potential risk mode, communication end current limiting is carried out and secondary verification is started, so that network activities of abnormal users are effectively limited, security risks are reduced, the risk degree of user behaviors is comprehensively and accurately judged, and the stability of the system and the security of information resources are guaranteed.

Techniques are disclosed for providing a context-aware description of anomalous behavior in a computer network. According to one embodiment of the present disclosure, a description of an anomaly detected in computer network activity is received. The description includes one or more features of the computer network associated with the anomaly. Contextual information relating to at least one of the features is generated based on a logical network topology. The logical network topology specifies a plurality of network traffic attributes of the computer network. An alert that includes a second description of the anomaly and the contextual information is generated.

An illustrative method for performing a risk scenario assessment and remediation may include identifying, based on posture data associated with a compute environment, one or more compute resources deployed in the compute environment that are configured to be connected to a network, accessing runtime workload data associated with the one or more compute resources representative of network activity for the one or more compute resources, and performing, based on the posture data and the runtime workload data, a remediation operation associated with the one or more compute resources.

A system and method for adaptive neural network architecture with real-time neurogenesis capabilities during inference operations. The system processes data through a core neural network with integrated supervisory and neurogenesis control systems. A hierarchical supervisory network, comprising low-level, mid-level, and high-level nodes, monitors network activity patterns and information flow. The neurogenesis control system maintains continuous activity maps, detects processing bottlenecks, and determines optimal placement of new neurons using geometric optimization. A modification subsystem implements controlled neurogenesis operations while maintaining network stability. The system handles data through adaptive codeword allocation and fusion of dissimilar data types. This sophisticated approach enables neural networks to dynamically expand their processing capacity during operation, responding to detected bottlenecks while maintaining operational stability through carefully managed integration of new neurons.

The embodiment of the invention provides a zero-trust security access control system and method. Relates to the technical field of cloud services. The system comprises a zero-trust client, a zero-trust access gateway, a zero-trust control center and a zero-trust access control gateway, and the zero-trust client is used for collecting user terminal information, user behavior information and environment information; the zero-trust control center is used for issuing an admission permission command to the zero-trust admission gateway according to a preset security admission strategy; and, according to a preset access control authority, issuing a command whether to allow access to the zero-trust access control gateway, the zero-trust access gateway is used for allowing the zero-trust client to connect according to the access command; and the zero-trust access control gateway is used for allowing the zero-trust client to access the target application according to the access command. The method is used for achieving comprehensive visibility of user behaviors and network activities in a cloud desktop scene, and the effect of improving user experience is achieved.

This disclosure relates to systems, methods, and devices for identifying anomalous network activity. In some embodiments, a baseline model is used for identifying anomalous network activity. In some embodiments, anomalous network activity is detected based on a z-score, modified z-score, or both being above respective thresholds when compared to the baseline. In some embodiments, multiple baseline models are used, and anomalous network activity is detected when multiple baseline models identify a network activity session as anomalous. In some embodiments, two baseline models are used.

A system configured for cooling electronic devices comprises a pair of opposing, active manifolds that control a flow of cooling liquid through pipes or through an immersion tank past the electronic devices. A controller detects and / or predicts localized hotspots and adjusts flow control devices associated with inlets and outlets of the manifolds to direct proportionately more cooling liquid to the hotspots. The flow control devices can be any combination of variable speed pumps and / or adjustable valves, vents, and / or baffles. Manifolds can be placed on two opposing sides of the devices, on four opposing sides, and / or above and / or below the devices. Temperatures proximate the devices can be measured by separate sensors and / or sensors integral to components of the electronic devices. Hotspots can be predicted by monitoring current flows, power flows, and / or voltages of the electronic devices, and / or inferred from network activity and / or from a workload queue.

The invention relates to the technical field of computer system monitoring and data acquisition, and discloses a multi-platform data acquisition method based on eBPF, which is suitable for Windows, Android and Linux operating systems. The method comprises the following steps: firstly, loading eBPF programs on different platforms to capture kernel events so as to realize comprehensive monitoring on system calling, network activities and file operation; next, standardizing the collected kernel event data by expanding a data processing function of a user mode application program, and transmitting the standardized kernel event data to a cross-platform data processing interface; in order to ensure the security of data transmission, an encryption protocol is introduced to protect multi-platform data. Finally, the transmitted data will be centrally stored and analyzed in order to detect system anomalies and potential security threats. By applying the eBPF technology, efficient data collection and safe data transmission are achieved in a multi-platform system, and the safety and reliability of multi-platform kernel event monitoring and data analysis are effectively improved.

The invention discloses a network attack tracing method, device and equipment and a medium, and the method comprises the steps: obtaining a plurality of network flow data packets, a plurality of pieces of weblog data and a plurality of equipment state parameters of a plurality of monitoring nodes in a target network domain; determining an abnormal node with a network attack behavior in the plurality of monitoring nodes based on the plurality of network flow data packets, the plurality of pieces of network log data and the plurality of equipment state parameters; and tracing the network attack behavior based on the abnormal data packet of the abnormal node, the abnormal weblog data and the abnormal equipment state parameter to obtain an attack type, an initial attack node and an attack path of the network attack behavior. The collaborative analysis value of data packet deep features and multi-source equipment information is fully utilized, real threats and normal network activities are accurately distinguished, and the traceability accuracy and reliability are remarkably improved. Meanwhile, through correlation analysis of multi-dimensional data, an attack source positioning range can be converged step by step, and an attack path can be completely reconstructed.

An exemplary method, for preventing an outage in a network, includes collecting network metrics and producing statistical features of the network during a predetermined time window based on statistical analysis of the collected metrics. The method further includes selecting, from the produced statistical features, a first data set of relevant statistical features. Further, the method includes collecting information about a past event, extracting event data from the past event, and vectorizing the extracted event data to form a second data set. The method further includes concatenating the first data set and the second data set to form a third data set and classifying the third data set relative to a model of historical network performance to determine a probability of the outage. Further, the method includes modifying, in response to the probability being above a threshold, the network / activity within the network to avoid onset of the outage.

Systems and methods for scanning network activity. The methods include receiving at an interface connection data regarding a plurality of network connections, wherein the connection data includes a signature used to classify each of the plurality of network connections; determining, using one or more processors executing instructions stored on memory to provide a signature analysis engine configured to analyze the connection data, the signature is prohibitively prone to misclassifying network activity as malicious, wherein the determination is based on the analysis of the connection data; and implementing a signature policy to prevent the signature from misclassifying network activity as malicious.

The invention discloses a complex equipment risk management and control method, system and device and a medium, and relates to the technical field of complex equipment development management risk management and control. The method comprises the following steps: constructing a multi-parameter CF-GERT network model which plays a role in event success probability according to the background of an actual development project and in combination with a milestone event for examining complex equipment development nodes; basic parameters in the network activity are collected, the distribution type of each parameter variable is estimated, the product of the transfer probability between a characteristic function and nodes is used as an equivalent transfer function in a multi-parameter CF-GERT network model, and the equivalent transfer probability of an equipment development project is determined based on a signal flow graph and a mature conclusion of a Meisson formula; and performing inversion according to the property of the equivalent transfer probability to obtain transfer variable related data of each parameter which plays a role in the project success probability in the event, and performing balanced optimization on each performance index of the equipment development project. According to the method and the system, the traditional GERT network can be optimized, so that the risk management and control of complex equipment can be realized.

Disclosed herein are methods and systems for identifying malicious network activity. In an embodiment, a method comprises monitoring, by a computer, network activity of a user having a baseline network activity; executing, by the computer, a machine learning model to determine a network activity score indicating a likelihood of the network activity being malicious activity for the baseline network activity, the machine learning model having been previously trained based on malicious activity and corresponding baseline network activity; and displaying, by the computer, the network activity score.

The invention discloses a network attack path deduction method and device based on a large language model, equipment and a medium, and relates to the technical field of network security, and the method comprises the steps: generating each initial deduction result corresponding to a current abnormal network activity through employing a target large language model and a beam search algorithm; verifying each initial network attack deduction path by using a target knowledge graph to obtain a target confidence degree corresponding to each initial network attack deduction path; and determining a target network attack path with the highest target confidence from the initial network attack deduction paths, and determining an initial deduction result corresponding to the target network attack path as a target deduction result so as to display the target deduction result by using a time sequence animation. The initial network attack deduction path is generated by using the large language model, and the target network attack deduction path is determined based on the knowledge graph, so that the problem that complex and changeable attack techniques cannot be adapted due to rule engine stiffness is solved.

A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.

The invention belongs to the technical field of network attack and defense simulation, and discloses a network attack and defense simulation engine system based on discrete event driving, which comprises an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module and a panoramic situation awareness module, the event scheduling module is in the form of MITRE ATTamp; the CK is constructed as a theoretical base and is used for converting all network activities into a dispatchable discrete event sequence; the network activities comprise data packet sending, protocol timeout and attack triggering; and the simulation network construction module can construct a simulation network containing complete service logic. According to the application, the MITRE ATTamp is scheduled by the event scheduling module; the CK tactical intention is converted into an ordered event stream, a hierarchical task network planner in the attack and defense simulation module dynamically decomposes and re-plans a high-level target, and ATTamp can be utilized; and the CK technology ID reconstructs an attack chain in real time.

The embodiment of the invention discloses a construction method, device and equipment of an intrusion detection model. When the method provided by the embodiment of the invention is executed, firstly, a distributed architecture capable of realizing parallel computing of the intrusion detection task of the power internet of things can be established; and constructing a self-adaptive neural network model, and deploying the self-adaptive neural network model to the computing node of the distributed architecture to obtain a target node. And then active and passive combined network detection and data sensing tasks are distributed to the target node, so that context sensing data of all devices in the electric power Internet of Things are obtained. And inputting the context sensing data into the adaptive neural network model to obtain an intrusion detection model. According to the method, the distributed architecture is constructed, the computing resources of multiple computing nodes are fully utilized, the adaptive neural network model is constructed, and the mode of combining active detection and passive detection is combined, so that the network activity and data traffic in the power Internet of Things are comprehensively monitored and perceived, and the coverage range and accuracy of intrusion detection are improved.

A method and system for detecting anomalous network activity in a cloud-based compute environment. The method comprises receiving configuration data and network activity observations for a set of virtual entities in the cloud-based compute environment; creating a profile for each virtual entity in the set of virtual entities, when the virtual entity does not already have an associated profile; dynamically updating the virtual entity of a profile with the respective network activity observations of the virtual entity; and determining whether anomalies have been detected.

The invention discloses an alarm causal association attack investigation method fusing honey point intelligence, which comprises three steps of benign database construction, abnormal score calculation and alarm point association. The method comprises the following steps: firstly, collecting an original audit log, normalizing the original audit log into a triple format, constructing a traceability graph, and constructing a benign database; then obtaining an audit log to be detected, normalizing the audit log to be detected into a triple format to construct a traceability graph to be detected, and comparing the traceability graph to be detected with the benign database to calculate an event occurrence frequency of a system event to be detected; calculating a weight score for each to-be-detected system event in combination with honey point information; and finally, reading an alarm point from the to-be-detected audit log, constructing a weighted traceability graph to perform backtracking causal analysis, and finding an attack entry point by using a depth-first search algorithm. And forward analysis is carried out to restore a complete attack scene graph. According to the method, the key attack path can be positioned more quickly, the whole network activity does not need to be comprehensively analyzed, and computing resources and analysis time are saved.

The invention discloses a closed-loop feedback target extraction method based on a frontal top electroencephalogram network activity reference model, and relates to the fields of neural information decoding, neuroscience application and brain-computer interfaces. According to the method, the problem of insufficient target selection and feedback regulation and control precision in traditional electroencephalogram closed-loop feedback is solved, and a new electroencephalogram network target extraction mode which is good in ecological property and high in robustness is provided. The method mainly comprises the steps that firstly, a brain network path closely related to memory cognitive function abnormity of mild cognitive impairment (MCI) is extracted in a natural film watching state, network characteristics are refined in combination with metabolic map information, a new brain network target fed back by a real-time electroencephalogram closed loop is formed, and the ecological property of the target and the pertinence of feedback are remarkably improved. Besides, based on a large amount of normal elderly group electroencephalogram data, a frontal top electroencephalogram network activity reference model of the normal elderly group in a movie recalling state is constructed, key feedback indexes are extracted by using a machine learning algorithm, real-time evaluation of the relative performance level of MCI individuals is realized, and the accuracy of evaluation is improved. And a technical support is provided for improving the cognitive function of the MCI patient.

A method of identifying anomalous network activity. The method includes identifying, based on network data representative of network activity within a network, at least one instance of a sequence of events that occurred within the network. A probability of the sequence of events occurring during non-anomalous network activity is obtained based on transition probabilities between events in the sequence of events. A frequency characteristic dependent on a frequency at which the sequence of events occurred within the network is determined. A likelihood of the sequence of events occurring within the network at the frequency is determined based on a combination of the probability and the frequency characteristic. It is identified, based on the likelihood, that at least a portion of the network data is anomalous.