2115 results about "Network attack" patented technology

The invention provides a network attack link tracking and threat situation reasoning method based on a knowledge graph, and relates to the technical field of network security, and the method comprises the steps: collecting and processing original data; extracting features and constructing a network attack knowledge graph; performing representation learning by adopting a graph neural network; identifying a time sequence dependency relationship; generating and analyzing candidate attack links; constructing a dynamic Bayesian network model; performing parameter learning by adopting a variational reasoning algorithm; future attack targets and means are predicted. According to the method, the network attack link can be effectively tracked, the future threat situation is accurately predicted, and the network security defense capability is improved.

The invention provides a network attack risk mapping assessment method and system, and relates to the technical field of network attack risks, and the method comprises the steps: collecting a network flow data packet to extract a multi-dimensional attack feature vector, employing a deep neural network to carry out feature learning to obtain an attack type recognition result and an attack intensity assessment value, and constructing an attack feature standard model; based on the attack type identification result and the attack strength evaluation value, combining an asset weight coefficient, a vulnerability hazard level and a vulnerability utilization difficulty coefficient to construct an asset vulnerability evaluation model; and performing association analysis on the real-time attack feature data and the asset vulnerability assessment score, constructing a risk mapping matrix, calculating a comprehensive risk score, and generating risk early warning information. According to the invention, accurate identification, dynamic assessment and timely early warning of the network attack risk are realized, and the accuracy and real-time performance of risk assessment are improved.

The present application relates to the technical field of communications, and in particular to a network security threat processing method and apparatus, and an electronic device. The method comprises: on the basis of acquired local area network data, determining a network security attack type of a network attack event and an association relationship between entities in the network attack event; constructing a knowledge graph on the basis of the network security attack type, the association relationship between the entities in the network attack event and a configuration rule of an initial weight; using any node in the knowledge graph as an initial node, accessing each neighbor node of the initial node along adjacent edges of the initial node, and using a preset algorithm to calculate an initial weight of each neighbor node to obtain a degree-of-maliciousness weight of the initial node; and comparing the degree-of-maliciousness weight with a preset first threshold value, and deleting a node with a degree-of-maliciousness weight thereof being lower than the first threshold value in the knowledge graph, and also deleting the adjacent edges to obtain an updated knowledge graph. The solution can improve the network security threat processing efficiency.

The invention relates to the technical field of information security, in particular to a power distribution Internet of Things cloud side end collaborative interaction security protection system, which comprises a network flow monitoring module, an abnormal flow identification module, a security threat response module, a network attack early warning module, a behavior pattern analysis module and an access authority management module. According to the method, the network flow data is collected and analyzed in real time, the abnormal flow recognition speed and accuracy are enhanced, the security threat response speed and efficiency are improved, measures are taken in time at the early stage of a problem, the risks of data leakage and network attacks are reduced, and the timeliness of defense measures is improved by combining security threat response and network attack early warning; by analyzing the relevance between threat events, the complex multi-stage attack activity is effectively predicted and identified, the access data and the communication mode of the equipment are monitored in real time, and the access authority and the trust level are adjusted, so that the security protection is more targeted and flexible, and the management efficiency of the risk equipment is improved.

The invention relates to the technical field of network attacks, in particular to a network attack dynamic detection and security protection method and system based on artificial intelligence, and the method comprises the following steps: S1, data collection: collecting a multi-protocol communication data flow of network equipment, and generating a multi-dimensional feature vector; s2, constructing a cross-protocol behavior graph: generating a dynamically updated network behavior graph; s3, anomaly detection: identifying an abnormal behavior mode through the deep residual sequential network, and outputting threat evaluation parameters; s4, protection strategy generation: generating a dynamic protection instruction set through a reinforcement learning decision algorithm; and S5, protection execution: executing the dynamic protection instruction set to complete safety protection operation. According to the method, the multi-protocol fusion behavior graph is constructed, and an abnormal detection mechanism of graph nerve and differential modeling and a dynamic response strategy driven by reinforcement learning are introduced, so that high-precision identification and efficient protection of network attacks are realized.

The invention relates to the technical field of intelligent security operation and maintenance, in particular to an artificial intelligence network security system based on multi-modal large model training, which comprises a server fault diagnosis module, a network attack detection module, an endpoint security monitoring module, a key management optimization module and a threat analysis feedback module. According to the method, the fault prediction accuracy is improved through multi-dimensional data analysis, service interruption caused by sudden hardware faults is reduced, the network access frequency, source and instruction features are evaluated based on the server abnormality, the attack detection accuracy is improved, the misjudgment risk is reduced, the endpoint equipment execution behavior, resource calling and behavior sequence are extracted, and the service performance of the terminal equipment is improved. Fine-grained security monitoring is realized, attack traceability is enhanced, a key strategy is dynamically adjusted, security adaptability is improved, strategy lag risk is reduced, multi-level data is integrated to calculate threat behavior and attack fitting degree, threat assessment fineness and response speed are enhanced, and global security situation awareness is improved.

The invention discloses a network security intelligent management and control system based on big data, and relates to the field of network security management. Comprising a data acquisition processing module, an intelligence fusion analysis module, a threat dynamic detection module, an attack deduction prediction module, a virtual mapping simulation module, an edge collaborative defense module, a defense strategy optimization module, an automatic decision execution module and a threat intelligence sharing module. According to the method, the detection capability of complex network attacks is improved, the attack path in the network environment can be visually presented, the security operation and maintenance efficiency is improved, the attack path is accurately blocked, and the attack success rate is reduced; comprehensive security event priority ranking can be realized, the scientificity of defense decision is improved, meanwhile, the system can adapt to different attack scenes, the defense efficiency is improved, it is ensured that a defense strategy always adapts to the current security situation, resource waste is avoided, and the defense cost-benefit ratio is improved.

The invention discloses a network security defense method and system based on incremental network attack analysis learning. The method comprises the following steps: collecting initial network flow data, and extracting a feature vector; and collecting real-time network flow data, performing segmentation processing based on a sliding time window, extracting time sequence association features from the segmented data, and matching the time sequence association features with the feature library to identify potential attacks or abnormal behaviors. And when the time sequence correlation feature is not matched with the feature library, marking the time sequence correlation feature as a candidate novel attack feature, calculating a mahalanobis distance between the time sequence correlation feature and a known attack feature to determine the attack variability, and dynamically adjusting the weight of the time sequence correlation feature. And inputting the adjusted feature weight and the real-time flow feature into a deep reinforcement learning detection model, and generating and updating a network security defense strategy. The scheme of the invention can effectively identify novel attack behaviors, dynamically respond and optimize defense strategies, and improve network security.

The invention discloses a network attack AI detection analysis method and system based on the smart Internet, and belongs to the technical field of network security protection, and the method comprises the steps: building an attack feature library through distributed edge nodes in a cooperative manner, generating feature parameters of each node based on a local attack event, and transmitting the feature parameters to a central server for dynamic fusion through encryption; constructing a multi-modal interaction graph, identifying a potential attack link based on association strength among graph nodes, and deducing an attack intention to generate a defense strategy; deploying a virtualized network environment, dynamically injecting induction characteristics, and adjusting an induction strategy in real time according to the interaction behavior of an attacker; and monitoring an abnormal mode of the user behavior sequence, triggering an AI interaction verification process and storing a defense strategy. According to the method, rapid collection and fusion of network attack features are realized, the detection delay of network attacks is reduced, the accuracy of attack prediction is improved, the flexibility and effectiveness of network attack confrontation are enhanced, and the defense intelligence and adaptive ability of the whole network are improved.

The invention discloses a high-accuracy threat intelligence assisted network threat tracing method, which comprises the following steps: S1, collecting and preprocessing multi-source network security data, and constructing a time-marked event sequence set; s2, constructing an optimized Transform network model, and processing an attack event sequence by using position coding and time embedding; s3, a black swan optimization algorithm is initialized, and a Transform structure hyper-parameter is dynamically optimized; s4, outputting an attack event semantic vector, and constructing an attack path semantic map; s5, the intelligence information vector is embedded into a Transform hidden space; s6, calculating semantic similarity and dependency intensity, and generating an attack source candidate set and a traceability path; s7, outputting an attack traceability path, a starting point node and an information label, and generating a structured traceability report; and S8, according to the traceability result feedback, updating the black swan algorithm and the Transform model. The method is used for realizing intelligent modeling of multi-source network attack events and high-accuracy traceability analysis of attack source nodes.

The invention belongs to the technical field of network security, provides a network attack detection method based on dynamic graph coding, and solves the problems of poor dynamic adaptability of an attack path and missing of timing constraint in the prior art. The method comprises the following steps: constructing a dynamic threat map, extracting a triple of heterogeneous threat intelligence by using a RoBERTa model, and adding a timestamp and a confidence attribute; a dynamic graph encoder for time sequence perception is designed, semantic and evolution laws are fused through periodic time coding and a multi-head time sequence attention mechanism, and feature weights are adjusted in combination with a gating residual layer; an event-driven incremental updating strategy is adopted, and node similarity is calculated to achieve local subgraph updating; a time sequence rule base is established, three-dimensional parameter verification attack chain time sequence logic is defined, and abnormity is judged through conflict scores; and finally, integrating a graph updating module, a dynamic coding module and a constraint analysis module to realize multi-source threat feature matching and attack detection. According to the method, the adaptability of attack path evolution is improved through dynamic graph modeling and real-time increment updating.

A system and method for cyber exploitation path analysis and response using federated networks to minimize network exposure and maximize network resilience, with the ability to simulate complex and large scale network traffic through the use of federated training networks, by gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Lastly, network attack path analysis and automated task planning for minimizing network exposure and maximizing resiliency is performed with machine learning, generative adversarial networks, hierarchical task networks, and Monte Carlo search trees.

A system and method for mitigating cyber-attacks against a target network comprising interconnected note that is implemented by Open Systems Interconnection (OSI) layers monitors the target network for detecting vulnerabilities across one or more OIS layers. a virtual network comprising a virtualized representation of the target network where the virtual network includes one or more virtual nodes that are annotated with identified vulnerabilities of one or more corresponding nods of the target network. A reference database can be configured to store records of known cyber-attacks and their corresponding mitigations where cyber-attacks on the virtual network are simulated based on records of known cyber-attacks and successful cyber-attacks. An AI engine can be configured to generate one or more mitigation actions based on simulation of the cyber-attacks before implementing the one or more mitigation actions to the target network.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

The invention relates to a network attack tracing method, system and device based on a user portrait, and a medium. The attack tracing method comprises the following steps: collecting interactive behavior data of a user in a Web page; performing compression and serialization processing on the interaction behavior data to generate a structured interaction log file; collecting fingerprint data of the user terminal and performing standardization processing to generate a fingerprint feature vector; based on the structured interaction log file and the fingerprint feature vector, generating a user unique identifier containing a risk level tag; performing clustering analysis on the interaction behavior data according to the unique identifier of the user, identifying an abnormal behavior mode of the abnormal user and marking an attack type; acquiring a public network IP address of an abnormal user, and positioning a geographic position in combination with an IP database; and constructing an attack traceability report based on the user unique identifier of the abnormal user, the abnormal behavior mode, the public network IP address and the geographic position. According to the invention, the user portrait can be accurately constructed, and the network attack behavior can be effectively identified and traced.

The invention relates to a network attack tracing method and device based on a threat graph, equipment and a medium. The method comprises the steps of obtaining network security log data from multiple security data sources, and performing standardization processing to obtain a structured network security event data set; extracting threat entities and behavior relationships among the threat entities from the structured network security event data set to obtain an entity set and a relationship set; constructing a threat map according to the entity set and the relationship set, and performing time data slicing according to the timestamp to obtain a map snapshot and map metadata; based on a predefined attack chain template, identifying an attack chain sub-graph conforming to an attack behavior structure in the threat graph to obtain an attack chain set and a path reachability matrix; and according to the attack chain set and the path reachability matrix, attack path inversion is carried out by taking the target node as an end point, and an attack traceability path and a graph evolution process display result are obtained. By adopting the method, the network attack path can be identified and the attack source can be traced.

The invention discloses an information security risk assessment method based on an API. The method comprises the steps that API assets in an enterprise are obtained through flow analysis; identifying and positioning the log file or sensitive data in the file by using a sensitive data identification model; integrating the vulnerability rule set, and detecting vulnerability vulnerabilities existing on the API through an API vulnerability detection model; a behavior risk automatic monitoring engine is set, and real-time monitoring and early warning are carried out on the behavior of abnormally calling the AP I to obtain data; constructing a network attack monitoring model; drawing an API risk link relationship based on a risk monitoring model trained by historical monitoring data, and speculating a suspicious data leakage path in combination with clue association ranking analysis; performing comprehensive trace reserving on the API data use behavior; and calculating the risk by using a matrix method, and generating an API information security risk assessment report. Through the method, a comprehensive API security risk assessment system can be established, API security risks can be effectively identified and managed, and enterprise data security is protected.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

The invention discloses a network attack path prediction method and system based on a knowledge graph, and relates to the technical field of knowledge graphs, and the method comprises the steps of multi-source heterogeneous data processing, dynamic knowledge graph construction, attack path prediction, high-confidence attack path acquisition and information feedback. According to the method, space-time reference alignment of data is guaranteed, a dynamic knowledge graph is constructed to update entity attributes in real time, a double-storage mode is adopted, the storage efficiency is improved, a graph attention mechanism and an attack path prediction model are constructed, attack paths are predicted, the attack path detection and prediction precision is improved, and the attack path detection and prediction efficiency is improved. The problem of limitation in the current network attack path prediction process is solved, the threat level of the high-confidence attack path is obtained through analysis, information feedback is carried out, updating of the dynamic graph is completed, and the accuracy, reliability and authenticity of a network attack path prediction result are guaranteed.

The invention discloses a multi-modal data fusion network attack detection method, and relates to the technical field of computer network security, and the method comprises the following steps: 1, network flow data collection and attribute analysis; step 2, multi-dimensional feature extraction and attack path drawing; 3, cross-modal data fusion and model construction integration are carried out; 4, model activation enabling and attack route evaluation; and 5, real-time data access and attack detection judgment. According to the multi-modal data fusion network attack detection method, through detailed analysis of multi-dimensional attributes of network flow data, potential feature information in the data is comprehensively mined, and multi-source information such as an attack path diagram, terminal equipment log data and threat intelligence data is further fused; and cross-modal interactive learning is carried out to construct a multi-modal attack detection model, so that the limitation of traditional single data source detection is broken through, and the relevance and complementarity among data are fully utilized.

The invention provides a network attack detection method and system based on a distributed intelligent probe, and the method comprises the steps: receiving real-time flow data synchronously collected by the distributed intelligent probe at each node of a network, carrying out the inter-node interaction relation modeling processing of the real-time flow data, recognizing a flow communication mode between different network nodes, and carrying out the detection of the network attack. Generating a flow association map containing the node connection relationship and the communication frequency; carrying out abnormal communication path mining based on the flow association map, and extracting a node communication sequence with an abnormal mode by analyzing the deviation degree of a node connection relationship and the fluctuation characteristics of communication frequency; performing pattern matching processing on the node communication sequence and an attack behavior template in a preset attack feature library, calculating sequence matching similarity and generating an attack matching degree score set; and determining a network attack type and attack source node positioning information, and generating a network attack detection result. According to the invention, the practicability and effectiveness of network attack detection are improved.

The invention provides an intelligent tracking and blocking method and system for a network attack chain, and relates to the technical field of network security, and the method comprises the steps: collecting network flow data, building an attack chain propagation path, setting a detection breakpoint, obtaining a data sample, carrying out the causal correlation analysis, extracting a data transmission feature, and converting the data transmission feature into a behavior sequence feature; predicting an attack chain evolution path by adopting a bidirectional feature matching mechanism; a honeypot service and a flow probe are deployed to generate an attacker portrait; and formulating a defense strategy according to the attack intention to realize attack chain blocking. According to the invention, accurate identification, effective tracking and active defense of network attacks can be realized, and the network security protection capability is improved.

The invention discloses a network attack active trapping method based on intelligent scheduling, and the method comprises the steps: constructing a dynamic honeypot environment according to a real business system mirror image, simulating the interaction logic and data characteristics of a real business system, and generating a honeypot system; analyzing a network equipment log of an access source according to the security situation awareness platform, and capturing multi-dimensional features to identify attack traffic; dynamically generating a drainage strategy according to an identification result of the security situation awareness platform, and seamlessly switching attack traffic to a honeypot system through load balancing equipment; and recording an attack behavior chain in the honeypot system, extracting an attack tool fingerprint and tracking an attacker identity. Through dynamic simulation environment construction, intelligent traffic scheduling, full-chain traceability and intelligent resource management, high-simulation trapping, accurate attack shunting, credible electronic evidence chain generation and efficient resource utilization are realized, and the active defense efficiency is remarkably improved.

The invention relates to the field of industrial internet intrusion prevention, in particular to a computer network big data security protection method and system, and the method comprises the following steps: monitoring network flow, collecting user identity, equipment security state, access time and network behavior data, and generating a network behavior record. In the invention, a dynamic security assessment system is constructed through network flow monitoring, identity verification and behavior analysis, and compared with static strategy or fixed rule matching, the dynamic security assessment system can adapt to a continuously changing network attack environment. Authority dynamic adjustment is performed based on the user identity verification state, flexible management and control of the access authority are ensured, and the problem of long-term high authority abuse is avoided. Threat detection not only depends on historical mode matching, but also is combined with real-time behavior analysis, and accurate isolation is executed for potential threats, so that protection measures are changed from passive response to active intervention, and the delay of manual intervention is reduced.

The invention relates to the technical field of AI agent defense, and particularly discloses an AI agent autonomous defense system and method for network attack path prediction. An attack chain reasoning module; a risk assessment module; a path prediction module; a resource scheduling module; a defense execution module; through cooperation of a dynamic environment sensing module, an attack chain reasoning module, a risk assessment module, a path prediction module, a resource scheduling module and a defense execution module, automation and intelligentization of the whole process from environment sensing, attack analysis to defense execution are realized, manual intervention is reduced, human errors are reduced, and the defense efficiency is improved. And the attack reasoning module is used for reasoning a multi-stage attack path, so that the limitation of single-stage attack analysis is broken through, an attack logic chain of an attacker from reconnaissance and penetration to transverse movement is completely presented, the attack life cycle is comprehensively covered, and the timeliness, comprehensiveness and security of network security defense are improved.

The invention discloses a multi-element power distribution network planning method for coping with a network attack, and relates to the technical field of power distribution network safety planning, and the method comprises the steps: S1, analyzing the vulnerability index of a power distribution network under the network attack; s2, generating a corresponding power network attack scene according to the vulnerability index in combination with historical network attack data; s3, establishing a power distribution network defense-attack-defense planning model based on the power network attack scene; s4, performing layout optimization on the power distribution network defense-attack-defense planning model based on the optimal energy storage configuration; s5, planning the power distribution network by adopting the optimized power distribution network defense-attack-defense planning model; the problem that the power distribution network is difficult to effectively prevent network attacks due to lack of pre-layout of network attack defense measures in a power distribution network planning technology is solved, the power distribution network is ensured to have effective and reliable network attack prevention capability, the defense efficiency of the power distribution network to the network attacks is remarkably improved, and safe and stable operation of the power distribution network is further improved.

The invention relates to an intelligent network attack surface prediction method and system based on deep learning, and belongs to the technical field of network security and information, and the method comprises the steps: obtaining network asset information, vulnerability distribution information and external threat intelligence data in a target network environment, and carrying out the preprocessing to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a feature vector related to the network attack; reasoning and analyzing a potential attack link based on the feature vector and the knowledge graph, and combining an association relationship among a network asset node, a vulnerability node and a threat intelligence node in the knowledge graph; and finally, according to a reasoning analysis result, evaluating an intrusion path possibly utilized by an attacker, outputting an attack surface prediction result, and presenting the attack surface prediction result in the form of an attack path list. According to the scheme, a potential attack link can be subjected to deep reasoning analysis, an intrusion path possibly utilized by an attacker can be accurately predicted, and the effectiveness of network security protection is improved.

The present invention relates to the technical field of network security protection. Disclosed are a security protection method and apparatus for a customer service management system. The method comprises: acquiring an employee data set, and performing permission assignment, so as to generate an employee operation permission set; performing identity verification on an access user, and determining a data management operation permission range of the access user; acquiring a sensitive data set for encryption processing, and storing same in a customer service management system; accessing data of the customer service management system, implementing an access control policy, and performing risk assessment, so as to generate a system risk level; extracting detected anomalous data, synchronizing same to a security protection network, and outputting a protection control policy; and executing the protection control policy for security assessment, regularly updating the protection control policy, and performing intelligent security protection on the customer service management system. The present invention solves the technical problem in the prior art that customer service management systems have low security protection capacity, which leads to difficulty in preventing network attacks, thus achieving the technical effect of improving the security protection capacity of customer service management systems.

The invention relates to the technical field of computer network security, in particular to a security guarantee system for cross-domain communication and data sharing of network platform software, which comprises a data security transmission module, an identity authentication and access control module, an encryption module, a security audit and anomaly detection module and an anti-interference disaster recovery module. According to the invention, through linkage of equipment fingerprint end-to-end encryption, threat adaptive dynamic key updating and a timestamp-random number anti-replay mechanism and AI risk pre-judgment, reinforcement learning path planning, digital twinning pre-verification and fault automatic switching technologies, collaborative guarantee of key security and transmission continuity in cross-domain audio transmission is realized; encryption intensity is dynamically upgraded along with threats, a transmission path is optimized in advance, and it is ensured that the audio stream resists various network attacks and interferences in low-delay transmission.

The invention relates to a micro-grid intelligent safety secondary voltage control method based on reinforcement learning, and belongs to the technical field of power grids. The method comprises the following steps: firstly, establishing a micro-grid secondary control model under hybrid network attack; a DoS attack defense network based on deep learning is designed, a self-adaptive FDI attack compensation state observer is designed, compensation for unknown FDI attacks is established, a self-adaptive law of compensation signals is designed, and estimation of the system state under network attacks is achieved. An evaluation-execution structure is constructed based on reinforcement learning, a virtual optimal controller and an actual optimal controller are designed in combination with a backstepping method, unknown parts in a system model, an evaluation network and an execution network are approximated by using a neural network, and a weight adjustment law is given. And introducing a log type barrier function into the performance index function, and constraining the output in a fixed constant interval to meet the constraint condition. The method can cope with DoS attacks and FDI attacks, and ensures stable control and safe operation of the secondary voltage of the micro-grid.