160 results about "Network defense" patented technology

The invention discloses a dynamic honey point collaborative intelligent threat trapping system and method based on a genetic algorithm in the technical field of network security, and the system comprises a multi-source information collection and dual-mode output module, a reinforcement learning strategy engine, a graph neural network prediction module, a digital twin simulation environment, a strategy verification and optimization module, and a real network defense execution module. A dynamic honey point deployment strategy is generated in real time through a reinforcement learning strategy engine, and the problem of strategy stiffness is solved; a third-generation non-dominated sorting genetic algorithm (NSGA-III) multi-objective optimization algorithm is used for coordinating honey point density adjustment, trip line sensitivity calibration and other actions; attacking path risks are quantified based on a threat scoring formula, digital twin environment pre-verification and high-risk node precise protection are driven, closed-loop linkage of threat perception, strategy optimization and active trapping is finally achieved, and the intelligent defense capability capable of achieving autonomous evolution is formed.

The invention belongs to the field of network security, and particularly discloses a network defense agent system based on a large language model. Through the design of the sensing layer, the decision analysis layer and the action execution layer, comprehensive protection of network threats is realized. The sensing layer is responsible for collecting original information from multiple channels and converting the original information into standardized data; the decision analysis layer performs modeling and threat reasoning on attack behaviors, evaluates a risk level and predicts subsequent actions; and the action execution layer specifically executes defense operation according to the defense strategy scheme output by the decision analysis layer. In addition, the application also constructs a data set oriented to attack and defense confrontation, records a complete attack sequence, defense response and effect evaluation thereof, and provides a reliable basis for continuous learning of defense agents. Experimental results show that the framework provided by the invention is superior to the traditional method in the aspects of attack detection accuracy, attack chain identification and defense strategy generation, and has stronger adaptability and real-time response capability.

The invention provides a network defense capability verification method and system based on intrusion attack simulation. According to the method, network dynamics and a photoacoustic effect simulation technology are creatively fused, and network abnormal traffic equivalent to real attacks is dynamically excited by constructing a photoacoustic coupling waveform driven by network topology; reversely analyzing the vulnerability characteristics based on the protocol interaction entropy, and generating an attack instruction with a space-time cooperation characteristic; utilizing a phase matching algorithm to precisely couple the attack behavior and the network dynamic disturbance to form a defense response track capable of being quantitatively analyzed; and finally, through an asymmetric correlation model, analyzing a dynamic relationship between trajectory deformation and a node survival state, and realizing objective quantitative evaluation of defense efficiency. According to the technical scheme provided by the embodiment of the invention, high-precision quantitative verification of the virtual-real combined network security defense capability can be realized, and the real-time performance and credibility of defense strategy evaluation are improved.

The invention discloses an adaptive game-driven network defense method and system, and relates to the technical field of network security. The method comprises the following steps: generating a multi-modal bait according to network context information, and screening an optimal bait through credibility evaluation; constructing a time sequence feature tensor according to the network event sequence information of the bait, and obtaining predicted attack information by adopting a pre-trained attack prediction model; combining the network event sequence information of the bait and the predicted attack information to construct a defense income matrix, and carrying out iterative equilibrium solution to obtain an optimal strategy candidate pool; and taking the defense hybrid strategy of the optimal strategy candidate pool as an initial population, performing multi-objective optimization through a non-dominated sorting genetic algorithm to obtain a Pareto optimal strategy set, and performing screening to obtain an execution strategy set for dynamic defense decision making. According to the invention, the dynamic property, intelligence and self-adaptability of network defense are realized, and the ability of a network system to cope with complex attacks is effectively improved.

The invention provides an industrial control and infrastructure defense cooperation method and system based on digital twinning, and relates to the technical field of defense cooperation. The method comprises the following steps: based on a digital twinning technology, collecting sensor data in an industrial control system, and identifying abnormal fluctuation of equipment operation to obtain abnormal activity information; the occurrence frequency and intensity of the deviation data are analyzed, and the network data transmission security of the industrial entity is optimized to obtain security protocol optimization configuration; reconfiguring the network access authority, and monitoring the new access mode and the data flow in real time to obtain an access control optimization state; monitoring network behaviors by using an isolated forest algorithm, and quantitatively evaluating potential internal and external threats to obtain a threat evaluation update log; and adjusting the data acquisition frequency and the processing process based on the update log, and obtaining a dynamic cooperative defense mechanism by updating network defense and response rules. According to the invention, the early warning and response capability of the industrial control system can be optimized.

The invention discloses a network attack active defense strategy optimization method based on deep reinforcement learning, and the method comprises the following steps: collecting multi-source data of a network environment, and carrying out the feature clipping and white list feature reservation; performing normalization and coding processing to generate a security situation vector; constructing a multi-index reward function, and generating an instant reward value and an event-level reward value; executing a double-closed-loop mechanism through an improved PPO model, and respectively outputting an instant strategy instruction and a long-term strategy parameter; performing multi-source evidence commissioning on the instant strategy instruction and the security situation vector, and judging a key evidence loss condition to obtain an execution token; inputting a risk budget pool to carry out resource quota checking, and executing anti-jitter and cooling control; and optimizing parameters of the multi-index reward function through a causal account book. According to the method, rapid response and continuous optimization of various attack behaviors can be realized, the defense effect and the resource utilization rate are considered, the false report and missing report rate is reduced, and the self-adaptability and stability of a network defense system are improved.

The invention relates to the technical field of network security, in particular to a network defense method, device and equipment and a medium, which are used for effectively coping with continuously changing network threats and improving the network defense effect. The method comprises the following steps: constructing a deep reinforcement learning DRL model, setting a state space and an action space of the DRL model, and constructing a reward function based on a key defense index of a network system; a flexible action-evaluation SAC algorithm is adopted to train the DRL model; and obtaining current network state information of the network system, inputting the current network state information into the trained DRL model to obtain an optimal network defense measure, and executing the optimal network defense measure. Therefore, by using the deep reinforcement learning technology, a protection mechanism can be dynamically adjusted to cope with continuously changing network threats, and in addition, when potential threats are detected, effective network defense measures are automatically executed, so that the system can turn from passive monitoring to active defense.

The invention relates to a network security dynamic defense method and system based on big data, and relates to the technical field of big data, and the method comprises the steps: constructing a multi-dimensional feature vector based on network flow data, system logs and user behavior data collected in real time; calculating a dynamic threat evaluation index based on the multi-dimensional feature vector; generating an adaptive response function according to the dynamic threat evaluation index; determining a defense strength dynamic adjustment function based on the adaptive response function, and executing multi-level linkage defense based on the defense strength dynamic adjustment function; the defense effect of the multi-level linkage defense is evaluated through the defense effectiveness evaluation model, and a corresponding evaluation result is obtained; and according to an evaluation result, continuously optimizing the executed multi-level linkage defense. According to the invention, the dynamic and defense effects of network defense can be improved.

The invention relates to a power network defense strategy determination method and device, computer equipment and a medium. The method comprises the following steps: acquiring operation data of a power network in different time periods; for the operation data in each time period, based on a feature detection model, extracting target operation features in the operation data; determining the operation state of the power network according to the target operation characteristics in different time periods; acquiring attack entity information and defense entity information of the power network aiming at the power network of which the operation state is an abnormal state; the attack entity information is the information of an entity which destroys the power network security; the defense entity information is the information of an entity for protecting the security of the power network; and determining a target defense strategy of the power network according to the attack entity information and the defense entity information. By adopting the method, manual intervention and subjective deviation can be reduced, the method is suitable for a complex and changeable operating environment in a power network, and the comprehensiveness and accuracy of overall detection are improved.

The invention discloses a network attack path automatic generation and defense strategy optimization method, system and device and a medium, and relates to the technical field of network security, and the method comprises the steps: constructing a topology mapping model, obtaining a network architecture, an asset list and a dependency relationship, constructing a visual topology chart, building a vulnerability association analysis model, and combining a vulnerability scanning result. The method comprises the steps of obtaining a vulnerability knowledge graph, optimizing a path calculation process based on the vulnerability knowledge graph, establishing a path derivation model, generating an attack chain by applying a path derivation algorithm, optimizing defense logic, formulating an optimization step model, and establishing a real-time simulation feedback model based on the generated attack chain. And performing simulation implementation on the defense strategy through a multi-level simulation training scheme, and dynamically optimizing the defense strategy according to feedback data. According to the method, the crossing from passive protection to active prediction and from single-point defense to global optimization is realized, and the accuracy and adaptive capacity of network defense are remarkably improved.

The invention relates to the technical field of power systems, in particular to a power transmission system key station identification method considering network-physical cross-domain attacks, which comprises the following steps: S1, acquiring defense measure information of a target substation: acquiring a network defense measure configuration condition; s2, constructing a network attack path: proposing the network attack path according to the actual defense condition of the transformer substation; s3, quantitative analysis of attack cost: quantifying the attack cost paid by an attacker in the attack path; s4, attack cost clustering: clustering the attack cost; s5, establishing an attack optimization model: establishing a double-layer optimization model; s6, key plant station identification: solving the double-layer optimization model, finding out system fragile plant station nodes, and carrying out power transmission system key plant station identification; according to the method, the power transmission system can be helped to identify high-risk plant stations in advance, defense resource configuration is optimized, and the cross-domain attack resisting capacity of the power grid is improved.

The embodiment of the invention provides an LLM-based 6G network automatic security processing method and system. The method is applied to the field of network security intelligent protection, and comprises the following steps: acquiring a network data stream, generating a structured log, extracting features, inputting the features into an intrusion detection model to identify attack behaviors, performing format conversion on a result to generate an LLM model, inputting the LLM model, and reasoning to obtain a network security disposal strategy. And extracting key fields, performing structured packaging, uploading the key fields to a block chain to complete evidence storage and integrity verification, and finally executing corresponding security control operation according to a strategy. According to the scheme, intelligent identification and automatic processing of network attacks are realized, after key fields are extracted, the structured strategy data are generated and uploaded to the block chain system for evidence storage and verification, traceability and data integrity of the processing process are ensured, network defense control which is automatic, high in security and timely in response can be realized, and the network attack processing efficiency is improved. And the intelligent and credible level of network security management is obviously improved.

The invention relates to an active network defense method and system based on watermark and moving target fusion, and the method comprises the steps: obtaining the input and output data of a communication system, and constructing a system model and a holosymmetric polytope observer model according to the input and output data; constructing an attack detector based on the system model and a holosymmetric polytope observer model; and based on the attack detector, the system model and the holosymmetric polytope observer model, watermarking input and output data through a pseudo-random number generation method and a preset target defense function. Through the watermark and moving target removal technology, the problem that the system performance is influenced by an existing watermark method is solved; and meanwhile, false data attacks, denial of service attacks, replay attacks and the like can be detected. In addition, the method is suitable for application scenes needing active attack detection, such as an intelligent connected vehicle system and an intelligent power grid system, and has very high application value.

The invention discloses a power-traffic network defense resource configuration method and system considering information security, and the method comprises the steps: taking the node voltage deviation of a power distribution network as an optimization target as a target function, and taking the defense resource budget as a constraint to construct an upper defender optimization model; constructing a middle-layer false information injection attack model according to the predicted values of the traffic flow and the charge-discharge load of the electric vehicle charging station; constructing a lower-layer dispatching center model according to the network parameters of the power distribution network and the parameters of the infrastructure; converting the middle-layer optimization model and the lower-layer optimization model into an inner-layer single-layer optimization model through a KKT condition, and converting the three-layer optimization model into a double-layer optimization model; and solving the obtained double-layer optimization model to obtain an optimal defense resource configuration strategy. The method provided by the invention provides powerful support for information security defense of the power-traffic coupling network.

A non-transitory computer readable medium stores instructions that, when executed by a processor, cause the processor to retrieve, from a catalog, a set of characteristics associated with a cyberattack, generate a plurality of packets having the set of cyberattack characteristics, wherein the plurality of packets collectively simulate the cyberattack, transmit the plurality of packets over a virtual operational technology (OT) network comprising a virtual network security system, and receive an alert indicating whether one or more of the plurality of packets was detected by the virtual network security system.

The invention discloses a network security situation awareness method and system based on deep learning, and the method comprises the steps: generating a time-space sequence data set through integrating a multi-source flow log and a behavior record, extracting the abnormal signal intensity, and generating an embedded vector set representing attack multidimensional through employing a graph representation learning method; and when the abnormal signal intensity exceeds a threshold value, mining time sequence relevance through a sequence analysis model, judging a hidden threat evolution path, updating complex attack chain representation in real time by utilizing a dynamic tracking mechanism, generating future threat probability distribution by fusing a risk prediction method, and determining a high-risk threat priority sequence. For high-risk threats, an early warning mechanism is activated through infrastructure influence assessment, a safety guarantee protocol is integrated, a protection layer is applied, and enhanced network defense configuration is generated. According to the embodiment, through integration of spatio-temporal data fusion, dynamic threat tracking and risk prediction, the detection precision and response speed of hidden threats are remarkably improved, and the safety of key infrastructures is guaranteed.

The invention discloses a network asset risk identification method and system, and the method comprises the steps: obtaining a network data flow, generating a list containing exposed assets, carrying out the feature analysis in combination with the historical data of the exposed assets, screening out candidate assets meeting an abnormal communication mode, carrying out the correlation analysis of the flow change data of any two candidate assets, and carrying out the risk identification of the network assets. Therefore, an asset interaction map is constructed, candidate attack paths are determined, then a target attack path is screened out through service analysis, and finally network assets with risks are identified from the target path. According to the method, dynamic perception and accurate risk positioning of known and unknown assets are realized, sudden attack initiated by APT attack by utilizing asset state fluctuation is effectively captured, the ability of resisting APT depth penetration is improved, and the timeliness and effectiveness of network defense are enhanced.

The invention relates to the technical field of power network security protection, in particular to a power network distributed cooperative defense method, system and device based on a graph neural network and a storage medium. The method comprises the following steps of: constructing a multi-relation graph structure comprising a master station, a substation and terminal equipment, and extracting node local embedding and full-graph-level situation embedding by adopting a graph neural network; establishing a centralized evaluation network to carry out topological position differentiation evaluation, and constructing a distributed action execution network to realize localized defense decision; a centralized training and distributed execution mechanism is adopted, a global strategy is uniformly optimized in a training stage, and each node independently executes a defense action in an execution stage; strategy iteration optimization is carried out through defense execution feedback, and attack mode changes are dynamically adapted. The technical problems of insufficient topology utilization, high response time delay and weak adaptive capacity in traditional power network defense are solved.

The invention discloses a network defense system vulnerability simulation method based on a generative adversarial network. The method comprises the following steps: S1, generating a network security situation awareness data set; s2, obtaining a weighted attack path graph; s3, performing graph semantic coding on the weighted attack path graph, and mapping a condition vector set; s4, obtaining a converged candidate weak point configuration set; s5, generating a target weak point configuration list; s6, forming a weak bait cluster; and S7, collecting a detection behavior log aiming at the weak bait cluster in real time, generating an attacker interaction behavior data set by utilizing the behavior log and the transverse movement behavior log, updating a weighted attack path graph and a condition vector set based on the attacker interaction behavior data set, and performing online fine adjustment on the condition generative adversarial network to obtain a weighted attack path graph. And the step S5 and the step S6 are executed again. According to the invention, through comprehensive discrimination and constraint optimization, unification of high trapping value and low business risk is realized.

The invention discloses a network security defense decision-making method, and particularly relates to the technical field of network security. The method comprises the following steps: acquiring user account access behavior data in a network environment and intrusion observation data output by an intrusion detector, and performing data cleaning and feature extraction to obtain historical trust evidence sequence data; performing time sequence feature analysis by using a recurrent neural network, and identifying an abnormal behavior mode of the account; trust evaluation is carried out based on an actor-commentator reinforcement learning algorithm, and account real-time trust score data is generated; performing association analysis by combining the behavior abnormal mode feature data and the real-time trust score data to obtain potential threat feature data of the user account; evaluating the effectiveness of the defense strategy by adopting a strategy evaluation network, and generating defense strategy evaluation data; and generating an optimal network defense decision according to the potential threat feature data of the user account and the defense strategy evaluation data. According to the method, the detection accuracy of potential network intrusion and the effectiveness of defense measures are improved.

The invention discloses an automatic defense system for computer network security, and the system comprises a quantum random walk edge real-time detection module which is responsible for capturing a data flow in a network in real time, and detecting the abnormal transition in the data flow through a quantum random walk model; the hyper-chaos time sequence prediction module is used for performing time sequence prediction on the data flow by utilizing a hyper-chaos neural network, identifying potential security threats, quantifying the chaos degree of the system through a Lyapunov index, dynamically setting an abnormal threshold value, and sending out an early warning signal when a prediction result exceeds the threshold value; the quantum key distribution cross-system collaboration module is used for encrypting threat intelligence exchange between external systems by using a quantum key distribution technology, and meanwhile, through an intelligent contract automation mechanism, when specific conditions are met, a whole-network defense action is automatically triggered; and the dynamic causal reasoning real-time feedback module is used for constructing a processor-network-application causal Bayesian network, and quickly positioning and blocking a threat source by deducing an attack propagation path in real time.

The invention provides a network attack data processing method and device, a medium and a program product. The method comprises the following steps: firstly, acquiring network flow data of a preset network section; then, according to a preset network traffic threshold value, threshold value detection is carried out on the traffic size in the network traffic data, and first abnormal traffic is obtained; further, on the basis of a DBSCAN algorithm, clustering processing is carried out on the network flow data according to the flow size, and at least one piece of network flow corresponding to the boundary point and / or the isolated point after clustering processing is obtained; then, respectively performing correlation analysis on the feature data of the at least one network flow and feature data of a plurality of abnormal flows obtained in advance, and taking the flow of which the correlation with any abnormal flow is greater than a preset value as a second abnormal flow; and finally, according to the first abnormal traffic and the second abnormal traffic, training the network defense model to obtain a trained network defense model, thereby improving the defense capability of the network defense model.

A system and method for the secure and private demonstration of cloud-based cyber-security tools. Using an advanced sandboxing design patterns, isolated instances of virtual networks allow a potential client to compare their existing cyber defense tools against a set of cloud-based tools. Capitalizing on non-persistent and secure sandboxes allow the invention to demonstrate fully functional and devastating cyber-attacks while guaranteeing strict privacy and security to both existing customers and potential ones. Additionally, instantiating separate sandboxed observed systems in a single multi-tenant infrastructure provide each customer with the ability to rapidly create actual representations of their enterprise environment offering the most realistic and accurate demonstration and comparison between products.

The invention provides a computer-implemented method for mitigating simulated cyberattacks, carried out by one or more user devices (1000) comprising an interface module (1150), the method comprising the steps of activating (S01) a functional module (1100) of the interface module (1150), sending (S11), from the functional module (1100), to a cyberattack simulation module (1500), a trigger input message (M1), generating with and sending from (S21) the cyberattack simulation module (1500), to the interface module (1150), a triggerable attack message (M2) based on the trigger input message (M1), replying (S31) to the triggerable attack message (M2), with the interface module (1150), by selecting a defense parameter, the defense parameter being sent (S41) to the cyberattack simulation module (1500) inside a defense message (M4), and computing (S51), with the cyberattack simulation module (1500), a cyber-defense score of the user devices (1000) based on the defense parameter.

The invention discloses an advanced network threat intelligent detection and defense system and method in the technical field of network defense. The system comprises a data acquisition module which analyzes encrypted traffic through a deep packet inspection technology and marks space-time metadata; the feature extraction module is used for constructing a node behavior association graph by adopting a multi-scale sliding window and a graph neural network; the detection engine module integrates multi-model parallel analysis of LSTM, random forest and the like, and dynamically fuses detection results through an entropy weight method; and the defense execution module is used for realizing flow cleaning and virtual trapping node deployment based on an SDN (Software Defined Network) technology. The method comprises the steps of protocol extension field reverse analysis, covert channel time sequence correlation analysis and dynamic network topology adjustment. According to the method, the encryption APT attack detection accuracy reaches 98.7%, the false alarm rate is reduced to 0.15%, the defense strategy effective time is shorter than 1 second, and the method is suitable for complex network environments such as cloud computing and industrial Internet of Things.

The invention provides a network security protection simulation method and a related device. Belongs to the technical field of network security. The method comprises the following steps: generating a network topology; determining a plurality of target network nodes and a network attack path according to the network topology; attacking the target network node based on the network attack path; determining a network defense strategy and defending the target network node; and determining the protection result according to the network attack strategy and the network defense strategy. According to the method, the defense capability of the network system under various environmental factors can be effectively tested.

The invention relates to the technical field of network security, and discloses a network defense method, device and equipment, a storage medium and a computer program product.The method comprises the steps that whether malicious oscillation exists or not is judged according to at least one of route change information of a border gateway protocol, a time window threshold value and a route updating frequency threshold value; and analyzing the current traffic characteristics through an attack detection model, judging whether an attack behavior of distributed denial of service exists, limiting the speed of the current network traffic according to the malicious oscillation characteristics, and guiding the attack traffic of the attack behavior to a black hole address based on the extracted attack characteristics. According to the application, malicious oscillation and attack behaviors are monitored and identified in real time, when malicious oscillation is detected, the speed of the current network flow is limited according to the characteristics of the malicious oscillation, for the attack behaviors, the attack flow is guided to the black hole address based on the extracted attack characteristics, the attack source is quickly blocked, and a dual detection and response mechanism is adopted. And the timeliness and effectiveness of network defense are improved.

In one aspect, a computer-implemented method of detecting network security threats comprises the following steps: receiving at an analysis engine events relating to a monitored network; analysing the received events to identify at least one event that meets a case creation condition and, in response, creating a case in an experience database, the case being populated with data of the identified at least one event; assigning a threat score to the created case based on the event data; matching at least one further event to the created case and populating the case with data of the at least one further event, the threat score assigned to that case being updated in response; and in response to the threat score for one of the cases meeting a significance condition, rendering that case accessible via a case interface.

The invention discloses a firewall dynamic policy adaptation method and system based on big data, and the method comprises the steps: collecting multi-source heterogeneous data in a network, and constructing a dynamic network entity map in real time; processing the time sequence of the atlas by using a preset time sequence diagram attention network model to obtain a behavior fingerprint vector representing the behavior state of the entity, and calculating the risk score of the entity; when the risk score exceeds a risk threshold value, automatically generating a temporary security policy for managing and controlling the access behavior of the entity; and managing the life cycle of the temporary security policy, and automatically updating, renewing or cancelling according to the entity risk state change. According to the method, the network entity behavior baseline is constructed and the risk prediction is carried out, so that the conversion from passive defense to active defense is realized, the security policy can be automatically and accurately generated and managed, advanced persistent threats and zero-day attacks can be effectively coped with, and the self-adaptability and the intelligent level of network defense are improved.

The invention relates to a network multi-step attack prediction method based on space-time fusion dynamic graph convolution. Compared with the prior art, the defect that network attack prediction is difficult to meet actual application requirements is overcome. The method comprises the following steps: extracting network alarm attributes; performing data preprocessing on the alarm attribute data; constructing a network multi-step attack prediction model; and performing multi-step attack prediction. According to the method, the attack probability can be predicted, and the specific parameters of the expected attack can be predicted, so that better network defense measures can be applied.