4352 results about "Network security" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

The invention discloses a network security analysis early warning system based on artificial intelligence, and the system comprises a data collection layer which captures full flow based on DPI, aggregates firewall logs, terminal behaviors and threat intelligence, and constructs a structured data pool; through TLS fingerprint identification of AI driving, the encrypted traffic is penetrated, and a sampling strategy is dynamically adjusted in combination with reinforcement learning. The intelligent analysis layer is used for carrying out cross validation on known threats and abnormal behaviors; the time sequence CNN extracts encrypted traffic features, and a novel threat detector is rapidly generated by using historical attack fragments in combination with a meta-learning framework; sHAP value driving dynamic feature selection and optimization feature vector input; the decision-making early warning layer is used for fusing multi-source features through a Bayesian network and generating 0-100 score risk scores; a self-adaptive threshold module is combined to adjust a score threshold in real time, and a high-risk event is pushed; the collaborative response layer is used for triggering a preset decision tree, deploying a GAN dynamic honeypot to trap an attacker and reversely tracing; the Neo4j visually restores the attack path, and blocking is executed after the threat is confirmed by a progressive response mechanism.

The invention relates to the technical field of network security, in particular to a dynamic access blocking method based on zero trust. Comprising the following steps: step 1, collecting whole network flow data in real time in a bypass monitoring mode through a flow mirroring function of a network switch, performing deep packet inspection analysis on the collected original flow data, and extracting network flow characteristic parameters; 2, maintaining a dynamic identity information base; 3, performing real-time behavior analysis on each network session; 4, according to the risk assessment result and the real-time security context, generating a dynamic access control strategy based on a minimum permission principle; 5, implementing access control at the network execution point; and 6, continuously monitoring the network flow and the strategy execution effect, collecting feedback data, optimizing the risk assessment model and the strategy generation algorithm based on the feedback data, and forming closed-loop control. By dynamically updating the identity and asset information, the system can identify new assets or changes in real time, so that the adaptability and response capability of a network environment are improved.

The invention relates to the technical field of network security and data protection, and discloses a data leakage prevention method and system based on user behavior perception, and the method comprises the steps: obtaining historical operation data, and constructing a personalized behavior reference library; monitoring a current access behavior in real time by sliding a time window, calculating a deviation degree and triggering anomaly detection; performing multi-level feature analysis on the abnormal behavior and calculating a comprehensive abnormal score; dynamically adjusting the access authority according to the score, recording an abnormal behavior and carrying out relevance matching; optimizing the reference model through feedback learning; and evaluating the credibility and the risk level based on an accurate modeling result, and adaptively adjusting permission configuration. According to the method, the user behavior rule can be accurately captured, the data leakage risk can be efficiently identified, the access permission can be dynamically adjusted, the false alarm rate can be reduced, adaptive protection can be realized, and data security and business smoothness can be guaranteed.

The invention relates to the technical field of computer network security, and discloses a computer network security access control management method based on big data. The method comprises the following steps: constructing a network security situation knowledge graph, collecting a real-time access behavior sequence through a probe, and synchronizing the real-time access behavior sequence to the knowledge graph; simulating a network entity interaction state in the knowledge graph, and predicting a threat propagation path and a potential intrusion behavior; setting a dynamic access control strategy, constructing a multi-dimensional feature matrix in combination with a real-time access behavior sequence association influence degree and a strategy execution priority constraint condition, calculating a strategy conflict risk score by using a deep learning model, comparing with a preset threshold to judge whether a conflict exists or not, and if yes, reconstructing the strategy; and automatically executing access blocking, session termination and data encryption operations according to the reconstructed strategy, recording an execution log and security feedback data, and updating the knowledge graph in real time. According to the method, the dynamic property and the security of access control are improved, and security threats in a complex network environment can be effectively handled.

The invention relates to the technical field of data encryption and transmission, in particular to a power grid cross-domain operation and maintenance data secure transmission method and system based on encryption, and the method comprises the steps: pre-judging a current risk through a historical network security event, dividing a network environment into different risk intervals based on a risk level evaluation value, encryption strategies with different intensities are correspondingly matched, so that refined security management and control with higher risk and stronger protection are realized; a triple progressive identity authentication system of an equipment layer, a dynamic layer and a biological layer is constructed, a dynamic permission management and control mechanism driven by identity attributes and risk levels is constructed, a basic permission boundary is determined based on inherent identity attributes of an operation and maintenance terminal, and permission strength and validity period are dynamically adjusted in combination with a risk level evaluation value. And finally, generating an access control strategy only adapted to the current terminal, the current risk and the current access request, so as to perform data encryption and transmission through the target encryption strategy and the access control strategy, thereby ensuring the security of data transmission.

The invention discloses an abnormal traffic detection method and system based on deep learning and a generative adversarial network, and relates to the technical field of network security and artificial intelligence. In order to solve the core problems of scarcity of annotated data, unbalanced categories, difficulty in feature extraction and the like in abnormal traffic detection, the invention aims to construct a self-supervision-generation-attention three-layer collaborative detection architecture: general features are extracted from unannotated traffic through a self-supervision feature representation learning module, and the problem of annotation dependence is solved; a VAE-GAN generation enhancement module is used for generating high-quality samples for minority class abnormal traffic, and class balance is achieved; packet-level, flow-level and session-level multi-modal features are dynamically fused based on a multi-head attention mechanism, accurate detection is carried out in combination with a Transform-CNN-LSTM hybrid model, and interpretable analysis is provided. The method is characterized in that end-to-end high-precision abnormal flow detection is realized systematically through organic cooperation of data acquisition and preprocessing, self-supervised learning, generation enhancement, attention detection and a result output module.

The invention discloses a network security threat detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining multi-source security data, carrying out the preprocessing of the multi-source security data, and obtaining the preprocessed multi-source security data; performing feature extraction on the preprocessed multi-source security data, and associating feature extraction results to obtain multi-dimensional threat feature representation; and constructing a threat knowledge graph according to the multi-dimensional threat feature representation, and inputting the threat knowledge graph into a preset space-time diagram neural network model to obtain a network security threat detection result. According to the invention, the fusion of the multi-source security data is realized, and the time sequence and spatial dependence in the threat knowledge graph are subjected to joint reasoning by using the preset time-space diagram neural network model to obtain the network security threat detection result, so that compared with the prior art, the network security threat detection capability and detection efficiency are improved.

The invention provides a network security monitoring method and system based on distributed nodes, and the method comprises the steps: obtaining an inter-node interaction record of each node in a distributed network in a preset communication period and the identification information in a protocol interaction process, and obtaining a node communication data set; the method comprises the following steps: constructing a multi-dimensional phase space reconstruction matrix containing communication time sequence association features and protocol identifier association features, carrying out nonlinear dynamic feature analysis on the matrix, extracting a chaotic feature value set of node communication behaviors, constructing a topological association structure of node communication features through a local linear relationship, mapping the set to a topological space of a preset dimension, and constructing a topological structure of the node communication behaviors. And generating an attack mode topology expression vector, and finally analyzing an abnormal state propagation process in the distributed network through an inter-node energy propagation rule based on the attack mode topology expression vector to obtain a network security detection result. According to the invention, the accuracy and dynamic analysis capability of distributed network security monitoring can be effectively improved.

The invention discloses a network security event analysis method and system based on multi-agent decision, and a storage medium, and the method mainly comprises the steps: carrying out the deep investigation and judgment through a deep decision agent based on a reinforcement learning network after an abnormal alarm of a monitoring platform is received, triggering the deep investigation when the calculated deep investigation probability is greater than a threshold value, and carrying out the early warning of the network security event. Calling an LLM-based sub-expert agent to carry out deep analysis aiming at specific features; and according to the analysis result of the sub-expert agent and the risk information provided by the risk information platform, the LLM-based comprehensive risk decision assessment agent performs conjoint analysis decision to generate a network security situation comprehensive assessment report. According to the method, the processing analysis capability of massive and heterogeneous security data and the recognition capability of complex attack paths are remarkably improved, and the discovery capability of unknown threats and the intelligent level of security operation and maintenance are effectively enhanced by introducing reinforcement learning optimization decision and the deep analysis capability of LLM.

The invention discloses a method based on a large language model and ATTamp; the invention discloses a CK framework penetration test automation method and device, and the method comprises the steps: firstly carrying out the structural analysis of multi-source input information and tool output, and guaranteeing that key fields are not discarded; then combining a retrieval enhancement generation technology and a network security knowledge base to provide domain knowledge support for the large language model, so as to generate a model with ATTamp; a penetration test task tree marked by CK tactics, technologies and sub-technologies; on the basis, an optimal tool is automatically selected through a tool resource library and a multi-dimensional screening mechanism, an execution instruction is generated, and finally an execution result is returned to the input analysis module to form a self-adaptive optimization test closed loop. According to the method, semantic fidelity compression and standardization processing of long information can be realized aiming at the problems of large output format difference, more information redundancy and the like of different penetration testing tools, and efficient, explainable and auditory technical support can be provided for automatic penetration testing in a complex network environment.

System and methods are disclosed for providing unforgeable telemetry on computer platforms. Mathematical modeling and theorem proving are utilized to guarantee the integrity of telemetry probe execution flow and trigger, thereby preventing circumvention and tampering of logged probe data. In contrast to current state-of-the-art solutions that rely implicitly on the operating environment, this approach provides a sound and complete assurance of telemetry output. The system enables organizations to map unforgeable telemetry probe data to industry and government cybersecurity regulatory controls, ensuring compliance therewith. This invention addresses the shortcomings of existing solutions, including their vulnerability to sophisticated attacks, operational complexity, and inability to provide unforgeable telemetry data, thereby providing a reliable and accurate monitoring output in the presence of cyberattacks on computer platforms.

The invention relates to the technical field of network security, in particular to an intrusion detection system applied to the field of network security, which can accurately identify potential attack behaviors and reduce misjudgment rate by extracting session time sequence characteristics, separating load and behavior metadata and generating a behavior semantic primitive set. Discrete behavior semantic primitives are aggregated into intention propagation nodes, a multi-order attack dependency relationship is deduced, a multi-order attack intention propagation map is generated, the relationship between an attack path and the nodes can be clearly presented, and a key attack link can be positioned; according to graph topology vulnerability distribution, detection strategy template parameters are automatically generated and dynamically adjusted, different attack scenes can be adapted in real time, and the accuracy and flexibility of a detection strategy are improved; through real-time monitoring and marking of a key attack path, triggering of a cross-device cooperative defense mechanism, and generation of a region isolation instruction and a flow cleaning rule, transverse penetration and longitudinal deepening of an attack chain can be blocked, and attack diffusion is prevented.

Systems and processes are disclosed for enhancing cybersecurity and optimizing software repositories through integration of web crawling, web scraping, feature engineering, and advanced machine learning algorithms to detect phishing attempts, prevent account takeover fraud, and identify unused code in repositories. The system collects and refines data from various sources, including transaction logs, customer databases, device details, external data sources, and historical fraud data, to build comprehensive datasets. Feature engineering creates new, meaningful features from the refined data, which are used to train and evaluate machine learning models. The best-performing models are deployed in production to monitor incoming communications and transactions in real-time, flagging suspicious activities and optimizing codebases. This processing ensures timely detection and prevention of security threats while maintaining efficient software development processes. Robust protection is provided against evolving cyber threats and enhances software performance and security through continuous learning and adaptation.

The invention relates to the technical field of network security, and provides an APT attack traceability and path restoration method and system, attack path validity is verified through a dynamic causal element path generator in combination with an anti-factual adversarial network, and fine-grained entity modeling is realized through a hierarchical multi-modal entity inference system. A causal attention mechanism is optimized to improve association analysis precision, a federal incremental learning framework is constructed to realize dynamic updating and privacy protection, and the problems of poor rule adaptability, coarse granularity of entity modeling, insufficient causal association distinguishing and low calculation efficiency in the traditional technology are effectively solved. The method has the technical effects of dynamically generating an effective attack path, improving attack traceability accuracy, reducing calculation overhead and enhancing privacy protection.

The invention discloses a private network dynamic access control method and system, and relates to the technical field of network security and access control. The method comprises the following steps: acquiring equipment behavior data and network flow data in a private network, performing feature construction, and generating equipment trust features and network behavior features; and carrying out multi-dimensional risk assessment model training based on the equipment trust features and the network behavior features, carrying out real-time risk assessment on access requests or entities in the private network through the trained multi-dimensional risk assessment model, and generating a real-time risk score through a weighted aggregation function. According to the invention, through the multi-modal feature fusion model based on an attention mechanism, deep association of static attributes and dynamic behavior features of equipment is realized, and a real-time risk score is generated in combination with a multi-dimensional risk assessment model and a weighted aggregation algorithm. The limitation that in traditional access control, the evaluation dimension is single, the static strategy lags behind, and dynamic threats cannot be reflected is effectively overcome, and the accuracy and interpretability of private network access risk perception are remarkably improved.

A computerized system for dynamic cybersecurity policy using AI-based contextual adaptive learning includes an AI system that evaluates business contexts, risk tolerance, and productivity impact to generate threat intelligence assessments. The system includes a Contextual Adaptive Learning module that dynamically adjusts cybersecurity policies based on threat assessments to create security workflows. A Cybersecurity Mesh Development module that integrates policies across security frameworks. A Dynamic Scenario Catalog module that updates policy adjustments based on threat intelligence. An Automated Workflow Orchestration module that creates and refines security workflows for optimal efficiency. A Policy Recommendation and Automation module that generates prioritized security recommendations and automates policy changes based on organizational risk profiles and current security controls. This system harmonizes security policies while considering business context, risk, and productivity impacts.

A system and method for querying data sources for cybersecurity analysis is presented. The system and method include: receiving security logs from at least one data source, wherein the security logs lack pre-defined schema; generating a schema of the security logs based on at least a type of data of the security logs, wherein the generated schema includes fields of the security logs and values of the fields; embedding field vectors, wherein each field vector is a vector representation of a value of each respective field; embedding value vectors, wherein each value vector is a vector representation of a natural language description of each value in each respective field; and generating a query in a cyber language query, using an AI system, for execution on at least one target data source based, in part, on the generated schema, the embedded field vectors, and the embedded value vectors.

The invention relates to the technical field of power monitoring system network security and real-time micropatch hot deployment, and discloses a power disaster recovery system-oriented micropatch non-inductive deployment engine, a resource scheduling method, a system, equipment and a medium, and the method comprises the steps: capturing system events through a kernel eBPF probe, and carrying out feature extraction and model reasoning; generating and transmitting an encrypted scheduling token; loading and verifying a patch fragment by a patch agent, inserting a jump instruction through a kernel interface to redirect an execution stream, and maintaining multi-kernel cache consistency; fusing multi-source telemetry data to carry out fusing judgment, realizing network isolation and calling a key service to cancel a key; and collecting runtime indexes and performing trend prediction, triggering a recovery or rollback operation according to a result, and storing an operation result and data through a block chain. According to the method, through combination of deep fusion of multi-source heterogeneous data, dynamic reasoning of a knowledge graph and strategy optimization of reinforcement learning, efficient perception and defense of a complex attack scene of a digital power grid are realized.

The embodiment of the invention provides a network security validity verification and quantitative evaluation method and system, and relates to the technical field of network security, and the method comprises the steps: obtaining global dynamic threat intelligence and a multi-dimensional global network security risk data source, and carrying out the preprocessing; constructing a global feature engineering system based on heterogeneous information network atlas and sequence analysis, forming a feature vector matrix, and mapping the feature vector matrix into an index state vector; inputting the feature vector matrix, the index state vector and the external environment information vector into an evaluation model, dynamically adjusting the weight of the feature vector matrix of each dimension, and outputting the validity score of each safety control point; based on the score, calculating a safety effectiveness index based on a time decay factor; identifying a weak link based on the index, and performing simulation verification to obtain a simulation attack actual measurement result; and an error vector is constructed based on the result and the validity score, and parameter adjustment and weight calibration are carried out. According to the scheme, the accuracy and the real-time performance of network security evaluation are improved.

The invention provides an electric power system cross-source safety intelligent monitoring and dynamic response method and system based on mimicry defense, and relates to the technical field of electric power system network safety. According to the method, multi-source data are acquired by deploying an acquisition agent and a sensor and are encrypted and transmitted, parallel analysis and threat judgment are realized by utilizing a heterogeneous executor pool and dynamic scheduling, an attack chain is identified by combining cross-domain association modeling, disposal is performed according to grades, credible recovery is supported, and reinforcement learning and federated learning are assisted to optimize a strategy and resource allocation. And lightweight adaptation is realized through intensity control in a resource limited scene, a closed-loop safety system covering data acquisition, threat analysis, dynamic disposal and continuous evolution is formed, and the detection accuracy, response efficiency and robustness of a power system are improved.

The invention provides a multi-receptive-field network abnormal flow detection method and system based on endogenous security attributes, and relates to the technical field of network security and abnormal flow intelligent detection. The method comprises the following steps: firstly, performing multi-scale flow representation, preprocessing and data enhancement on network flow data to obtain enhanced input flow data; local features are extracted through basic convolution, and local and global fusion features are obtained based on a double-branch network comprising a multi-receptive field convolution branch and a Mama-self-attention branch; deep fusion representation is formed through multi-round feature extraction and tensor fusion, and finally binary classification and fine-grained classification results are output through global pooling and a linear classification layer. According to the method, high-precision, high-robustness and high-real-time detection of the abnormal traffic of the complex network is realized under low calculation overhead.

The invention relates to the technical field of network security and data processing, and discloses a violation short message recognition method and system based on deep semantic understanding, and the method comprises the steps: firstly cleaning an original short message, generating a mixed embedding vector through characters, sub-words and pinyin, and carrying out the recognition of the violation short message; then processing through a double-layer detection engine, wherein the first layer utilizes rules and a lightweight model for rapid preliminary screening; in the second layer, for suspected samples, a double-tower fusion neural network architecture is adopted, local and global features are combined, fusion is carried out through a gating unit, and a large language model is input to carry out deep semantic reasoning. The system executes strategies such as interception or flow limiting according to the risk score, and realizes model iteration through a dynamic knowledge base and incremental learning. According to the method, the resource consumption and the detection precision are balanced through the layered architecture, the antagonistic variants are effectively identified by utilizing multi-dimensional feature fusion, and the method has the adaptive evolution capability for a novel violation mode.

The invention provides a dynamic network security defense method and system oriented to real-time network state adaptation, and the method comprises the steps: building a standardized state vector sequence through collecting key indexes, such as network flow rate, abnormal connection ratio, topology change frequency, protocol distribution deviation degree and the like; based on the sequence, utilizing a time sequence prediction model embedded with a structured attention mechanism to predict attack risk trends of a plurality of time windows in the future in a prospective manner; and in combination with the current state and the risk trend, dynamically selecting an optimal strategy path in a predefined defense action map, mapping the optimal strategy path into a standardized control command which can be executed by equipment, and dispatching, issuing and executing the standardized control command according to the priority. According to the method, closed-loop self-adaptive defense from state perception and risk prediction to strategy generation and execution is realized, and the real-time performance, intelligence and engineering deployability of a network security system are remarkably improved.

The invention discloses an internal and external network security service passing method and system based on edge computing, and belongs to the technical field of network security, and the method comprises the steps: obtaining multi-dimensional attribute information of an edge node, generating a security policy basic data set, generating a traffic feature fingerprint and a self-adaptive environment adaptive fingerprint, and calculating a fusion matching degree; edge security entity nodes are generated in combination with service scene adaptive threshold clustering, and then a security policy meta-model with a security policy blueprint as a core is constructed; analyzing the security policy meta-model through a multi-modal semantic analysis engine, generating a dynamic security enhancement model, and mapping the dynamic security enhancement model to a hierarchical security control model; based on the hierarchical model, outputting edge node internal and external network safety passage configuration and a corresponding safety passage ledger through a scenarized configuration generation algorithm; according to the method, adaptive generation, dynamic optimization and accurate execution of the security policy are realized, and the security, the automation level and the operation and maintenance efficiency of internal and external network passing in the edge computing environment are effectively improved.

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.

A system and method for inspecting multiple instances across cloud computing environments for a cybersecurity issue is configured to detect a code object in a configuration code file, the code object utilized to deploy a virtual instance in a cloud computing environment; generate in a security graph a code object node representing the code object; generate in the security graph a resource node representing a virtual instance deployed in a first cloud computing environment based on the code object, wherein the resource node is connected to the code object node; detect a cybersecurity issue on the virtual instance; and generate an instruction to inspect a second virtual instance deployed in a second cloud computing environment based on the code object, the second virtual instance represented by a second resource node connected to the code object node.

The invention discloses a network space security intelligent monitoring and analysis system, and relates to the technical field of network security monitoring and analysis, and the system comprises a multi-source data collection module which collects multi-dimensional data in a full-link manner, and the collection frequency is dynamically adjusted along with a network load; the data preprocessing module cleans the fused data and generates a standardized analysis data set; the AI intelligent risk identification module identifies various safety risks in real time through a mixed deep learning model; the real-time response processing module starts differential processing according to a three-level mechanism; the threat traceability analysis module traces an attack link and generates a report; the security situation visualization module displays the security state in multiple dimensions; the data encryption storage module encrypts and protects data and performs double backup; and the system self-optimization module dynamically optimizes the strategy through incremental learning. The method is accurate in risk identification, timely in response processing, reliable in traceability and evidence storage, and efficient in cross-domain cooperation; terminal protection and third-party access control are enhanced, and network space security and stable service operation are comprehensively guaranteed.

The invention belongs to the technical field of network security, and provides a network threat real-time detection and defense method and system based on artificial intelligence. The method comprises the steps of multi-modal data acquisition and preprocessing, dynamic graph feature engineering and knowledge graph collaborative fusion, dual-adaptive model training and optimization, streaming real-time detection and anomaly scoring, DRL-driven hierarchical defense response and automatic disposal, and feedback-driven model adaptive updating and block chain auditing. According to the method, a mixed model of OS-ELM + dual-adaptive ridge regression + federated learning is designed, the training speed is higher than that of CNN, and over-fitting / under-fitting is avoided by dynamically adjusting a regularization coefficient; the federal learning realizes data local training and parameter uploading, and solves the problem of privacy disclosure; knowledge distillation enables the model volume to be reduced, edge equipment deployment is adapted while the accuracy is maintained, and the generalization ability is obviously superior to that of a traditional static model.

The invention discloses a network security linkage response system based on distributed intrusion detection, which belongs to the technical field of network security, aims to improve the comprehensiveness of network threat detection and the timeliness of response, and comprises a distributed lightweight probe, an edge preprocessing and initial judgment module, a central depth analysis module, an intelligent linkage response module and a unified management visualization module. The distributed lightweight probe module collects network security data of each network node; the edge preprocessing and initial judgment module processes the network security data and reports the network security data after initial abnormal detection; the central deep analysis module fuses and associates the reported preprocessed data, and obtains a threat analysis result in combination with AI model analysis, external threat intelligence comparison and attack chain reduction; the intelligent linkage response module matches a preset strategy execution scheme based on the threat analysis result and feeds back an effect; and the unified management visualization module is responsible for configuration management, result display and alarm. According to the invention, accurate identification and rapid linkage response of network threats are realized, and the network security is effectively guaranteed.