342 results about "Network security management" patented technology

Advanced cybersecurity systems and methods may provide enhanced security of critical infrastructure without the risks associated with traditional penetration testing. The systems and methods may model network vulnerabilities and simulate attack scenarios to identify potential security breaches. This supports the integration of generic rules and common properties, allowing for dynamic and scalable vulnerability analysis across complex network systems. Additionally, the systems and methods incorporate a multi-purpose fuzzer and an AI-driven Cyber Reasoning System (CRS) that autonomously detects and remedies software vulnerabilities based on predefined logic and pattern recognition. This comprehensive approach identifies existing vulnerabilities and predicts potential future threats by analyzing changes in network behavior and data flow. The systems and methods are particularly suited for mission-critical environments where operational continuity is paramount, providing a robust tool for improved cybersecurity management without disrupting system operations.

The invention discloses a security event log real-time monitoring and analyzing system and method for a power grid communication network, and relates to the technical field of network security management. The causal relationship graph building module is used for building a causal relationship graph of the target power grid communication network; the multi-dimensional correlation analysis module is used for collecting and analyzing multi-source heterogeneous log data in real time; the abnormal security event identification module is used for identifying an abnormal security event according to the causal relationship graph and the multi-dimensional correlation analysis result; and the attack chain tracking response module is used for tracking the attack chain. According to the method, the technical problem that the existing power grid communication network security monitoring lacks tracking of abnormal event evolution from the time dimension and cannot accurately identify and track a multi-stage attack chain is solved, and the effects of dynamically tracking the evolution process of the abnormal event and identifying a potential attack chain by establishing a time causal chain graph are achieved. And the detection precision and the response speed of the attack behavior are improved.

The invention discloses a network security intelligent management and control system based on big data, and relates to the field of network security management. Comprising a data acquisition processing module, an intelligence fusion analysis module, a threat dynamic detection module, an attack deduction prediction module, a virtual mapping simulation module, an edge collaborative defense module, a defense strategy optimization module, an automatic decision execution module and a threat intelligence sharing module. According to the method, the detection capability of complex network attacks is improved, the attack path in the network environment can be visually presented, the security operation and maintenance efficiency is improved, the attack path is accurately blocked, and the attack success rate is reduced; comprehensive security event priority ranking can be realized, the scientificity of defense decision is improved, meanwhile, the system can adapt to different attack scenes, the defense efficiency is improved, it is ensured that a defense strategy always adapts to the current security situation, resource waste is avoided, and the defense cost-benefit ratio is improved.

The invention relates to a network security management system based on big data, and the system comprises the following modules: an identification module which is used for inputting an extracted feature vector into a preset identification algorithm for threat intelligence identification, and obtaining a threat intelligence identification result; the first analysis module is used for carrying out network attack behavior analysis on the network acquisition data based on the threat intelligence recognition result if the threat intelligence recognition result has a network abnormal behavior to obtain an attack scene; wherein the attack scene comprises an attack chain and an attack mode; the second analysis module is used for performing association analysis on the network acquisition data based on the attack scene to obtain a threat factor of network security; the management module is used for formulating a corresponding security management strategy based on the threat factor of the network security; the technical problem that a traditional security monitoring method cannot effectively capture latent abnormal behaviors in a network and is difficult to provide comprehensive and timely security threat early warning is solved.

The invention relates to the technical field of network security management, in particular to an active defense system for power monitoring system distribution network security management. The safety monitoring unit is used for collecting and analyzing network data in real time; the intrusion detection unit is used for identifying suspicious activities and attack signs; the risk assessment unit further analyzes the suspicious activities and the attack signs and assesses the influence degree of the suspicious activities and the attack signs on the power grid security; and the decision support response unit provides coping strategy suggestions according to the result of the risk assessment and executes the provided countermeasures. By integrating the safety monitoring unit, the intrusion detection unit, the risk assessment unit and the decision support response unit, real-time collection, analysis and processing of network data are realized. Particularly, the intrusion detection unit adopts an advanced network flow behavior recognition model and a system log behavior recognition model, so that behaviors which are not consistent with a normal communication mode and abnormal operation records in a system log can be effectively recognized.

The invention discloses a network security dynamic early warning method and system based on multi-source data fusion, particularly relates to the technical field of network security monitoring and early warning, and evaluates the network protection quality and measures the protection strength and effectiveness by fusing multi-source data; building an attack probability prediction model based on the long-short-term memory network, and obtaining the attack probability of the network in a future time period T; analyzing the user operation behavior, and identifying an abnormal behavior parameter which is not consistent with the normal behavior mode; inputting the abnormal behavior parameters into an operation behavior analysis model to obtain an operation behavior abnormal index; the problems of one-sided information, inaccurate evaluation, inaccurate prediction and slow response are effectively solved, and dynamic early warning of the network security situation is realized; and when the Anx is lower than the security threshold, an early warning mechanism is triggered immediately, so that efficient and comprehensive technical support is provided for network security management, and the stability and security of a network environment are ensured.

The invention discloses a risk assessment and prediction method based on a network security situation awareness system, and relates to the technical field of network security. According to the risk assessment and prediction method based on the network security situation awareness system, a current network potential risk data set is obtained, and a current network potential risk assessment value is obtained through comprehensive analysis based on the obtained current network potential risk data set; acquiring a current network traffic data set, and based on the acquired current network traffic data set, performing comprehensive analysis to obtain a current network traffic evaluation value; comprehensively analyzing the current network potential risk assessment value and the current network flow assessment value to obtain a network security risk coefficient and a network security risk level; by comprehensively analyzing the current risk and flow data, a more comprehensive, real-time and dynamic network security management scheme is provided, potential threats can be effectively identified, and the early warning capability is improved. The problem that the existing network security situation awareness system is inconvenient to comprehensively reflect the network security situation is solved.

The invention relates to the field of network security in the industrial field, and discloses an industrial field network security online monitoring system, which comprises an asset identification module, a topology analysis module, a risk assessment module, a dynamic updating module, a decision support module and a visualization module, the system obtains equipment information in the network through a stateless scanning technology, constructs an equipment topological graph, and evaluates equipment risks based on a graph convolutional network; by monitoring the equipment state and the topological structure in real time, the system can dynamically update the risk score and provide an accurate safety assessment result; and according to an evaluation result, the system generates a network security management decision suggestion, and helps a network administrator to effectively manage and cope with the network security risk through multi-dimensional visual display of an equipment state, a risk score, vulnerability information and the like. The method has the advantages of comprehensive equipment identification, dynamic risk assessment, intelligent decision support, visual display and the like, and the efficiency and the automation level of network security management are improved.

The invention provides a digital asset-oriented network security management method and system. The method comprises the following steps: acquiring a digital asset list and a business process document, identifying keywords in the document by using a natural language processing technology, constructing an association relationship graph of digital assets and business processes, and discovering potential association; directly connected business process nodes of each digital asset are extracted from the incidence relation graph, an asset business influence range report is generated, and a many-to-many mapping relation between the assets and the businesses is displayed in a matrix form; in the review process, association and quantitative indexes, including a risk thermodynamic diagram, an influence degree scatter diagram and the like, among assets, risks and business processes are dynamically presented through a visualization technology, and a visual information transmission channel is provided for all parties; and after meeting review is consistent, qualitative influence analysis of the business department and quantitative loss estimation of the technical department are integrated into a business influence analysis result by adopting a fuzzy comprehensive evaluation method, and a comprehensive business influence level is obtained.

The invention provides a self-adaptive network security early warning system and method based on deep learning, and aims to continuously update a threat recognition model through an advanced autonomous learning mechanism to adapt to a rapidly changing network environment. The system establishes a dynamic behavior baseline by integrating multi-source data including network traffic, system logs, user behaviors and the like, and realizes real-time monitoring of network behaviors and accurate identification of abnormal behaviors; once potential threats are detected, the system can automatically trigger preset response measures, such as suspicious traffic isolation and access request blocking, so that actions can be taken quickly before damage caused by the threats; according to the design of the system, the dependence on manual intervention is reduced, the real-time performance and effectiveness of early warning are improved, and the recognition accuracy of unknown attacks is remarkably improved; through the automatic and intelligent early warning mechanism, more reliable and intelligent protection is provided for network space security, and high efficiency and accuracy of network security management are ensured.

The invention provides a network security multi-mode intelligent detection system and method, relates to the technical field of network security management, and is applied to a power distribution system which comprises a communication device and a power distribution device. The network security multi-modal intelligent detection system comprises a multi-modal data acquisition module used for acquiring network flow data, equipment characteristic data and behavior data of a power distribution system; the detection engine module is used for analyzing and detecting the network flow data, the equipment characteristic data and the behavior data to obtain a detection result; and the decision and response module is used for performing risk assessment according to the detection result based on a preset risk assessment model to obtain a risk grading result and a response strategy. According to the invention, comprehensive monitoring and deep analysis of the network security condition of the power distribution system are realized. By integrating multi-modal data, the limitation of a traditional single data detection mode is effectively overcome, and the accuracy and timeliness of threat detection are improved.

The invention relates to an open source intelligence relevance identification method and system based on a semantic analysis driving model. The method comprises the following steps: carrying out fine-grained semantic analysis on a network security report and a forum discussion post by adopting a natural language processing technology based on deep learning, respectively mining word-grained context semantic association feature representations of the network security report and the forum discussion post, and carrying out fine-grained semantic interaction response analysis on the network security report and the forum discussion post, therefore, whether the forum discussion post is the associated information of the network security report or not is intelligently identified. Therefore, the accuracy and efficiency of open source intelligence relevance identification can be effectively improved, an enterprise is effectively assisted in finding potential security threats in time, and the network security management capability is improved.

The invention discloses a network space map surveying and mapping method and system based on multi-source data fusion, and the method comprises the steps: obtaining a multi-source data set in a unified format based on network flow data, equipment information data and geographic position data; obtaining a network asset entity and an incidence relation graph thereof through entity identification and correlation analysis based on the multi-source data set with the uniform format; obtaining a network space three-dimensional map model through three-dimensional space mapping and visual rendering based on the network asset entity and the association relationship map thereof; based on the network space three-dimensional map model, performing dynamic updating according to the accessed real-time data flow to obtain real-time network space situation data; and obtaining a network security risk assessment result through anomaly detection and threat identification based on the real-time network space situation data. According to the invention, visual display and security situation awareness of the network space are realized, and a brand new decision support tool is provided for network security management.

The invention belongs to the technical field of blockchain and Internet of Vehicles security management, and relates to an Internet of Vehicles security and credible message sharing method based on blockchain and trust management, comprising: a message providing vehicle records and broadcasts a message, and a message receiving vehicle receives the message, scores the authenticity of the message, and broadcasts the message to a consensus vehicle; the consensus vehicle performs usefulness scoring on each authenticity score s1, i, when the number of high usefulness scores is greater than a threshold value Q, the data (m, s1, i, s2, i, c, t) is uploaded to the accounting node, and s2, i, c are high usefulness scores of the consensus vehicle c on s1, i; the accounting node receives and verifies the data (m, s1, i, s2, i, c, t), packages the verified data into a block and stores the block into a block chain; the RSU calculates the trust value of the vehicle in the area and shares the trust value to an RSU cluster; the RSU cluster makes a trust decision on the vehicle according to the trust value of the vehicle; according to the method, authenticity scoring and usefulness scoring are carried out on the message, the credibility of the shared message in the Internet of Vehicles is improved, and the authenticity and integrity of the message are ensured in combination with the block chain technology.

The invention relates to the technical field of network security management, in particular to a network security management system based on big data, which comprises a data acquisition and integration unit, a dynamic threshold setting unit, a fuzzy comprehensive evaluation unit, a machine learning optimization unit and a control unit. The acquisition process has intelligent characteristics and adopts a block chain to cache data, the dynamic threshold setting unit constructs a model to adjust a threshold by combining a hidden Markov model, kernel density estimation and a reinforcement learning algorithm for different network crime types, and the fuzzy comprehensive evaluation unit determines a membership function and distributes weights by applying a fuzzy mathematical algorithm. And the machine learning optimization unit uses historical data to train and update the model, assists in case-related account determination, effectively solves the problems of missed determination and misjudgment caused by a fixed threshold value in traditional account risk assessment, and improves the accuracy of network criminal account risk assessment.

The invention discloses a security operation and maintenance management method and system based on a network security event, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-dimensional data, and calculating an attack state based on the preprocessed multi-dimensional data; the attack influence degree is calculated by using a weighted propagation model based on the attack state, and a fitness function is constructed and optimized based on the attack influence degree to obtain an optimal protection strategy set; and converting the optimal protection strategy set into a control instruction, executing the control instruction, and storing, collecting and analyzing generated multi-dimensional data. A non-linear ordinary differential equation is constructed through a non-linear reaction diffusion model, the predictability and the coping capacity of network security management and operation and maintenance are improved, the attack influence degree is calculated through a weighted propagation model, accurate estimation of the wide propagation effect of network security threats is achieved, and through construction and optimization of a fitness function, the network security threats can be accurately estimated. The flexibility and adaptability of the protection system are improved, and the requirement for manual intervention is greatly reduced.

The embodiment of the invention provides a method, device and system for constructing an attack graph, and a storage medium, and relates to the technical field of network security. The method comprises the steps that based on a test case knowledge base of a target system, an attack graph information expansion algorithm is executed through a knowledge graph technology, and expanded information is obtained; utilizing the expanded information to construct an attribute attack graph of the target system; and carrying out attack path description on vulnerabilities of the target system based on the attribute attack graph. An attack graph information expansion algorithm is executed through a test case knowledge base based on a target system and by means of a knowledge graph technology, information needed for constructing an attack graph can be obtained, potential attack paths can be mined, the attack graph information is expanded, and then a comprehensive and accurate attribute attack graph is constructed. According to the method, effective description of the vulnerability attack path of the target system is realized, so that the constructed attack graph can reflect the security condition of the network system more truly, more scientific decision support is provided for network security management personnel, and the network security protection effect is improved.

The invention provides an Internet of Vehicles vulnerability knowledge graph updating method based on a cloud platform, and the method comprises the steps: monitoring vulnerability updating information, carrying out the popularity analysis, screening out the information with high popularity based on a popularity threshold value, and extracting potential entities from the information; expanding the potential entity; and updating the knowledge graph based on the potential entities. According to the method, the dispersed vulnerability information is integrated in a manner of establishing the knowledge graph, so that the problem of information fragmentation is eliminated, network security managers can understand and utilize the vulnerability information more quickly and accurately, and the efficiency of coping with vulnerabilities is improved. On the basis, in order to ensure the real-time performance and accuracy of the Internet of Vehicles vulnerability information knowledge graph, a plurality of data sources are further monitored in real time through technologies such as machine learning and data mining, and potential entities needing to be updated are screened out for updating the knowledge graph in real time.

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user / entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies / threats were previously known. The security platform can include both real-time and batch paths / modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

The invention discloses a network security protection management system and method based on big data, and relates to the technical field of network security management, and the method comprises the steps: collecting industrial protocol layer data, physical sensor data and process parameters, extracting network behavior features, physical features and process correlation features, and constructing an industrial security feature vector; according to the security weight coefficient and the industrial security feature vector of the current process stage, calculating a threat score of the equipment, and dynamically adjusting a threat level through a three-level verification mechanism; constructing an equipment dependency graph, performing risk diffusion calculation based on the adjacent matrix and the attenuation coefficient, and generating a risk diffusion priority list to adjust an isolation strategy; an improved multi-target genetic algorithm is adopted to solve a Pareto optimal solution set, an equipment recovery sequence and a process parameter adjustment scheme are determined, and a recovery instruction is issued to realize safe recovery, so that the dynamic perception and accurate defense capability for industrial network threats is improved, and the safety and stability of industrial production are guaranteed.

The invention discloses a power data communication network security situation prediction method, which comprises the following steps of: aiming at a hot spot multi-dimensional orientation description vector, acquiring a network security event log, adopting a time sequence event chain construction technology, and determining event triggering frequency and service interruption duration related to a hot spot through matching of event triggering frequency and event association strength, so as to predict the security situation of the hot spot. Obtaining an event chain sequence; extracting an event trigger frequency, a service interruption duration and a hotspot influence range from the event chain sequence, and judging a hotspot life cycle stage through quantification of a node load state and traffic abnormal fluctuation to obtain a life cycle quantitative index; and extracting a hot spot influence range and traffic abnormal fluctuation from the global security situation view data, and if the hot spot influence range or the traffic abnormal fluctuation exceeds a preset threshold, adjusting weight redistribution through a node load state to obtain an incremental change feature set. According to the method, the hotspot situation in the power data communication network can be comprehensively and dynamically analyzed, and powerful support is provided for network security management and decision making.

The invention provides a network security attack threat analysis method and device based on a rough set, and relates to the technical field of network security. The method comprises the following steps: collecting real-time network flow data, analyzing the characteristics of the network flow data by applying a data attribute evaluation technology in a rough set theory, evaluating the fluctuation intensity and the fluctuation amplitude of the data, dynamically adjusting the size of a time window, and obtaining a time window size adjustment parameter. According to the invention, abnormal data are quickly positioned through statistical characteristics, the efficiency and response speed of network security monitoring are improved, resources are dynamically configured by evaluating the abnormal frequency and severity in the data stream, and the frequency of network monitoring is optimized, so that the network security management is more active and prospective, and the network security management efficiency is improved. The response and processing capabilities of the network are detected by dynamically adjusting the attack frequency, the network security configuration is further optimized, and the overall security and stability of the network are greatly improved.

The invention relates to a public multi-mode cloud network resource software security enhancement method based on neural symbol fusion reasoning, which comprises the following steps: an intermediate representation generation stage: generating and optimizing an intermediate representation of a program through a fine-tuned large language model, and establishing semantic mapping from a source code to a structured logic representation; in the symbol language conversion stage, the intermediate representation generated by the large language model is converted into a domain-specific language fact set which can be recognized in the symbol logic reasoning stage, and formal and logic expression of program semantics is achieved; and a symbol logic reasoning stage: matching the fact set with the rule base through a symbol logic reasoning engine, performing detection and verification according to the safety rule, generating a structured report, and feeding back a result for optimization. The method is suitable for security enhancement of various core software systems in a public cloud network multi-modal network environment, high-precision security analysis is carried out on cross-modal and cross-subsystem fragmented codes in a compiling-free environment, and verifiable technical support is provided for public cloud network security control.

The invention relates to the technical field of network security monitoring, and discloses a network security situation awareness method and system, and the method comprises the steps: collecting a multi-source heterogeneous log, carrying out the standardized analysis, and obtaining log event data; performing real-time analysis by utilizing a dynamic baseline association engine based on the log event data to obtain log association alarm data, analyzing a triple from the log association alarm data, constructing a basic knowledge graph based on the triple, performing rule reasoning and embedded reasoning, and integrating reasoning results to form a situation-enhanced security situation knowledge graph; threat data are extracted according to the security situation knowledge graph, the threat data are optimized in combination with a graph neural network GAT to obtain a final network attack threat value, network security situation awareness is carried out based on the network attack threat value, and the threat data comprise comprehensive criticality and an attack influence range. According to the invention, the efficiency and effect of network security management can be improved.

The invention relates to the technical field of network security, and discloses a network security management method and system based on a big data model, and the method comprises the steps: 1, converting multi-source heterogeneous data into a graph node containing a device entity, an I P entity and a user entity, and an interaction edge containing a timestamp and a relation type; step 2, constructing an attack chain dynamic evolution equation based on graph nodes and interaction edges, wherein the equation comprises an attacker action parameter and a defender action parameter; and step 3, inputting a time fusion Transform model to obtain probability distribution of a future attack action sequence by using a state variable corresponding to the attack chain dynamic evolution equation. According to the method, the technical scheme of constructing an attack chain dynamic evolution equation based on a differential game model, predicting an attack action sequence through time fusion Transformer and dynamically updating a defense strategy through meta reinforcement learning is adopted, and the technical effects of accurately modeling an attack evolution path, predicting an attack behavior in advance and generating a self-adaptive defense strategy in real time are achieved.

The invention belongs to the field of network security, and relates to a method and device for constructing a network security management and control platform, electronic equipment and a storage medium, and the method comprises the steps: constructing a P-POT-PDRR security system model; constructing an intelligent multi-agent system consisting of a sensing agent, an analysis agent, an execution agent and a collaborative scheduling agent; through multi-source network data acquisition, cleaning, fusion and asset map construction, perception of a network environment is realized. Constructing an AI intelligent analysis and threat identification engine; based on an analysis result and a predefined strategy, risk assessment, attack path prediction and automatic response decision are realized, and the threat disposal time is shortened; and iterating parameters of the P-POT-PDRR security system model by continuously collecting execution feedback and optimizing strategy rules. The collaboration of a safety system is improved; the intelligent level is higher; the threat processing time is shortened, the loss caused by attacks is reduced, and the response efficiency is better; and the method has good expandability and compatibility.

The invention discloses a management software security maintenance method based on an internet information technology, which belongs to the technical field of data security and comprises the steps of block chain patch management, zero-trust architecture identity verification and access control, vulnerability response and repair and machine learning and dynamic behavior analysis. The technical problems of opaque patch management, low vulnerability response efficiency and insufficient unknown threat protection in traditional network security management are solved, patch tampering and malicious software invasion are effectively prevented, the security of intranet resources is improved, the vulnerability response speed is increased, the requirement for manual intervention is reduced, and the security of the intranet resources is improved. The protection capability of the system to novel attacks is enhanced, the complexity in the identity verification process is greatly reduced, the user experience is improved, the expansion range of potential attacks is reduced, and the flexibility and expandability of the system are enhanced.

The embodiment of the invention provides an LLM-based 6G network automatic security processing method and system. The method is applied to the field of network security intelligent protection, and comprises the following steps: acquiring a network data stream, generating a structured log, extracting features, inputting the features into an intrusion detection model to identify attack behaviors, performing format conversion on a result to generate an LLM model, inputting the LLM model, and reasoning to obtain a network security disposal strategy. And extracting key fields, performing structured packaging, uploading the key fields to a block chain to complete evidence storage and integrity verification, and finally executing corresponding security control operation according to a strategy. According to the scheme, intelligent identification and automatic processing of network attacks are realized, after key fields are extracted, the structured strategy data are generated and uploaded to the block chain system for evidence storage and verification, traceability and data integrity of the processing process are ensured, network defense control which is automatic, high in security and timely in response can be realized, and the network attack processing efficiency is improved. And the intelligent and credible level of network security management is obviously improved.

The invention provides a network security multi-mode intelligent detection method, device and equipment and a storage medium, and relates to the technical field of network security management.The detection method comprises the steps that static feature data, dynamic network flow data and time sequence behavior mode data of network boundary equipment are collected; performing multi-modal fusion analysis on the static characteristic data, the dynamic network flow data and the time sequence behavior mode data to generate a comprehensive risk result; determining whether to trigger a preset blocking sandbox mechanism based on the comprehensive risk result; and when a preset sandbox blocking mechanism is triggered, starting a preset verification process, performing simulation verification according to the comprehensive risk result, the dynamic network flow data and the time sequence behavior mode data to obtain a verification result, and performing real-time blocking operation according to the verification result to ensure network boundary security. According to the method, the limitation of traditional single data source detection is broken through, and the lag mode of traditional artificial log auditing is thoroughly changed.

The invention belongs to the technical field of network security management and control, and particularly relates to a data security storage method adaptive to network security prevention and control, which comprises the steps of data acquisition, multi-dimensional feature extraction, optimal prevention and control strategy generation, hierarchical encryption storage, abnormal behavior traceability and dynamic isolation response. According to the system, illegal data injection risks are blocked from an entrance through a source data authentication acquisition module, multi-dimensional effective features of data are extracted through a multi-dimensional feature purification module, the multi-dimensional effective features and real-time network threat situations are fused through a prevention and control strategy adaptation module, and an optimal prevention and control strategy is screened by quantifying the adaptation degree; the hierarchical encryption storage module reasonably distributes storage hierarchies and executes differential encryption and hierarchical backup, the abnormal behavior traceability module accurately identifies abnormal behaviors, and the dynamic isolation response module executes hierarchical isolation and triggers emergency response and strategy optimization, so that full-life-cycle safety management and control of data from collection, storage to access is realized, and the safety of data storage is improved. And the prevention and control accuracy and the system operation efficiency are both considered.