126 results about "Network segmentation" patented technology

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

Current OT security solutions mostly provide defensive security involving monitoring and network segmentation. However, offensive security, proven effective in IT systems, is not easily applicable to OT systems due to its sensitive nature and high availability requirements. To conduct offensive security measures in OT networks, the concept of Digital Twins emerges as a viable solution but with limited progress in developing virtual replicas that accurately simulate real environments. Further, the process of creating such replicas is inherently complex and time-consuming, often involving extensive manual work. The present invention discloses an environment named as “Battle Twin,” a specialized playground designed for breach and attack simulations specifically designed for OT networks. Battle Twin focuses on mimicking the security posture of the underlying network rather than replicating its production or behavioral aspects. By leveraging Battle Twin, security experts may effectively test and evaluate offensive security strategies without even touching real OT environments.

In response to a programmatic request, configuration information representing a multi-network-segment gateway established on behalf of a customer is stored at a networking service. In response to another programmatic request, a communication session is established between a route signaling node of the gateway and a routing information source located at a customer premise. In response to additional programmatic input, the networking service stores an indication that the gateway is to be used to transfer packets between a cloud-side virtual network and a customer-side virtual network. The routing information exchanged in the session pertains to the cloud-side and customer-side virtual network, and is used to transfer data packets between the two virtual networks.

The invention belongs to the technical field of intelligent detection of new energy equipment, and particularly relates to a solar panel defect detection method and system, computer equipment and a storage medium, and the method comprises the following steps: a lightweight defect preliminary screening and adaptive shooting step: carrying out the recognition and image collection of a solar panel array through a lightweight model at the edge end of an unmanned aerial vehicle; a defect segmentation and type identification step: performing accurate segmentation on the solar panel and the defects through a neural network model, and judging the types and grades of the defects in combination with a feature extraction and classification model; a defect enhancement optimization step: enhancing the defects through an adversarial network; a detection performance evaluation step: quantitatively evaluating the overall performance of the system through a multi-dimensional index; mSAN-Net network segmentation is adopted, so that the defect detection precision is improved; and in combination with a GAN defect enhancement technology, the omission ratio and the false detection rate of weak defects are reduced, so that the fine operation and maintenance requirements of the solar panel are met.

The invention discloses an underwater foresight sonar image segmentation method, system and device based on CNN and Transform, and relates to the technical field of digital image processing and mode recognition. The method comprises the following steps: S1, collecting image data collected by a foresight sonar, carrying out corresponding labeling, and obtaining a training set and a verification set after data enhancement through data processing; s2, performing feature extraction on the image through a cascade convolution module and a hybrid Transform model, wherein the convolution module pays attention to local semantic information of the image; in a data processing stage, data enhancement is realized by fusing technologies such as Contourlet transformation, in a network architecture, an encoder combines convolution and hybrid Transformer, learning of local and spatial information of an image is considered, deep feature fusion and data value mining are carried out by utilizing Swin Transformer and the like, and particularly, it is worth mentioning that an edge feature module can learn edge information of a target area, and the edge feature module can learn the edge information of the target area; the segmentation result is explicitly corrected, the network segmentation performance is comprehensively improved, and the accuracy of sonar image analysis is powerfully guaranteed.

Embodiments of the disclosure provide distributed authentication with network segmentation and dynamic authorization for networks. The system may include a device within a network of devices. An identifier is within the device and includes a cryptographic certificate. The device is configured to transmit the identifier to an authenticator as a security proof. The authenticator is configured to disable the device from performing at least one operation within the network before verifying an identity of the device via the identifier.

A system for zero-trust cybersecurity access control using continuous identity verification (100), comprising: a Policy Decision and Enforcement Orchestrator (1) configured to receive an access request from a user device and enforce a session with minimal privileges; an engine for continuous identity verification (2) configured to generate a time-dependent identity trust score by continuously verifying the user identity during an active session; a device state and telemetry collector (3) configured to acquire device state parameters, runtime signals and network telemetry and to generate a state value; a module for detecting behavioral risks and anomalies (4) that is configured to create behavioral profiles and detect anomalies based on user activity patterns, contextual signals and the history of resource access; a cryptographic authentication and secure token module (5) configured to issue and update a short-lived, bound access token associated with at least the identity trust value and the state value; and an adaptive response and microsegmentation module (6) configured to dynamically adjust access permissions, network segmentation and session privileges in real time, based on an aggregated risk assessment derived from modules (2) to (4), where the system (100) continuously reassesses trustworthiness during the session and selectively allows, restricts, requires enhanced authentication or terminates the session based on the aggregated risk assessment.

The invention relates to the technical field of image processing, and discloses a three-dimensional medical image segmentation method, which comprises the following steps: acquiring two prediction segmentation probability graphs of each sample based on two parallel sub-networks of a dual-network segmentation model, and calculating a soft pseudo label of an unlabeled sample; utilizing a distance regression head and a hyperbolic tangent function to obtain two prediction symbol distance fields of each sample based on the decoding feature map; calculating segmentation loss and regression loss of each labeled sample, and adding the segmentation loss and the regression loss to obtain supervision loss; calculating the pseudo label consistency loss and the symbol distance consistency loss of each unlabeled sample, and adding the pseudo label consistency loss and the symbol distance consistency loss to obtain consistency loss; optimizing the dual-network segmentation model under the joint constraint of supervision loss and consistency loss; and obtaining an input segmentation result of the to-be-segmented three-dimensional medical image by using the trained dual-network segmentation model. According to the method, the problem of class imbalance in the three-dimensional medical image is effectively relieved, and the segmentation precision of the weak edge region is improved.

A lung CT blood vessel image segmentation and reconstruction system based on multiple interpretable features performs further fine-grained segmentation on the basis of main airway features through a feature extraction module to obtain a plurality of connected domains, performs multi-stage feature extraction on the connected domains, and outputs multi-scale feature information; the blood vessel segmentation module generates an information matrix according to the indexes and the pulmonary parenchyma mask, generates a blood vessel network segmentation result through an adversarial network and performs post-processing; and the model reconstruction module performs three-dimensional reconstruction on the blood vessel network segmentation result and the pulmonary parenchyma mask to obtain a 3D model. According to the method, on the basis of anatomical priori knowledge of pulmonary vessels and airways, a large amount of multi-scale feature information is utilized, the information loss of the two-stage segmentation network is reduced, and the network adaptability and the learning ability of the relation between pixels under the complex condition are improved. In the aspect of system design, a modular design and management mode is adopted, efficient resource access is achieved, and meanwhile the operability and usability of the system are improved through end-to-end process design.

A wireless communication system includes an external provider subsystem and an electronic network subsystem in operable communication with the external provider subsystem. The electronic network subsystem is configured to provide a first microservice and a second microservice different from the first microservice. The wireless communication system further includes an in-home subsystem (i) separate from the external provider subsystem, (ii) in operable communication with the electronic network subsystem, and (iii) including a first micronet and a second micronet different from the first micronet. The first micronet is configured to operably interact with the first microservice, and the second micronet is configured to operably interact with the second microservice. The wireless communication system further includes at least one electronic device configured to operably connect with one of the first micronet and the second micronet.

A wireless communication system includes an external provider subsystem and an electronic network subsystem in operable communication with the external provider subsystem. The electronic network subsystem is configured to provide a first microservice and a second microservice different from the first microservice. The wireless communication system further includes an in-home subsystem (i) separate from the external provider subsystem, (ii) in operable communication with the electronic network subsystem, and (iii) including a first micronet and a second micronet different from the first micronet. The first micronet is configured to operably interact with the first microservice, and the second micronet is configured to operably interact with the second microservice. The wireless communication system further includes at least one electronic device configured to operably connect with one of the first micronet and the second micronet.

A wireless communication system includes an external provider subsystem and an electronic network subsystem in operable communication with the external provider subsystem. The electronic network subsystem is configured to provide a first microservice and a second microservice different from the first microservice. The wireless communication system further includes an in-home subsystem (i) separate from the external provider subsystem, (ii) in operable communication with the electronic network subsystem, and (iii) including a first micronet and a second micronet different from the first micronet. The first micronet is configured to operably interact with the first microservice, and the second micronet is configured to operably interact with the second microservice. The wireless communication system further includes at least one electronic device configured to operably connect with one of the first micronet and the second micronet.

A wireless communication system includes an external provider subsystem and an electronic network subsystem in operable communication with the external provider subsystem. The electronic network subsystem is configured to provide a first microservice and a second microservice different from the first microservice. The wireless communication system further includes an in-home subsystem (i) separate from the external provider subsystem, (ii) in operable communication with the electronic network subsystem, and (iii) including a first micronet and a second micronet different from the first micronet. The first micronet is configured to operably interact with the first microservice, and the second micronet is configured to operably interact with the second microservice. The wireless communication system further includes at least one electronic device configured to operably connect with one of the first micronet and the second micronet.

According to some embodiments, a method of controlling access to network resources includes: receiving an authentication request from a user device to a core security service; if the user is authenticated, authorizing the user device to connect to a private cloud, and connecting the user device with the private cloud and retrieving user-specific segmented firewall rules stored in the private cloud; routing, through the firewall rules, a request by the user device to access an outer resource; evaluating the request against the firewall rules; if the request meets the firewall rules, routing the request through security measures of the firewall; and if the request does not meet the firewall rules, denying the user device access to the outer resource.

The invention provides a space detection positioning method and device, electronic equipment and a readable storage medium, and the method is applied to a compound eye detector, and comprises the steps: controlling the compound eye detector to capture a scene image according to a preset detection parameter; preset image processing is carried out on the scene image to obtain a target image, and the preset image processing comprises denoising processing, contrast adjustment processing, superposition processing and local pixel adjustment processing; extracting image feature information in the target image based on a network segmentation method; performing deep learning on the extraction process of the image feature information by adopting a preset deep learning algorithm; and analyzing the image feature information, and determining parameter information of the detection object and position information of the detection object in the space. According to the invention, multiple preprocessing is carried out on the scene image collected by the compound eye detector, the quality of the image collected by the compound eye detector is effectively improved, and the detection precision of the compound eye detector is further improved.

Methods and systems relate to packet forwarding that includes a network device receiving a message from a second network device and that has a destination address of a third network device. The circuitry of the network device determines that a connection between the second network device and the third network device has been previously opened by the third network device. In response to the determination that the connection is open and in response to receiving the message, the circuitry transmits the message towards the third network device.

The application discloses a kind of spine segmentation methods, comprising the following steps: step 1: data pre-processing, generate spine heat map and windowing to image, the window width and window width of lumbar bone tissue are respectively set to 400 and 1800;Step 2: using U-Net structure roughly locates lumbar vertebra;Step 3: calculate image bounding box, obtain the range of selected lumbar vertebra using 4 neighborhood, and select the voxel with HU value greater than 0.3 times of the maximum HU value of image as possible lumbar vertebra, then the obtained bounding box is extended in each dimension 0.05-0.2 times of the corresponding image size;Step 4: network segmentation based on XUnet network, XUnet uses Inception block to extract features;Through the implementation of the application, while deepening the network width and depth, improving the network expression ability, further reduces the redundant parameters in the network, realizes the deep learning and automatic efficient vertebral automatic segmentation effect, the positioning segmentation effect is good, plays a prominent progress, has certain use value and popularization value.

The application provides a power grid transient fault mode classification method and system based on artificial intelligence, relates to the field of power system faults, and comprises the following steps: collecting multi-dimensional physical quantity data, extracting transient response strength and topological connectivity coupling calculation node state values, generating diffusion trajectories and extracting morphological features to determine fault types, source positions and boundaries, calculating time sequence gradient to trace propagation paths, identifying path intersection nodes to calculate cumulative contribution degrees to determine core nodes, configuring isolation trigger conditions for the core nodes to output a network segmentation scheme. The application can quickly and accurately identify faults, reduce power outage ranges, and improve power grid stability.

In an example, systems and methods enable automatic implementation of intent-based security policies in a network system, such as a software-defined wide area network system, in which network segment prefixes for network segments at one or more sites are dynamically learned. A service orchestrator controller translates an intent-based security policy input by a user to a security policy for a first site. The security policy for the first site specifies a segment-specific queryable resource associated with a second site. To implement the security policy, a device associated with the first site queries the segment-specific queryable resource associated with the second site, and updates one or more forwarding tables of the device with the network segment prefixes associated with one or more network segments at the second site received in response to the query. The first site forwards network traffic to the second site based on the updated forwarding tables.

A request of a VPN client to connect to a second set of one or more networks is received by a first VPN server associated with a first set of one or more networks. The request comprises an identifier of the VPN client, an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and a digital signature of the access control server. The digital signature is validated using a public key of the access control server. One or more common networks each included in both the first and second sets of networks are identified. A firewall of the first VPN server is modified to permit the VPN client to connect to the one or more common networks.

Since IP network topology often has a clear hierarchical structure, using community detection algorithm in graph theory can divide the topology into several regions with high cohesion and low coupling, and selectively spread the routing update in the region to other regions, which can effectively avoid the calculation amount of full routing simulation, and realize fast and accurate IP network routing simulation reasoning. The application proposes an IP network routing simulation reasoning method based on community detection, which first divides the whole network into multiple cluster structures based on the community detection algorithm, and the shortest path between the nodes in the cluster does not pass through other clusters, and uses this division result as the basis for calculating the routing update. Then, the change operation of the network topology is accurately identified, and according to the network elements involved in the change point and the cluster information to which they belong, the network element node pairs that need to be recalculated are further arranged, and the SPT tree of the node pairs is recalculated and the routing update is performed. At the same time, an IP network routing simulation reasoning device based on community detection is proposed, which includes a topology management module, a network configuration module, a network segmentation module, a change analysis module and a routing calculation module, to realize the topology segmentation and routing simulation reasoning process of the IP network.

The application provides a network anomaly positioning method and device, equipment and a readable storage medium, relates to the technical field of communication, and is applied to an anomaly positioning device. The method comprises the following steps: obtaining a first segment characteristic value, the first segment characteristic value being a value of a transmission characteristic of a first network segment in a network; determining N segment characteristic comparison values, the N segment characteristics comprising transmission characteristics of N network segments in the network, each segment characteristic comparison value in the N segment characteristic comparison values being within a reference value range of the transmission characteristic of the corresponding segment; inputting the N segment characteristic comparison values and the first segment characteristic value into a first prediction model to obtain a first output of the first prediction model, the first prediction model being used for determining whether the network is an abnormal network based on N+1 values corresponding to N+1 segment characteristics; and determining whether the first network segment is an abnormal network segment according to the first output. The application is used for solving the problem of low positioning efficiency when positioning the network anomaly position.

A request of a VPN client to connect to a second set of one or more networks is received by a first VPN server associated with a first set of one or more networks. The request comprises an identifier of the VPN client, an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and a digital signature of the access control server. The digital signature is validated using a public key of the access control server. One or more common networks each included in both the first and second sets of networks are identified. A firewall of the first VPN server is modified to permit the VPN client to connect to the one or more common networks.

The application discloses a kind of premature infant retinopathy typical lesion automatic segmentation method, comprising the following steps: S1, collect ROP image, exclude unqualified image therein, and after the qualified ROP image is labeled, it is used as ROP lesion segmentation dataset, and dataset is divided into training set, verification set and test set;S2, construct deep neural network model;S3, after the training set is preprocessed, the training set is used to train the deep neural network model, calculate loss, optimize network parameters, and obtain the optimal model after several iterations;S4, the optimal model is tested using test set, and the segmentation performance evaluation index of the model on test set is obtained.Compared with the prior art, the method can better distinguish between background and four lesion structures, reduce the misjudgment rate, achieve automatic pixel-level segmentation of ROP fundus image lesions, and ultimately improve the network segmentation performance.

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

The invention discloses a multi-agent task allocation method based on network coverage dynamic matching control, which comprises the following steps that: multiple agents self-organize a network and divide the network into N sub-networks, the sub-networks adopt a navigator and follower mode, and the navigator executes sub-network management and decision; each sub-network obtains a current environment state, and selects to explore a task domain or search other sub-networks by using a high-level decision of a hierarchical deep reinforcement learning model; executing agent movement by using a low-level decision of the hierarchical deep reinforcement learning model until a task domain or other sub-networks are found; performing network segmentation or fusion on the sub-networks which find the task domain or other sub-networks through network topology control to form a coverage sub-network or a new sub-network; and the intelligent agent in the coverage sub-network completes task execution by using the task allocation optimization model, and the new sub-network is converted after the task execution is completed. According to the method, task distribution can be explored by using multiple agents with a limited scale in an environment where network infrastructures are lacked and task distribution is unknown, and task distribution is completed, so that task response time is shortened, and the task completion rate is increased.

Embodiments of the application disclose a face reconstruction and occlusion region identification method, device and equipment and a storage medium. The method comprises: inputting a face image into a first network structure, outputting a reconstruction parameter vector of the face image when three-dimensional reconstruction is performed through the first network structure; performing three-dimensional reconstruction of the face image based on the reconstruction parameter vector to generate three-dimensional face information; performing rendering and mapping processing on the three-dimensional face information to generate two-dimensional face information containing network segmentation data; obtaining a deep feature map extracted by the first network structure, and constructing graph structure information based on the deep feature map and the two-dimensional face information; inputting the graph structure information into a second network structure, and outputting an occlusion region corresponding to the face image through the second network structure. The scheme optimizes overall resource deployment, can meet application scenarios with many parallel tasks and high real-time requirements, and has higher accuracy in occlusion region determination.

Mechanisms are provided for decentralized security orchestration. The mechanisms execute training, for each vendor network in the plurality of vendor networks, on a corresponding vendor network artificial intelligence (AI) computer model. The training is executed with training data collected from a corresponding vendor network over time, where the training data represents transactions occurring within the corresponding vendor network. The trained models are executed on new security information to thereby classify activity in portions of the data processing system as to a security risk level. Fuzzy logic is executed on the classifications to automatically determine if segmentation of the data processing system is to be performed. If segmentation is to be performed, the mechanisms segment / isolate portions having a predetermined security risk level classification.

The present invention provides a network segmentation unit, a gateway device including the same, a network segmentation method, and a system. The gateway device includes a gateway unit and a network segmentation unit, and the network segmentation unit is disposed between the gateway unit and an external power grid. An impedance regulator is provided in the network segmentation unit. The network segmentation unit is configured to pass a first signal in a non-specific frequency range with low impedance to supply power to the gateway unit, and is configured to pass a second signal with high impedance to adjust the ratio of the power of the second signal before and after passing through the network segmentation unit to above a defined threshold, so that the gateway unit can segment the local area network and other networks based on the power value of the received signal. The frequency of the first signal is lower than the frequency of the second signal, and the second signal is used for communication of the local area network.

This invention provides an intelligent centralized monitoring method for full-color LED displays, comprising: analyzing inter-node dependencies and communication delays based on a neighboring node association model to identify target areas with network segmentation risks; detecting backup communication paths for risky nodes and selecting paths with communication delays below a preset threshold as priority switching paths; deploying a distributed consistency protocol to compare data differences and generating a synchronization order list based on data update frequency and business priority; using a fragmented transmission mechanism to divide the data to be synchronized into multiple data segments and transmitting them to the target nodes in parallel via multiple paths; initiating an automatic repair mechanism for inconsistent nodes, obtaining backup data from neighboring nodes to perform differential correction; and dynamically optimizing communication path weights and synchronization cycle parameters based on the correction results to complete iterative updates of the system status.