4 results about "Power attack" patented technology

This invention proposes a method and system for causal verification and attack tracing in power systems, belonging to the field of power system network security technology. The method includes: collecting multi-source data from the power system; standardizing the multi-source data; extracting entity-relationship-attribute triples; cleaning the triples to generate a triple dataset; constructing a power attack tracing knowledge graph based on the triple dataset and combining entities and their inter-entity business relationships; selecting candidate event sets from the power attack tracing knowledge graph based on abnormal equipment events; constructing an attack causal graph based on the candidate event sets; verifying the causal relationships between events; and reconstructing the attack chain to locate the attack source. This invention improves the physical credibility of attack paths, the ability to identify attacks specific to power scenarios, and the supporting value and practicality of tracing results for defense decisions; it reduces the false positive rate caused by accidental correlations and improves the accuracy of attack chain and source location.

The application provides a power system causal verification attack tracing method and system, and belongs to the technical field of power system network security. The method comprises the following steps: collecting power system multi-source data, standardizing the power system multi-source data, extracting entity-relation-attribute triples, performing data cleaning on the triples, and generating a triple data set; based on the triple data set, combining entities and business relationships between entities, constructing a power attack tracing knowledge graph; according to the device abnormal event, screening a candidate event set from the power attack tracing knowledge graph, constructing an attack causal graph based on the candidate event set, verifying the causal relationship between events, restoring the attack chain to locate the attack source. The application improves the physical credibility of the attack path, the recognition ability of the power scene special attack, the support value and practicality of the tracing result for the defense decision, reduces the misjudgment rate caused by accidental association, and improves the accuracy of attack chain and source location.

The present invention discloses a data center power attack detection method and system. Through a GAN model based on reinforcement learning, the generator's ability to fit samples and the discriminator's judgment ability are utilized to generate simulated time series data; a GBDT model is used for power attack detection; a power management and control module is run on the server side, and client programs are run on other machines to collect client data; and a GBDT detection model is run in the data center to grant the power management module the power of power management. When a power attack event occurs, the additional power consumption is reduced and the pressure of the power attack is alleviated. The present invention provides effective and reliable training data, improves the accuracy of the detection model, and can overcome the problem of insufficient data samples for power attack detection in data centers.

The invention provides a state-aware lightweight Bluetooth security framework, which comprises a state-based rule construction module used for extracting attack steps and attack data packets from a Bluetooth low-power attack database, constructing a finite-state machine model based on Bluetooth specifications, and determining a state-aware state by defining a normal state, an illegal state and a transfer path between the states, generating a state conversion rule for the malicious path; the eBPF rule deployment module is used for compiling the state conversion rule into an eBPF byte code by utilizing an LLVM compiler, transmitting the eBPF byte code to target BLE equipment through Bluetooth service, and loading the eBPF byte code into a kernel environment of the target BLE equipment, so that the eBPF rule takes effect in real time; and the session state extraction module is used for deploying hooks at a link layer and a security management protocol layer to capture session traffic, analyzing a captured session event according to a deployed eBPF rule so as to update the state of the finite-state machine in real time, triggering a defense mechanism when a malicious path is detected, preventing an attack behavior and resetting the state of the finite-state machine.