41 results about "Privilege escalation" patented technology

A system automatically evaluates requests for escalation of privileges in an organization. The system receives a Request for Escalation of Privileges (REP), in a natural language, that indicates a request from a Requesting User to elevate access privileges to a computerized organizational resource. The system automatically feeds the REP as input into a fine-tuned Large Language Model (LLM), which automatically performs an analysis of that REP, and automatically generates an LLM-based output indicating at least: a proposed minimal set of elevated permissions that are estimated by the LLM to be needed and also sufficient for achieving a task described in the REP. The LLM is configured to further generate output with textual reasoning for inclusion of at least one elevated permission in that proposed minimal set of elevated permissions.

The invention discloses an unauthorized vulnerability detection method, device and equipment and a readable storage medium, and is applied to the field of security detection, and the method comprises the steps: carrying out the semantic recognition of real business flow data through a large language model, and determining a to-be-detected interface; performing semantic analysis on the parameters of the to-be-detected interface by using a large language model to determine target parameters; extracting a parameter value with an unauthorized vulnerability risk in the target parameter from the historical real service flow data; generating a test effective load of the to-be-detected interface based on the target parameter and the parameter value by utilizing a large language model and a preset rule base; and performing unauthorized vulnerability detection on the to-be-detected interface by using the test payload, and determining a detection result. According to the method, the natural language understanding capability of a large language model is utilized, the limitation of traditional regularization preprocessing and effective load generation is broken through, and the method is adaptive to diversified scenes of a complex system.

The invention belongs to the technical field of data processing, and particularly relates to a cloud resource security access control method based on big data processing, which comprises the following steps: S1, constructing a real-time behavior calculation engine; s2, establishing a multi-modal risk assessment model; s3, generating and optimizing a self-adaptive strategy; according to the cloud resource security access control method based on big data processing, millisecond-level behavior data acquisition is realized by adopting Apache Flink, and a user-resource-behavior sequential relation network is constructed in combination with a Neo4j graph database, so that the static role limitation of the traditional RBAC is broken through, for example, when it is detected that a certain account accesses non-common resources in non-working time, the user-resource-behavior sequential relation network is not influenced, and the user-resource-behavior sequential relation network is not influenced. The system automatically triggers secondary authentication, so that the safety is improved; secondly, constructing an access graph through a sliding window, and calculating a node centrality index, namely, when a certain user node is suddenly connected with a plurality of high-sensitivity resources, namely deviating from a baseline by more than 3 sigma, immediately marking as a potential transverse unauthorized attack, thereby improving the intelligent level of identification and avoiding data leakage.

The application discloses a kind of power industrial control terminal network isolation method and system based on process security label binding;Belong to the technical field of power system network security, its operating steps include: decoupling physical network resources into independent partitions and mapping to independent user-mode network protocol stack instances;Through the bottom flow direction rule, the in-bound traffic is accurately delivered to the corresponding partition;Identify process security label at the application layer, establish the forced mapping of process and specific protocol stack instance and link;Through the controlled shared memory channel, realize the safe data interaction between partitions.The application realizes strong logical isolation on unified hardware, through the forced binding of process identity and network link, reduces the privilege promotion and horizontal penetration risk caused by traditional protocol stack sharing, while limiting the scope of failure impact, without relying on external physical isolation equipment, significantly improves the endogenous security protection capability of industrial control system network boundary.

Disclosed subject matter encompasses method operations performed by an embedded device. Exemplary deployments may include a BMC as the embedded device, but the embedded device is expressly not limited to BMCs. Disclosed subject matter enables partially-sandboxed execution environments (SSEEs) with an auditable framework supporting unrestricted or restricted system access via privilege elevation capabilities not generally permitted within conventional container solutions. Functional modularity is implemented without incurring the substantial overhead inherent in fully modular and isolated containers. Disclosed SSEEs require no intermediate runtime or the corresponding overhead. Disclosed subject matter may leverage sandboxing functionality native to at least some software package management utilities (SPMUs) including, as a non-limiting example, a Flatpak utility suitable for use in embodiments employing a Linux OS, to achieve footprint-efficient SSEEs.

The invention relates to the technical field of information security, in particular to a computer system network security risk monitoring system and method.The method comprises the steps that a code analysis tool is used for extracting a plurality of code snippets capable of being independently executed from a source code, a binary file or a running environment, and a function attribute tag is added to each code snippet capable of being independently executed; setting at least one attack purpose according to a preset security threat type, wherein the security threat type comprises a permission enhancement attack, a data leakage attack, a service interruption attack, a supply chain attack or an identity authentication bypassing attack; based on the attack purpose and the code snippets capable of being independently executed, a genetic algorithm is adopted to generate a plurality of code combination paths, static fitness scoring is conducted on the code combination paths, and when a novel attack means does not appear, timely response is conducted, potential attack paths which are not utilized are found out, and blocking is conducted in advance.

The present application relates to the technical field of cluster service management, and provides a cluster service proxy method and system, the method of the present application comprising: according to a request of deleting a host from an execution party, backing up data of the corresponding host, and deleting the host from the cluster by a host management center in a proxy service layer; executing an execution command verified by an application layer and the proxy service layer inside cluster resources by a command execution module in the application layer; and copying a to-be-copied file verified by the application layer and the proxy service layer into the cluster resources by a file copying module in the application layer. The system of the present application comprises: an application layer, a proxy service layer, a storage layer, and a cluster layer. The cluster service proxy method and system of the exemplary embodiments of the present application can ensure that the cluster service is not affected before deleting a host; avoid executing file copying and command execution on resources without operation right by the execution party; and prevent command injection, privilege escalation, and other operations that threaten the security of the cluster resources.

This invention discloses a method and system for mining permission-related vulnerabilities in power monitoring systems. First, it automates login to the target system to obtain valid test sessions. Then, it simulates user operations to trigger system function interfaces, capturing network request data during the interaction process and constructing an interface dataset. Data packets are filtered and analyzed, and sensitive traffic with abnormal permissions is identified based on a large language model. Cookies are replaced and replay tests are performed. The original response and the replay response are compared, and the presence of horizontal privilege escalation vulnerabilities is determined by calculating structural similarity. This invention effectively overcomes the shortcomings of traditional automated tools, such as high false positives and false negatives and poor flexibility due to a lack of dynamic decision-making capabilities, by constructing a complete closed-loop process of automated login, interface data collection, intelligent identification using a large language model, and cookie replacement and replay. This significantly improves the intelligence level of penetration testing and the accuracy of vulnerability mining.

The invention relates to a vertical unauthorized protection method based on an RBAC model, and belongs to the field of data security. The method comprises the following steps: formulating a custom annotation for classes and methods of a WEB system; when the class or the method uses the custom annotation, all interfaces of the class or the interface of the method are associated with a menu specified by the attribute value of the attribute menu; when the user has the authority of any menu in the appointed menus, judging that the user has the authority to access a corresponding interface, otherwise, judging that the user is vertical unauthorized and intercepting; and performing protection verification on vertical unauthorized, judging whether all the menu lists with the authority of the user contain any menu in the menu lists specified in the user-defined annotations or not, and if so, releasing the interface request. According to the method, simplification and generalization of vertical unauthorized protection can be achieved in a user-defined annotation mode, and the development workload and the later maintenance cost are effectively reduced.

System and method for non-invasive monitoring and exploitation detection in third-party software processes. The system includes modules for scanning process memory to identify sensitive credentials such as application programming interface (API) keys and tokens, monitoring opened file descriptors including files, sockets, and inter-process communication channels, and analyzing network activity including domain name system (DNS) requests and encrypted connections. Runtime metadata such as privileges, environment variables and resource usage is also collected. The system correlates these signals to detect indicators of exploitation, such as unauthorized access, privilege escalation, or injected payloads, without modifying or instrumenting the monitored process. Integration with external security systems may enhance detection accuracy. Alerts and reports are generated in real-time to support incident response and forensic analysis.

Systems and methods are disclosed for implementing a system to generate a knowledge graph of trust relationships between roles in a cloud environment, and to identify misconfigurations that may lead to privilege escalation. In certain embodiments, a method may comprise implementing a graph-based role permission inspection system for identity and access management (IAM) roles in a cloud environment, including generating a graph representation of trust relationships between roles, where a first role having a first set of privileges can endorse a second role having a second set of privileges. The method may further include determining whether the second set of privileges includes a permission not available in the first set of privileges, and generating an indicator that the first role violates a policy when the second set of privileges includes the permission not available in the first set of privileges.

A privilege escalation risk detection in a host (1, Fig.1) applicable to a computer and / or network, comprising: examining which executables are running in a host (401) and searching for behavioural in

An arrangement and a method of privilege escalation detection in a computer or computer network. The method comprises examining which executables are running in a target host; searching from a behavioral data source behavioral information of the executables running in the target host; including in a first list identification information of executables running in the target host which the behavioral information indicates are known to run with a first or a higher level privilege; including in a second list identification information of sensitive resources loaded or executed by the executables included in the first list; examining the sensitive resources included in the second list to determine whether that resource is writable by an executable running at a privilege level lower than the first level; and providing an indication of every resource that is loaded by the first or higher level privilege executable but is writable by the executable running at a privilege level lower than the first level as a potential vulnerability.

The application discloses a vulnerability correlation analysis method, system and device and a storage medium, and relates to the technical field of computers. The vulnerability correlation analysis method comprises the following steps: acquiring a system vulnerability list of a target system; classifying vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on a privilege escalation theory, wherein the privilege escalation categories comprise prerequisite privileges and result privileges; combining vulnerabilities in multiple privilege escalation categories to obtain multiple vulnerability attack chains; determining the scores of the vulnerability attack chains according to the influence degree quantitative values, the exploitability quantitative values and the privilege escalation span quantitative values of the vulnerability attack chains, and selecting an optimal vulnerability attack chain according to the scores of the vulnerability attack chains. The application can mine the privilege correlation between system vulnerabilities, select the optimal vulnerability attack chain based on the scores of the vulnerability attack chains, and is helpful to efficiently repairing system vulnerabilities.

A system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event.

The application relates to the technical field of network security, and discloses a network security threat intelligent detection method based on big data analysis, which comprises the following steps: collecting network equipment flow log data, constructing a network behavior space-time fusion matrix, and calling the optimal threat detection algorithm; through an innovatively designed dynamic feature dimension alignment mechanism, the tensor structure mismatch problem caused by the difference between asset static data and network flow data sampling frequency in a traditional scheme is overcome; an adaptive tensor interpolation technology is used to realize the mapping of dynamic and static logs in the space-time dimension, reduce systematic deviation during feature fusion, and improve the accuracy of subsequent threat analysis; through the established network behavior space-time fusion matrix, asset service topology, vulnerability fingerprints and real-time flow behavior are three-dimensionally associated and modeled for the first time, the behavior chain characteristics of an attacker in the process of horizontal movement and privilege escalation are described, and the attack path restoration capability for advanced sustainable threats is improved.

An apparatus and method for cyber risk quantification calculated from the likelihood of a cyber-attack on the target enterprise and / or cyber ecosystem based on its security posture. The cyber-attack likelihood can be derived as a probability-based time-to-event (TTE) measure using survivor function analysis. The likelihood probability measure can also be passed to cyber risk frameworks to determine financial impacts of the cyber-attacks. Embodiments of the present invention also relate to an apparatus and method (1) to identify and validate application attack surfaces and protect web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks; and / or (2) that protects web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks. This can include implementing an intelligent learning loop using artificial intelligence that creates an ontology-based knowledge base from application request and response sequences. Stochastic probabilistic measures are preferably applied to a knowledge base for predicting malicious user actions in real time.

This application discloses a method, apparatus, and storage medium for detecting lateral privilege escalation vulnerabilities, belonging to the field of cloud computing. The method is applied to a computing device, which includes an application and a first data table of the application. The method includes: obtaining interface functions included in the application, each interface function including at least one first variable; obtaining a function call chain based on the interface functions, the function call chain including multiple functions in the application, the function call chain being used to access the first data table based on the at least one first variable; and detecting whether the application has a lateral privilege escalation vulnerability based on the function call chain. This application can improve the accuracy of detecting lateral privilege escalation vulnerabilities.

The invention relates to a Kubernetes privilege extraction attack method, system, equipment and medium based on implicit privilege analysis and utilization, and the method comprises the following steps: statically analyzing and identifying various resources supported in a Kubernetes cluster through a resource identification module based on resource registration and collection, which comprise a main resource and sub-resources associated with the main resource; static analysis of resource performance functions is carried out on the obtained main resources and sub-resources, and various explicit permissions supported by the Kubernetes resources are obtained; implicit permission mappings implicit under various explicit permissions are obtained through semantic analysis, so that all final implicit permission mappings in the explicit permissions are obtained; based on the method, the system, the device and the medium analyze the security of the Kubernetes from multiple angles to more comprehensively understand and enhance the protection capability of the Kubernetes cluster, so that the security of the cloud native application is improved, potential threats are resisted, and potential attack risks are reduced.

The invention discloses an unauthorized vulnerability black box detection method based on a cross-request data dependency tracking mechanism. The method is used for identifying identity verification and authorization security problems with vulnerabilities in network applications. According to the method, a cross-request data dependency tracking mechanism is introduced to deduce an operation dependency relationship between pages, analyze feedback content and judge whether unauthorized reading or modifying operation exists or not, so that the detection of unauthorized vulnerabilities is realized. The method comprises the following specific steps: preprocessing: preparing an initial address of a target website and registering accounts of a common user and an attacker; constructing a cross-request data dependency graph, and establishing a dependency relationship among different operation requests; and vulnerability detection: tracking an attacker request through the cross-request data dependency graph so as to judge whether a vulnerability exists or not. According to the method for detecting the unauthorized vulnerability through the black box, the recall rate, the accuracy rate and the automation degree of unauthorized vulnerability detection are improved, and an effective unauthorized vulnerability detection tool is provided for software security analysts.

A method and system for kernel data isolation based on multiple kernel page tables is provided. Through creating multiple kernel page tables in a kernel system and binding specific applications to a corresponding page table for operation, each internal process of the application remains consistent with the corresponding page table in terms of kernel address space, and the kernel address spaces of different applications are isolated from each other due to existence of the different page tables. The system includes a page table management module and a private memory management module. The present disclosure protects private application data at the granularity of applications in the same kernel at very low costs to prevent data breach caused by read attacks on kernel address space or privilege escalation attacks, maintains privilege level division of kernel address spaces, and ensures transparency of private memories among applications and general IO capability of private memories.

The invention provides a vertical unauthorized vulnerability detection method and device, equipment, a medium and a program product, and the method comprises the steps: obtaining user full-link behavior data corresponding to each role under a detected system; determining a permission difference set corresponding to each role; the permissions in the permission difference set are permissions which are not possessed by other roles except the role; constructing a first unauthorized test case according to the first data corresponding to each permission difference set; the first unauthorized test case is used for detecting whether a user in the first role has the authority of a second role; constructing a second unauthorized test case according to the user full-link behavior data; the second unauthorized test case is used for detecting whether unauthorized access can be carried out under each role; and performing vertical unauthorized vulnerability detection according to the first unauthorized test case and the second unauthorized test case. According to the scheme, the problems that an existing vertical unauthorized vulnerability detection scheme is high in judgment result misjudgment rate and incomplete and unnecessary in test case can be solved.

The application discloses a memory management method and electronic equipment, and relates to the technical field of system security. The method comprises the following steps: obtaining a kernel native heap memory allocation function and a heap memory release function; obtaining a vulnerability object allocation function; monitoring the kernel heap memory allocation function and the vulnerability object allocation function through dynamic extension of a kernel program, collecting memory pre-allocation data according to a monitoring result, and performing a write operation on the memory; comparing double-boundary memory write operation parameters with the memory pre-allocation data, and detecting heap overflow of the memory write operation according to a comparison result; and in response to a detection result of the heap overflow of the memory write operation being failed, releasing an original memory application through the heap memory release function, and reallocating the memory application through a dynamic cache pool algorithm. The application can block privilege escalation and kernel crash caused by memory heap overflow in real time, solve the problems of memory fragmentation and defense lag, and significantly improve the continuous guarantee capability of a key business scenario.

This invention relates to the field of computer technology and discloses a method for secure management of hidden sectors, a hidden sector file system, a device, and a medium. The method, used in a hidden sector file system, includes: receiving a target user's request for a target operation on the hidden sector; verifying the target user's permissions, or permissions and password, according to a preset security policy in the security layer; the preset security policy in the security layer is mapped based on the mandatory access control policy of the security layer; and executing the target operation request when the verification passes. The technical solution of this invention uses a customized file system formatted with hidden sectors, employs an operation interface independent of ordinary file systems, and incorporates a security layer permission verification mechanism, providing an additional specific storage option compared to ordinary file systems and user permission mechanisms. This effectively prevents network attacks on user systems and effectively prevents internal privilege escalation attacks that compromise data security of critical information within the system through the file system.

This invention proposes a forensic analysis method and system based on a smart terminal. The method includes the following steps: Step S1: Dynamic adaptation configuration, real-time monitoring of the target terminal's operating system version and hardware identifier, and automatic loading of a matching privilege escalation script and data parsing protocol; the privilege escalation script is configured with an injected parameterized kernel module, which is constructed using a combination of pre-compiled binary templates and runtime injected variables. The pre-compiled binary templates contain system call hijacking instructions and memory address redirection logic; the automated engineering loads a dynamic symbol parser in a sandbox environment, and generates a data extraction interface by intercepting application data encryption and decryption function call points; Step S2: Cloud-based collaborative forensics, constructing an authentication token and session key based on the target account's encrypted backup data on the terminal, and initiating a read-only data request to the cloud server through a communication protocol simulating a legitimate client.

The invention provides a power line carrier communication scheduling method and system oriented to multi-terminal QoS guarantee. The method comprises the steps that an operation and maintenance case receives a response control task issued by a scheduling platform, identifies the type of a target terminal and determines the priority score, the waiting time score and the scheduling priority score of the target terminal; and the scheduling level of the response control task is determined based on the scheduling priority score, the response control task is distributed to the corresponding multi-dimensional scheduling sub-queue, the current to-be-executed task is selected in each scheduling period, and a preemption mechanism is supported. And in each scheduling period, dynamically updating the scheduling priority score of each response control task, and executing an aging privilege lifting mechanism based on the updated scheduling priority score. And after the current task to be executed is determined, determining a current communication link state based on the link state parameter corresponding to the target terminal, if the current communication link state is unstable, triggering a link adjustment strategy based on the type of the target terminal, and performing corresponding processing according to an adjustment result.

The application provides a permission control method and system for a container to access a host hardware service across domains, determines the number of slots in a host system configuration file, and generates slot identifiers, hardware service context mapping rules, security enhanced Linux type definition files, access control permission rules, and cross-slot prohibition rules to compile the host system, to generate a host system image; modifies key functions in a hardware interface definition language base library on the container side and compiles them into a container system image; when any container is started, an idle slot is found from a slot allocation table, the corresponding slot identifier is allocated to the started container, and all processes in the container are controlled to run in a security domain of the idle slot; a verification hook function is registered in a hardware service manager of the host system to perform consistency verification on caller process information and slot information in a complete service name, to obtain a verification result; and the risk of out-of-bound access and privilege escalation is reduced.

The application belongs to the technical field of computer network security, and particularly relates to a Kerberos protocol weak encryption and cloud dynamic strategy combined privilege escalation method. The method comprises the following steps: using SYSTEM level permission to access a target user object in AD, modifying a preset condition conforming to a cloud privilege dynamic group membership rule to obtain a tampered target user attribute; using an Azure AD Connect synchronization service to mark the tampered target user attribute as an attribute update event, and determining that abnormal data flow conforms to normal business synchronization characteristics; constructing a ticket by using a Kerberos client library according to an NTLM hash of a target user account to obtain a fake ticket; the target user account is dynamically added to an associated global administrator role group to obtain a target user account with a global administrator session token; and the target user account is logged in to a PTA service channel by using the fake ticket to obtain Azure AD control capability.

A system and method for detecting privilege escalation on a resource deployed in a computing environment is presented. The method includes configuring the resource to deploy thereon a sensor, the sensor configured to detect events on a data link layer of the resource; receiving from the sensor a detection indicating a permission-based event of a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; detecting a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to detecting the privilege escalation event.

An automated system and method for detecting privilege escalation vulnerabilities includes: a user behavior collection module, a user behavior graph analysis module, an attack test case generation module, and an execution and reporting module. Based on user behavior from functional testing, this invention achieves comprehensive system analysis, generates user group behavior graphs, and performs pruning, subgraph partitioning, functional point common point segmentation, and critical path discovery. This results in more efficient and accurate generation of test cases for privilege escalation vulnerabilities, filtering out a large number of useless test cases, automating test case execution, and using a page similarity calculation method to remove common subtrees to determine test execution results and provide feedback on detection results, greatly improving the efficiency and accuracy of privilege escalation vulnerability detection.