71 results about "Risk vulnerability" patented technology

The invention discloses an EPSS-based vulnerability accessibility rating method, relates to the technical field of network security, and is used for solving the problem that vulnerability path analysis is not clear. According to the method, multi-modal data in threat intelligence is analyzed, a uniform vulnerability multi-dimensional feature vector is dynamically generated in combination with a feature quantization and time correction strategy, and the risk of the vulnerability in an actual scene is comprehensively analyzed in combination with network topology analysis and protection strategy evaluation and environment sensitivity score quantization; the vulnerability priority is dynamically adjusted through attack path simulation in combination with path weights and protection measures, the criticality of vulnerabilities in an attack chain is quantified, it is ensured that high-risk vulnerabilities in a critical path are processed preferentially, and a repair task optimization model under resource and time constraints is established based on the vulnerability priority and a repair dependency relationship. According to the method, the accuracy and the dynamism of vulnerability reachability rating are remarkably improved, and the efficiency of vulnerability management and the actual protection effect are improved.

The invention discloses a smart contract automatic optimization and risk early warning method and system based on an AI and a block chain, and the method comprises the steps: obtaining original data of a smart contract, and carrying out the preprocessing of the original data, and extracting a feature number; constructing a contract risk assessment model through a deep neural network and a graph convolutional network, and outputting an assessment result; constructing a risk vulnerability prediction model based on a long short-term memory network, generating a risk probability distribution result, performing dynamic matching with a historical risk database, generating a risk assessment result, and triggering a cross-chain early warning signal; transmitting the early warning signal to a contract administrator node through a block chain cross-chain relay service, and generating an intelligent optimization instruction set; and testing the optimized contract through the block chain node, and deploying the contract to a block chain network. The method has the advantages that through combination of the neural network model and the block chain technology, automatic optimization and risk early warning of the smart contract are realized, vulnerabilities are accurately identified, risks are predicted, optimization suggestions are provided, and the security and reliability of the contract are improved.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The invention relates to the technical field of vulnerability detection, in particular to a code-level security vulnerability detection method, electronic equipment and a storage medium. The method comprises the steps of obtaining a logic graph corresponding to a target code, wherein the logic graph comprises a role node, a service entity node, an operation edge and an access constraint edge; obtaining an application scene label of the target code according to the logic graph; inputting the target code into an AST resolver to obtain a syntax tree corresponding to the target code; obtaining a sensitive function library B and a suppression function library C matched with the target code according to the application scene label of the target code; and judging whether the target code has security vulnerabilities or not according to the syntax trees corresponding to the B, the C and the target code. According to the method, the unauthorized risk vulnerabilities in the program codes can be effectively identified.

The invention relates to the technical field of Internet of Things security, in particular to an Internet of Things vulnerability data restoration system, which is used for solving the problems that in the prior art, multi-dimensional vulnerability features cannot be accurately extracted and propagated, potential vulnerabilities cannot be efficiently identified, high-risk vulnerabilities cannot be preferentially processed according to a dynamic resource adjustment strategy, and the vulnerability data restoration efficiency cannot be improved. And the accuracy, the automation level and the response efficiency of vulnerability management are reduced. According to the method, a heterogeneous relation graph between equipment and components is constructed through the vulnerability identification and positioning module, multi-dimensional vulnerability features are accurately extracted and propagated, efficient identification of potential vulnerabilities is realized, priority ranking is performed in combination with CVSS scores and equipment importance, high-risk vulnerabilities are preferentially processed through scientific scores and a dynamic resource adjustment strategy, and the efficiency of vulnerability identification is improved. And the to-be-fixed vulnerability list containing multi-aspect information is generated, so that the vulnerability management accuracy, the automation level and the response efficiency are remarkably improved.

The invention belongs to the field of network security, and relates to a method and a device for constructing a network security operating system, electronic equipment and a storage medium, and the method comprises the following steps: constructing an autonomously controllable improved microkernel infrastructure; based on the microkernel infrastructure, constructing a full-stack layered security control computing architecture base; constructing intelligent agent components, and deploying a multi-intelligent agent collaborative protection component system; integrating trusted computing and an integrity measurement verification system; performing dynamic adaptation and execution of multiple security policies; and a standardized safety evaluation and adaptive optimization closed loop is established. A trusted computing base is cut from a design source, so that the probability of occurrence of high-risk vulnerabilities is reduced; the real-time defense that the threat is changed and the strategy is changed is realized, and the blind area of the static strategy in resisting the unknown threat is made up; the malicious codes can be blocked before running, and the post passive situation that traditional security software only depends on a feature library for searching and killing is broken; and the contradiction between security capability solidification and threat dynamic evolution is fundamentally solved.

The invention discloses an enterprise-level three-party dependency package security management and control system and method, and relates to the technical field of software supply chain security, and the enterprise-level three-party dependency package security management and control system comprises the following modules: a timed task scheduling module, an external network package pre-scanning module, a private service package monitoring module, a dependency graph construction module, a product management and control module and a notification display module. By establishing an external network packet pre-scanning mechanism, security scanning is performed and a blocking list is generated before a dependent packet enters an enterprise private server, and introduction of a packet containing high-risk vulnerabilities is blocked from the source; meanwhile, through the continuous monitoring of the private server package and the construction of the dependency relationship graph, the vulnerability discovery and the accurate positioning of the influence range of the stored dependency package are realized; and finally, performing hierarchical management and control on the affected products based on vulnerability levels, and realizing timely transmission and situation visualization of risk information through a notification display module. According to the invention, full-life-cycle safety protection from an external network source to internal products of an enterprise is realized, and the safety management level and risk response efficiency of the dependent package of the enterprise are effectively improved.

The invention relates to the technical field of code auditing, and discloses a code auditing method and system, and the method comprises the steps: based on code data uploaded by a user, analyzing an initial risk point fixed point, carrying out the operation simulation based on an initial risk positioning point, generating simulation execution path data, carrying out the potential path risk simulation, obtaining an extended risk point set, and carrying out the code auditing. Performing verification during actual operation on the extended risk point set, generating a dynamic verification result, performing cross comparison on the result and the initial risk positioning point set, generating a verified risk vulnerability list, performing vulnerability association analysis in combination with service logic and data flow context, generating associated vulnerability data, and performing code repair. According to the code auditing method and the code auditing device, the code auditing efficiency and the code auditing accuracy can be improved.

The invention relates to a vulnerability scanning and processing method and device, electronic equipment and a storage medium, and the vulnerability scanning and processing method comprises the steps: creating a scanning task through an OpenVAS client, carrying out the vulnerability scanning detection of a target through an NASL plug-in after a server receives a scanning request, and returning a scanning result to the client; and if the medium and high risk vulnerabilities exist, assigning a work order to carry out vulnerability repair and labeling, accurately notifying matched assets, and then querying a vulnerability state until no to-be-repaired vulnerability exists. According to the method and the device, the potential vulnerabilities of the assets can be comprehensively and accurately found and the security risk can be effectively coped by utilizing the vulnerability scanning tool and depending on the high-quality vulnerability library and the vulnerability scanning plug-in, so that network security protection personnel can know and master the vulnerabilities of the assets in advance, the attack of hackers can be effectively prevented, and the security of the network assets is guaranteed.

The invention relates to a medical and health big model-oriented security evaluation method, which comprises the following steps of: obtaining security information related to a medical and health big model, and identifying potential security risk vulnerability types; dividing potential security risk vulnerability types into common dimension data and Prompt dimension data according to a security assessment target; constructing a data set according to a division result; using the constructed data set and through the reference model, carrying out security evaluation for the medical and health large model; an evaluation result of safety evaluation is analyzed, the severity and influence of the evaluation result are evaluated, and improvement suggestions are put forward; and monitoring the medical and health big model according to the improvement suggestion, updating the prompt data set, and re-evaluating the medical and health big model. The method is reasonable in design, the prompt dimension is used for more comprehensive evaluation, the data richness is improved, the data set coverage range is wide, the evaluation credibility is enhanced, the model is used for evaluation, the subjective prejudice of manual evaluation is reduced, and the objectivity is enhanced.

The invention discloses a large model security vulnerability detection method based on multi-agent reinforcement learning, and relates to the technical field of artificial intelligence security. The detection method comprises the following steps: constructing an initial cue word set, a cue word generation agent and a cue word discrimination agent; selecting an initial cue word, inputting the initial cue word into a cue word generation agent, and inputting a generated new cue word into a target large model to obtain first model output; forming the new cue word and the first model output into a key value pair input cue word discrimination agent, obtaining a comprehensive score of the new cue word, and adding the new cue word to the initial cue word set; repeatedly updating the initial cue word set, obtaining an optimized cue word set, inputting the optimized cue word set into the target large model, and obtaining a second model output; and performing sensitive information identification on the output of the second model, and judging security vulnerabilities of the target large model. According to the detection method, potential security risk vulnerabilities of the large model can be effectively found, and the security of the target large model can be improved.

The invention relates to the technical field of code vulnerability detection, in particular to a software source code vulnerability detection method, device and system, and the method comprises the steps: obtaining an abstract syntax tree of a source code stream, and calculating the syntax depth of each statement in a source code; determining the data flow importance of each statement based on the connection condition of the corresponding edge of each statement in the data flow diagram of the statement in the source code; determining a correlation score of each statement; matching and identifying a high-risk statement in the source code, and determining a local window scale of the high-risk statement; for source codes in the local window of the high-risk statement, determining the attention weight of each token to obtain a context condensation vector of the local window, and screening from all the tokens of the local window to obtain a priority position list; and calculating a self-adaptive threshold value of the local window so as to judge the vulnerability probability of the code snippets in the local window, and performing sandbox verification on the high-risk vulnerability by utilizing the priority position list. Therefore, the source code vulnerability detection accuracy is improved.

The invention discloses a project risk management method and system, equipment and a storage medium. The method comprises the steps of generating a plurality of project risk assessment units in a target management project based on project data of a plurality of process links; taking each project risk assessment unit as a basic unit, performing project risk assessment in the project risk management model, and calculating corresponding project risk data; calculating corresponding risk vulnerability data in the project risk management model by taking each project risk assessment unit as a basic unit; the project risk risk data and the risk vulnerability data of each project risk assessment unit and the current project progress of the process link are based on the project risk risk data and the risk vulnerability data of each project risk assessment unit; obtaining an overall risk assessment result of the target management project; generating a project risk coping strategy according to the overall risk assessment result; the project risk coping strategy is adjusted and optimized based on the obtained risk assessment result updating instruction; according to the invention, the management effect of project risk management is improved.

The invention is applicable to the technical field of network security, and relates to an intranet traffic interception method, a medium and a terminal, which can be used for intercepting and capturing an intranet traffic without depending on high-risk vulnerabilities of an attacked device, an intranet switch and an intranet router system or application and a third-party professional traffic monitoring system on the premise of remote non-physical contact with the attacked device. An attacker only needs to access the intranet based on the TCP / IP underlying network combination attack concept, the purpose of intercepting and capturing the flow of the attacked equipment can be achieved, the conditions for initiating attacks to the intranet are greatly reduced, the attack purpose of intercepting and monitoring the flow of the intranet based on the black box current situation can be truly achieved, and the method is wide in application range, wide in attack object coverage and high in practicability. In addition, the method has concealment, after the attack is successful, the existing service operation of the attacked equipment is not influenced, the flow of the attacked equipment is normally transmitted and received, and meanwhile, the attacked equipment is difficult to find that the flow of the attacked equipment is intercepted and monitored, so that the method promotes defense by attack, and better maintains the safety of a network bottom layer.

The invention belongs to the field of data security, and particularly designs a system and method for quickly detecting vulnerabilities based on traffic, and the method comprises the steps: S1, collecting fingerprint rule data, CPE dictionary data and CVE vulnerability data; s2, collecting and filtering traffic by using a switch to obtain traffic data; s3, performing asset identification on the traffic data by using the fingerprint rule data and the CPE dictionary data to obtain a corresponding CPE ID; step S4, querying corresponding vulnerabilities according to the CPE ID obtained in the step S3, and performing vulnerability grading; and S5, generating a vulnerability detection report according to the vulnerability level. By means of the design, medium-high-risk loophole hidden dangers existing in an operation system, middleware, WEB, applications and the like in IDC assets can be rapidly found in a lossless mode based on flow recognition without actively sending a detection packet.

The embodiment of the invention relates to the technical field of information processing, and discloses a vulnerability detection method, device and equipment and a storage medium, and the method comprises the steps: obtaining a preset high-risk vulnerability library in which a plurality of high-risk vulnerability numbers and at least one vulnerability triggering method corresponding to each high-risk vulnerability number are stored, high-risk vulnerabilities are security defects causing risks to engineering security operation; obtaining a method set, a code set and a first vulnerability set of the to-be-detected project; determining a second vulnerability set based on the method set, a preset high-risk vulnerability library and the first vulnerability set, wherein vulnerability numbers contained in the second vulnerability set are high-risk vulnerability numbers stored in the preset high-risk vulnerability library; and determining a target vulnerability set based on the code set and the second vulnerability set, wherein the target vulnerability set comprises vulnerability numbers corresponding to vulnerabilities needing to be repaired in the to-be-detected project. The first vulnerability set does not need to be screened manually, manpower resources are saved, and vulnerability detection efficiency and accuracy are improved.

The present application relates to the technical field of data analysis, and particularly relates to a vulnerability risk reachability analysis method, an electronic device and a storage medium, wherein the initial risk evaluation value of a vulnerability is obtained by performing vulnerability scanning analysis on target code, and the reachability analysis weight is determined in combination with the path reachability analysis value and the conditional reachability analysis value, and finally the target risk evaluation is obtained, the actual possibility of the vulnerability being exploited is fully considered, compared with the traditional risk assessment based on inherent harm only, the real risk degree of the vulnerability can be more accurately reflected, a more reliable basis is provided for security decision, the target risk evaluation value can provide a reference for resource allocation, high-risk vulnerabilities can be preferentially processed in the vulnerability repair process, blind repair of vulnerabilities is avoided, and the efficiency of vulnerability management is greatly improved.

The invention discloses a multi-source data fused power system network security threat analysis and early warning method, system, device and medium, and belongs to the technical field of power system network security, and the method comprises the steps: collecting network security data and network vulnerability data through a network database of a power dispatching center, and carrying out the preprocessing; calling network security data, performing analysis and calculation to obtain a network security index, triggering an alarm when the network security is threatened, and performing analysis and monitoring on network vulnerabilities; calling the network vulnerability data, performing analysis and calculation to obtain a restoration priority index of the network vulnerabilities, and dividing the vulnerabilities into high-risk vulnerabilities and common vulnerabilities according to the restoration priority index; and obtaining a repair priority index of the high-risk vulnerability, generating a priority repair work order according to the repair priority index of the high-risk vulnerability, and performing priority repair on the network high-risk vulnerability according to the priority repair work order. According to the invention, under the condition of limited resources, the most serious security threat is firstly solved.

The invention discloses a vulnerability repairing method and device based on a security verification technology, equipment and a medium. The method comprises the steps of obtaining a current scanning missing report corresponding to a target vulnerability scanner, and performing low-risk vulnerability elimination operation on the current scanning missing report to obtain a current to-be-verified vulnerability; performing verification processing on the current to-be-verified vulnerability through a preset security verification technology to obtain a current first non-defensive vulnerability, and generating a current first repair work order; and through a preset vulnerability repair method, performing repair processing on the vulnerability in the current first repair work order, completing the vulnerability repair operation of the current first repair work order, and modifying the state of the current first repair work order to a completed state. The problem of tedious steps caused by the fact that a verification technology and vulnerability repair cannot be combined in the prior art is solved. The vulnerability repairing accuracy and efficiency are improved, the number and difficulty of vulnerability processing are reduced, and the time cost and task load of vulnerability repairing are reduced.

The application provides a large enterprise internal self-development information system code security evaluation method and system. The application uses code security visualization integrated management technology, distributed message queue technology, flow collection technology and vulnerability detection technology to realize security detection of enterprise internal self-development system code, high-risk vulnerability scanning, effectively solve the problem of frequent security vulnerabilities of self-development information system after online, and provide real-time reliable data support for the code security situation and information security situation of the development department at all levels for the company information management layer through the visualization integrated management technology. In addition, the application can be applied to the large enterprise internal self-development information system development team, and the information security vulnerability detection is carried out on the code side before the information system is online, so that the information security vulnerability can be found in time and effectively.

The application provides a message forwarding method and device. In the embodiment, a head node respectively issues an SRv6TE Policy source path route and a source path control probe message to other nodes on a current path, so as to trigger the other nodes on the current path to generate a source path control table. The source path control table contains routing and forwarding information that nodes on a path of an existing SRv6TE Policy do not care about before, so as to inhibit a risk vulnerability caused by the fact that the nodes on the path of the existing SRv6TE Policy do not care about the routing and forwarding information, and improve the security of an SRv6 network.

The present application provides a method, system and medium for intelligent evaluation of network patrol risk vulnerabilities, which belongs to the field of big data and network operation technology. The method includes: obtaining the patrol information and behavior log information of the subnet and extracting data, processing with the preset network risk control safety index data to obtain the risk vulnerability exceeding standard data and the operation risk exceeding standard data, and comparing with the operation risk exceeding standard distribution data to obtain the subnet group risk exceeding standard deviation index, and then correcting the operation risk exceeding standard data in combination with the environmental risk interference coefficient and the system steady-state correction coefficient to obtain the operation safety risk control deviation index, and then comparing with the security risk assessment correction threshold to evaluate the subnet risk status; thereby, based on big data, the network operation risk vulnerability situation is combined with the environmental risk interference and system stability situation to obtain the risk control deviation index to evaluate the risk exceeding standard situation of the network operation, and realize the inspection and evaluation of the network security operation status through big data.

The invention relates to the technical field of scanning verification, and discloses an electric power information system vulnerability hidden danger scanning verification system. Comprising a data set module for matching and binding power data and power equipment into a data set, an active scanning module for actively scanning suspicious vulnerabilities of the data set, an intrusion verification module for performing intrusion verification on the suspicious vulnerabilities and verifying risk vulnerabilities, and a vulnerability assessment module for assessing vulnerability hidden danger levels of the power information system. According to the method, the hindrance encountered by loophole hidden dangers during active scanning is reduced, the phenomena of mismatching of verification conditions and inaccurate verification results caused by sharing one verification environment are avoided, and the risk hidden dangers of suspicious loopholes can be accurately verified by utilizing an intrusive verification mode; the scanning verification effect of two dimensions of active non-intrusive scanning and active intrusive verification of the loophole hidden danger is realized, and the scanning verification accuracy of the loophole hidden danger in the electric power information system is greatly improved.

The invention discloses a multi-dimensional performance evaluation honey spot deployment method based on multi-objective optimization and related equipment. The method comprises the following steps: acquiring network information of a target network, constructing an attack graph and analyzing a permeation path to obtain attack graph data; calculating a multi-dimensional deployment efficiency index according to the network information and the attack graph data; taking the multi-dimensional deployment efficiency index as an optimization target, and constructing a multi-target optimization model according to honey point information; and obtaining a Pareto optimal deployment scheme of the honey spots according to the multi-objective optimization model. According to the method, the utilization rate of defense resources can be improved, the maximum protection effectiveness of key areas, core attack paths and high-risk vulnerability nodes is realized, and the method can be widely applied to the technical field of network security.

The embodiment of the invention discloses a dependency risk version automatic forbidding method and device and a medium. The method comprises the following steps: in a project construction process, performing fingerprint analysis on each dependent component of a project integration package, and comparing the md5 fingerprint of each dependent component with a dependent risk version library to detect whether each dependent component has a vulnerability risk; if any dependent component has the vulnerability risk, forbidding the dependent component and terminating project construction, or replacing the dependent component with a security version to continue project construction; in the project starting process, each dependency component of the new process is extracted for fingerprint analysis, and the md5 fingerprint of each dependency component is compared with the dependency risk version library to detect whether each dependency component has a vulnerability risk or not; and if any dependent component has the vulnerability risk, forbidding the dependent component and terminating project operation, or replacing the dependent component with a safe version to continue operation. According to the embodiment, high-risk vulnerabilities are automatically identified and blocked.

The invention discloses a host security risk vulnerability visual management system, which relates to the technical field of network host security, and adopts the technical scheme that the host security risk vulnerability visual management system comprises a host security vulnerability management system, and the output end of the host security vulnerability management system is connected with a host security vulnerability detection system; the output end of the host security vulnerability detection system is connected with a host security vulnerability risk monitoring and analysis system, the output end of the host security vulnerability risk monitoring and analysis system is connected with a host dangerous vulnerability alarm system, and the output end of the host dangerous vulnerability alarm system is connected with a security vulnerability intrusion protection system. The output end of the security vulnerability intrusion protection system is connected with a security vulnerability patch repair system, and the output end of the security vulnerability patch repair system is connected with a security vulnerability disposal system. And after retest is completed, the host can be retested, so that vulnerability residues are prevented.

The invention discloses a reverse restoration method and device for a confusion program, a medium and a product, and relates to the technical field of anti-confusion and financial science and tech, and the method comprises the steps: obtaining a target confusion program, sequentially detecting and restoring Boolean value operation, a confusion character string array, a confusion attribute name and indirect function confusion call existing in the target confusion program. Obtaining a first reverse reduction program; detecting redundant codes in the first reverse reduction program through static analysis and dynamic analysis, and removing the detected redundant codes in the first reverse reduction program to obtain a second reverse reduction program; and performing control flow flattening reverse restoration processing on the second reverse restoration program to obtain a target reverse restoration program corresponding to the target obfuscation program, and restoring the original execution path of the code, thereby solving the problem of vulnerability concealment caused by code obfuscation, enhancing the high-risk vulnerability detection rate and the attack surface coverage capability, and improving the security of the high-risk vulnerability. And the reliability and the effectiveness of depth reversal of the target confusion program are improved.

The invention discloses a cloud platform threat diagnosis control method and device, equipment, a storage medium and a computer program product, and relates to the technical field of network security. The cloud platform threat diagnosis control method comprises the following steps: acquiring terminal information including in-cloud firewall data and physical firewall data, and acquiring network information including in-cloud mirror image traffic and out-of-cloud mirror image traffic at the same time; performing threat comparison on the terminal information and the network information to obtain cloud platform risk vulnerability information; and generating a virtual patch according to the cloud platform risk vulnerability information, and performing vulnerability protection according to the virtual patch. Threat analysis and positioning are carried out by combining the discovery capabilities of the terminal and the network side for vulnerability information, closed-loop processing can be carried out on a host with a security threat condition by independently utilizing a virtual patch technology, and the reliability and flexibility of cloud platform threat discovery and blocking are improved.

The invention relates to the technical field of vulnerability detection, in particular to a video monitoring vulnerability detection method and device based on a knowledge graph and a medium, and the method comprises the steps: constructing a vulnerability knowledge graph according to vulnerability information corresponding to a preset monitoring device operation log, and updating a target weight matrix of a local graph neural network model of preset monitoring equipment based on a model weight matrix issued by a given cloud server, inputting the vulnerability knowledge graph into the updated graph neural network model, outputting a vulnerability anomaly score corresponding to the running log, and if the vulnerability anomaly score is greater than a preset score threshold, determining that the running log is abnormal. Determining that the corresponding preset monitoring equipment has a video monitoring vulnerability abnormity, and switching local standby monitoring equipment of the preset monitoring equipment at the same time; according to the method, the local model is lighter, meanwhile, the vulnerability detection accuracy of the local model is improved, and high-risk vulnerabilities can be found in time.

The invention relates to a high-risk vulnerability rapid judgment method based on reverse slicing, and belongs to the technical field of software development. According to the method, forward stain analysis and reverse data flow analysis are combined, rapid judgment is carried out on the memory destruction type security defects, the efficiency and accuracy of vulnerability analysis are improved, the judgment problem of the memory destruction type security defects in a complex software system is effectively solved, and the method has important theoretical significance and application value.