527 results about "Security alarm" patented technology

Automatically investigating security incidents and generating security incident reports using a Large Language Model (LLM). A computerized system receives an incoming Security Alert Message pertaining to a possible security-related incident. The system automatically feeds into the LLM at least: the content of the Security Alert Message; the metadata of the Security Alert Message; context information describing a security domain; and organization context information pertaining to users and machines of that organization. The system automatically prompts the LLM to automatically investigate the Security Alert Message and to automatically generate a detailed Incident Report pertaining to the Security Alert Message.

Methods, systems, and computer storage media for providing security posture management using an artificial intelligence security engine in a security management system. Security posture management supports security management of a computing environment based on contextual information associated with artificial-intelligence-supported applications. The security management system provides an artificial intelligence security graph associated with the artificial-intelligence-supported applications. The artificial intelligence engine uses the artificial intelligence security graph to correlate artificial intelligence attack monitoring data with operational data of the artificial-intelligence-supported applications. In operation, artificial intelligence attack monitoring data is accessed. An artificial intelligence security graph associated with a plurality of artificial-intelligence-supported applications is accessed. Based on the artificial intelligence attack monitoring data and the artificial intelligence security graph, operational data of an artificial-intelligence-supported application is accessed. The artificial intelligence attack monitoring data and the operational data are analyzed to identify an artificial intelligence security alert. The artificial intelligence security alert is communicated.

The invention belongs to the technical field of tunnel construction monitoring, and provides a tunnel construction deformation monitoring system based on machine vision and a monitoring method thereof in order to solve the problem that in the prior art, machine vision equipment applied to tunnel deformation monitoring is insufficient in device protection and monitoring safety. The tunnel construction deformation monitoring system comprises a machine vision laying camera, a machine vision monitoring camera, a monitoring target, a data processing platform, a safety alarm, a protection device and a power supply device, through the design of the protection device, damage to the cameras caused by dust and moisture in a tunnel is avoided, and the influence of vibration interference on image acquisition is reduced; meanwhile, due to the design of the safety alarm, when the tunnel deforms, field staff can immediately know the abnormal section and the abnormal position and take supporting measures in time, and potential safety hazards are greatly reduced.

The invention relates to a network data leakage monitoring system and method, and the system comprises a data collection module, a data preprocessing module, an anomaly detection module, a risk assessment module and an alarm module. The data acquisition module is used for acquiring network data from a network data source in real time; the data preprocessing module is used for cleaning and standardizing the acquired network data to obtain preprocessed network data; the anomaly detection module identifies an anomaly mode and calculates a confidence score according to the preprocessed network data by using a pre-trained neural network model; the risk assessment module assesses the potential data leakage risk in real time based on the type of the abnormal mode and the confidence score, and generates a comprehensive risk assessment result; and the alarm module generates and sends alarm information when the comprehensive risk assessment result exceeds a preset threshold value. The system can accurately detect and evaluate the network data leakage risk in real time, and provides effective security alarm.

The invention discloses an alarm research and judgment processing method and device based on a security big model, and computer equipment, and the method comprises the steps: collecting a security alarm event through collection assemblies disposed at all asset sides, and obtaining alarm information; filling an alarm analysis template based on the alarm information to obtain an alarm analysis cue word, the alarm analysis template including identity description information, instruction description information and disposal decision tree sample information of the security big model, and the instruction description information being used for guiding the security big model to output an alarm information disposal decision tree based on a thinking chain; inputting the alarm analysis cue word into a security big model, so as to generate an alarm information processing decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the processing decision tree sample information through the security big model; and performing response processing on the alarm information based on the alarm information processing decision tree so as to realize processing of the security alarm event.

The invention discloses a multi-source heterogeneous network security alarm aggregation noise reduction method, system and device. The method comprises the following steps: step 1, constructing a network security alarm ontology model; step 2, standardization processing of multi-source alarm; 3, performing dynamic alarm aggregation based on an entity relationship; 4, multi-level alarm noise reduction and intelligent study and judgment are carried out; according to the method, deep standardization is carried out on multi-source heterogeneous alarms through the network security alarm ontology model, and a data semantic gap is eliminated; a dynamic aggregation strategy based on a core entity and a relationship is adopted, related alarms surrounding the same core entity in a specific time window are aggregated into aggregated alarms, the order of magnitude of the number of the alarms is reduced, and a complete attack scene description is formed; a three-layer progressive noise reduction mechanism is adopted, false alarms and low-value alarms are eliminated, and high credibility of output safety events is guaranteed; automatic conversion from massive original alarms to a small number of high-value security events is realized, and the security operation response speed and decision quality are improved.

The invention relates to an edge data processing method of an information security monitoring and early warning AI platform and a related device. The method comprises the following steps: carrying out standardization processing on original security alarm data collected by a plurality of edge computing devices to obtain standardized feature data; constructing a target function comprising a processing efficiency item and a resource consumption item based on the standardized feature data, and decoupling the target function into a plurality of sub-optimization problems of edge computing nodes by using a Lagrange multiplier to obtain an initial task allocation scheme; performing local linearization processing and convex optimization decomposition on the initial task allocation scheme to obtain an optimal task decomposition scheme; constructing a state transition probability matrix according to the optimal task decomposition scheme, and generating a dynamic task scheduling strategy; and distributing the dynamic task scheduling strategy to each edge computing node, and performing time sequence analysis and spatial clustering on multi-source data to obtain a security situation assessment result. According to the invention, the utilization efficiency of edge computing resources is improved.

Automated multi-phase investigation of security incident alerts using a Large Language Model (LLM) with converging dialogue. A computerized system receives a Security Alert Message pertaining to a possible security-related incident pertaining to an organization. The system automatically evaluates whether the Security Alert Message is either (I) a False Positive security alert message or (II) a True Positive security alert message, by performing an iterative multi-phase converging process in which the LLM evaluates at least: (i) the content of that Security Alert Message, and (ii) the meta-data of that Security Alert Message, and (iii) organizational context that is related to that Security Alert Message. An iterative process is performed by the LLM, which utilizes an Agent Module to fetch additional context information from organizational sources. The LLM re-updates the Risk Score and re-evaluates the Risk Score until convergence to a decision.

The invention relates to the technical field of security alarm, in particular to a home security integrated system and method based on artificial intelligence, and the system comprises a multi-source data collection module which collects environment data through an infrared sensor, a thermal imaging camera and a standard video camera, carries out the data fusion, and generates an environment data fusion result. According to the invention, the acquisition module fuses infrared, thermal imaging and video cameras, so that the monitoring coverage is expanded, the capability of capturing environmental details is enhanced, and the detection rate of abnormal behaviors is improved. Standardized monitoring data is generated through data fusion and format unified processing, high-quality input is provided for feature extraction and behavior analysis, data streams are optimized, and information loss is reduced. A pre-trained deep learning model is applied to an intelligent analysis module, recognition of complex behavior modes is enhanced, and the accuracy and timeliness of anomaly detection are improved.

The invention is suitable for the technical field of network congestion control, and provides a power system RDMA network dynamic congestion control method based on a DCQCN, and the method comprises the steps: collecting the multi-source state data of a power system in real time; inputting the multi-source state data into a preset electric power feature fusion model, and generating a dynamic ECN parameter group containing an ECN marking threshold value, a marking probability and a rate regulation factor; executing dynamic ECN marking on the data packet based on the dynamic ECN parameter group, and embedding a lightweight HMAC signature based on an electric power PKI system into the electric power service message with the highest priority; when a congestion event is detected, discarding a data packet which does not pass the HMAC verification, generating a security alarm log, and migrating congestion link flow to a standby loop according to a service priority weight based on a power double-loop network topology structure; and issuing the congestion decision result to a physical equipment control layer through the electric power SDN controller. According to the invention, while the service quality of the key business is guaranteed, collaborative optimization of the communication network and the power physical system is realized.

The present application relates to a method and apparatus for generating a cyber kill chain, and an electronic device. The method comprises: generating multi-source logs and security alarm logs on the basis of network traffic and terminal behaviors; performing aggregation processing on the security alarm logs to obtain aggregated security alarm logs, and associating the aggregated security alarm logs with the multi-source logs to obtain a user behavior sequence; inputting the user behavior sequence into a pre-trained detection model to detect, on the basis of the detection model, whether there is attack traffic in the user behavior sequence; and when there is attack traffic in the user behavior sequence, inputting the user behavior sequence into a pre-trained generation model to generate, on the basis of the generation model, a cyber kill chain corresponding to the attack traffic. By means of the method, the recognition efficiency and accuracy of detecting the attack traffic can be improved, and the cyber kill chain corresponding to the attack traffic can be accurately restored, so that the cybersecurity personnel can comprehensively assess and promptly deal with cybersecurity threats.

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.

The invention discloses an electric power AI security detection model optimization method and system fusing attribution quantification and adversarial correction. The optimization method comprises the following steps: step 1, carrying out structured semantic representation on heterogeneous security alarms of an electric power network; 2, performing model decision logic analysis based on hybrid attribution quantization; step 3, automatically diagnosing decision prejudice based on domain knowledge masks; step 4, constructing an adversarial sample generated based on an anti-fact text; and 5, performing closed-loop fine adjustment and optimization on the attribution regularization model. According to the method, the interpretable ability of large model decision analysis, the root cause positioning ability of misinformation and the autonomous repair optimization ability are improved, the transparency and credibility of model decision are improved, the model misinformation caused by environmental influence is reduced, and the efficiency of model autonomous correction is improved.

The invention discloses an intelligent security alarm system and method based on wireless networking, and relates to the technical field of Internet of Things and intelligent security, and the system comprises a security data collection module, a security feature extraction module, a security anomaly detection module, a security alarm module and an intelligent security management module. The security and protection data acquisition module acquires human body infrared, environmental sound and three-dimensional vibration data, extracts security and protection characteristics, detects movement and sound abnormity, constructs an alarm model, carries out graded alarm, issues information through a wireless technology, and displays regional security and protection event distribution through a thermodynamic diagram. According to the invention, wireless acquisition and intelligent fusion of multi-modal security data are realized, the accuracy and real-time performance of anomaly detection are significantly improved, security event distribution is visually reflected through hierarchical alarm and thermodynamic diagram display, rapid response and decision are facilitated, the false alarm rate is reduced, system deployment and maintenance are simplified, and the system reliability is improved. And the intelligence and practicability of the security and protection system are enhanced.

Some embodiments bridge a gap between focusing on security alerts raised by conditions and events that have already occurred, and focusing on vulnerabilities that might be exploited in the future. Alerts are organized into alert categories, vulnerabilities are organized into vulnerability categories, and are optionally supplemented with misconfiguration categories. Correlations are identified between alert categories and vulnerability or misconfiguration categories, and the correlation values noted, to produce category association rules. The alerts, vulnerabilities, and other security findings are gathered in some situations from multiple similar environments, and in some cases are filtered to pertain to similar resources or similar configurations. The category association rules are utilized to perform cybersecurity prioritizations such as assigning priority levels to alerts and assigning likelihood levels to potential breaches. Graphs showing resources and data flow paths are annotated with risk scores or with security findings relevant to the applicable category association rules.

The invention provides a building security alarm system based on the Internet of Things. The building security alarm system based on the Internet of Things comprises a sensor module used for collecting safety related data including environmental parameters and safety events in a building, an edge calculation unit connected with the sensor module and used for analyzing and processing the collected data in real time by adopting a preset quick response algorithm model, and a communication module connected with the edge calculation unit and used for sending the data to the communication module. And the alarm module is used for transmitting analysis results and alarm information to the central control platform and related personnel terminals. According to the building security alarm system based on the Internet of Things, the Internet of Things and an edge computing technology are introduced into the building security alarm system, and a preset quick response algorithm model is adopted, so that real-time analysis and processing of safety related data are realized; mathematical formulas of data fusion, anomaly detection, alarm judgment, response time optimization and the like are utilized, so that the data processing flow is simplified, and the system complexity is reduced.

The invention discloses a safety alarm false alarm identification method based on deep learning and text analysis. The method comprises the following steps: 1) a data acquisition and processing stage; 2) detecting a network attack event by using a recurrent neural network (RNN) through extracting multi-dimensional features of a log; 3) detecting the false alarm of the network security event based on the text analysis of Word2Vec and Transformer; according to the method, through feature extraction and RNN model design, especially by adopting an LSTM unit to process time dependence, the identification capability of the model on the security event is improved, the method does not depend on traditional signature-based detection, and the dependence on misinformation is reduced; according to the method, the semantic information in the alarm content is deeply mined in combination with a text analysis technology based on Word2Vec and Transform, the accuracy of false alarm recognition is remarkably improved, an abnormal result is fed back to operation and maintenance personnel, and a more efficient and accurate network security protection solution is provided.

The invention relates to a cross-network collaborative security alarm noise reduction method based on security federal learning, and belongs to the field of network security. Comprising the steps that a server prepares and distributes a large model injected with personalized and global parameter modules; the client performs fine adjustment based on local alarm data and only uploads gradient update of the global parameter module; the server dynamically divides a network layer into a low-conflict layer and a high-conflict layer by calculating the gradient conflict degree of each client on each network layer of the global module; the server only aggregates the low-conflict layers to update the global model and distributes the update back to the client, while the client retains its locally trained low-conflict layer. To-be-detected alarms are input into the client large model to be analyzed and processed, and accurate alarms and disposal suggestions are fed back to the data set for continuous optimization after the result is audited by experts. According to the method, client drift is relieved, and the noise reduction accuracy and individuation effect of the model on heterogeneous data are remarkably improved while data privacy is protected.

A vehicle safety alert system designed to monitor the interior of a vehicle and alert users about the presence of unattended individuals or pets, such as children or the elderly, left behind inside the vehicle is disclosed. The system includes a smart alert device which can be in a variety of portable forms including stuffed toys and is equipped with a plurality of sensors including an ignition sensor, a motion sensor, a temperature sensor, a sound sensor, and a camera to capture comprehensive visual data of the vehicle's interior. The device utilizes a processor to analyze sensor data and determine the presence of unattended individuals or pets, sending alerts to a user device through a communication network. Alerts can be audio, textual, or video messages, including real-time footage. The system includes a user-friendly application to configure alert preferences and emergency contacts, enhancing the system's utility and user convenience.

The invention discloses a safety assessment alarm system and method for physical education sports, and relates to the technical field of safety alarm, the system comprises a physiological state monitoring module, a sports image acquisition module, a central processing unit and a signal alarm module, the abnormal risk of physical training of the athlete is evaluated from the angle of movement posture and track deviation, and the abnormal condition of physiological parameters of the athlete is combined, so that the training intensity of physical exercise is quantitatively monitored, the personal safety risk degree of the athlete is specifically evaluated, and a safety alarm signal is generated to give an instant alarm. Alarm judgment accuracy is guaranteed through comprehensive data analysis, the probability of misjudgment and false alarm of the system is reduced, physical education professionals are prompted to carry out timely medical safety inspection and management on athletes through safety alarm signals, and balance between improvement of athletic performance and reduction of safety risks is achieved.

The invention provides an AI artificial intelligence machine learning system and an intelligent gateway, and relates to the technical field of AI artificial intelligence control, and the system comprises a communication module which is in bidirectional connection with an air conditioning unit, a security and protection sensor array and an intelligent illumination network in a building through a plurality of Internet of Things protocols, collects equipment operation data flow in real time, and sends the data flow to a server; comprising an air conditioner compressor current waveform, a security alarm code and lighting equipment light intensity time sequence data; and the edge calculation module is used for extracting an air conditioner energy consumption characteristic value, a security alarm signal and an environment temperature and humidity data set according to the equipment operation data flow, and storing the processed structured data set to a simulation object memory area through a simulation object classification algorithm. Through cooperation of multiple modules, real-time acquisition and processing of multi-source equipment data, analysis of personnel and environment information, intelligent generation of control instructions and adaptation to various equipment through protocol conversion are realized, so that the building environment comfort, safety and energy utilization efficiency are improved, and system compatibility and emergency response capability are enhanced.

The invention provides an electric power metering system network security situation analysis method and system based on big data, and relates to the technical field of electric power system information security. According to the method, network traffic, system logs, security alarms, asset information, vulnerability records and external threat intelligence are collected, a security data lake is constructed, and security situation factors are extracted; outputting an anomaly detection result and a threat classification result by using the unsupervised anomaly detection model and the supervised threat classification model; calculating an asset security risk value and an overall security risk value by combining the vulnerability severity and the asset importance, and generating an overall security index, an attack threat level and a vulnerability level; and a time sequence prediction model is further constructed based on the network security situation indexes, and future situation prediction and security early warning are realized. According to the invention, comprehensive perception, accurate analysis and active defense of the network security situation can be realized.

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

The invention relates to the field of application security detection, and provides a mobile application security assessment and automatic detection method, which adopts a data processing technology based on artificial intelligence to carry out syntactic analysis and semantic understanding on an obtained code of a mobile application program so as to obtain a code semantic structured coding feature. Meanwhile, semantic embedding coding is carried out on a set of security vulnerability rules extracted from the security vulnerability rule base to obtain a set of security vulnerability rule semantic embedding coding features; then, a detection result is automatically obtained based on dynamic query analysis representation of a set of code semantic structured coding features and security vulnerability rule semantic embedded coding features, and a security alarm prompt is generated in response to the detection result under the condition that the confidence coefficient of security vulnerabilities in the mobile application program exceeds a preset threshold value. In this way, the accuracy and reliability of the security vulnerability detection result can be effectively improved.

The invention relates to the field of intelligent door and window alarm, in particular to a low-energy-consumption intelligent door and window safety alarm method and system based on environmental perception. The invention discloses a low-energy-consumption intelligent door and window safety alarm system based on environmental perception. The system comprises a correlation calculation module, an initial score calculation module, a monitoring alarm module and a monitoring frequency updating module. According to the method, the system energy efficiency is obviously optimized through a dual periodic scoring mechanism and a monitoring frequency dynamic adjustment strategy; establishing a basic energy consumption baseline based on an initial score generated by a user characteristic parameter, and generating a second importance score to accurately quantify a risk value of each scene in combination with deviation degree analysis and time sequence correction of short-period environment monitoring data; the dynamic regulation and control mode enables the equipment to maintain an ultra-low power consumption state in a risk-free period, and compared with a traditional fixed frequency, the monitoring scheme can significantly reduce energy consumption, and is especially suitable for long-term stable operation of a battery-powered intelligent window control device.

A security system of a building includes a processing circuit. The processing circuit is configured to detect, based on data of security equipment of the building, that a security alarm of the building is a false alarm and search, responsive to the detection of the false alarm, a database to identify a past corrective action accepted for implementation and at least one false alarm occurring after the past corrective action was accepted and before detection of the false alarm. The processing circuits is configured to generate a corrective action to reduce an occurrence of the false alarm based on a result of the search and implement the corrective action to update operation of the security equipment to reduce the occurrence of the false alarm.

The invention relates to the technical field of intelligent security and protection, and discloses an intelligent security and protection alarm method and system based on an intelligent park. The method comprises the following steps: acquiring original security and protection data by using sensing equipment arranged in a smart park; performing standardization and redundancy elimination processing on the original security and protection data, dividing safety areas of the park through a pattern recognition algorithm, calculating a load intensity index of each area, and generating a security and protection situation summary; according to the security situation summary, a heuristic search algorithm is adopted to determine alarm trigger parameter initial values including detection sensitivity and alarm intervals, and a basic alarm parameter group is generated; performing nonlinear correction on the basic alarm parameter group, and outputting an environment perception alarm parameter group; training the historical security data set by adopting a neural network model, and analyzing the interaction between the load and the threat to obtain a threat diffusion model; and comparing the threat diffusion model with the real-time security data points, performing difference measurement, reconstructing alarm trigger logic according to a measurement result, and completing autonomous regulation and control of security and protection of the smart park.

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.

The invention provides an attack link restoration method and system based on a large language model and a traditional AI model, and effectively solves the problem that attack link restoration is incomplete and inaccurate when a current attack link restoration scheme faces complex factors such as network address translation. The method comprises the following steps: acquiring an attack semantic knowledge base containing an attack context knowledge matrix, wherein the knowledge base is generated by processing an attack framework, a security log and a traceability report by a generative large model; obtaining an asset access relation graph generated by analyzing the metadata of the target network infrastructure by the large model and reasoning in combination with an attack semantic knowledge base; regularly acquiring security alarm logs in a first time window and scoring, and acquiring context logs if the security alarm logs exceed a threshold value; based on a time sequence diagram attention network model, determining the confidence degree that edges in an asset access relation graph corresponding to logs containing access pairs in the alarm logs and the context logs belong to attack links; and performing sub-graph extraction in the atlas to obtain candidate sub-graphs, and then determining a target attack link.

The invention relates to the technical field of parking safety, in particular to a safety supervision method and system for intelligent parking, and the method comprises the following steps: S1, collecting environment parameters around a charging pile and a charging vehicle in real time; s2, if it is detected that any parameter exceeds the corresponding safety threshold value, a safety alarm is given out immediately; s3, constructing a charging safety evaluation model for predicting potential safety risks in the charging process; s4, when the charging safety risk assessment result exceeds a set risk threshold value, executing safety check; s5, when a safety event of overheating, overflowing or gas leakage occurs, emergency treatment measures are executed; and S6, updating the state transition probability of the charging safety evaluation model. According to the intelligent parking system, intelligent risk assessment and emergency processing are carried out through multi-sensor real-time monitoring in combination with the Markov chain algorithm, accurate risk prediction, real-time response and continuous optimization in the charging process are achieved, and the safety and management efficiency of the intelligent parking system are remarkably improved.