190 results about "Security alarm" patented technology

The invention discloses an electric power AI security detection model optimization method and system fusing attribution quantification and adversarial correction. The optimization method comprises the following steps: step 1, carrying out structured semantic representation on heterogeneous security alarms of an electric power network; 2, performing model decision logic analysis based on hybrid attribution quantization; step 3, automatically diagnosing decision prejudice based on domain knowledge masks; step 4, constructing an adversarial sample generated based on an anti-fact text; and 5, performing closed-loop fine adjustment and optimization on the attribution regularization model. According to the method, the interpretable ability of large model decision analysis, the root cause positioning ability of misinformation and the autonomous repair optimization ability are improved, the transparency and credibility of model decision are improved, the model misinformation caused by environmental influence is reduced, and the efficiency of model autonomous correction is improved.

The invention relates to a cross-network collaborative security alarm noise reduction method based on security federal learning, and belongs to the field of network security. Comprising the steps that a server prepares and distributes a large model injected with personalized and global parameter modules; the client performs fine adjustment based on local alarm data and only uploads gradient update of the global parameter module; the server dynamically divides a network layer into a low-conflict layer and a high-conflict layer by calculating the gradient conflict degree of each client on each network layer of the global module; the server only aggregates the low-conflict layers to update the global model and distributes the update back to the client, while the client retains its locally trained low-conflict layer. To-be-detected alarms are input into the client large model to be analyzed and processed, and accurate alarms and disposal suggestions are fed back to the data set for continuous optimization after the result is audited by experts. According to the method, client drift is relieved, and the noise reduction accuracy and individuation effect of the model on heterogeneous data are remarkably improved while data privacy is protected.

The invention provides an electric power metering system network security situation analysis method and system based on big data, and relates to the technical field of electric power system information security. According to the method, network traffic, system logs, security alarms, asset information, vulnerability records and external threat intelligence are collected, a security data lake is constructed, and security situation factors are extracted; outputting an anomaly detection result and a threat classification result by using the unsupervised anomaly detection model and the supervised threat classification model; calculating an asset security risk value and an overall security risk value by combining the vulnerability severity and the asset importance, and generating an overall security index, an attack threat level and a vulnerability level; and a time sequence prediction model is further constructed based on the network security situation indexes, and future situation prediction and security early warning are realized. According to the invention, comprehensive perception, accurate analysis and active defense of the network security situation can be realized.

The invention relates to the technical field of intelligent security and protection, and discloses an intelligent security and protection alarm method and system based on an intelligent park. The method comprises the following steps: acquiring original security and protection data by using sensing equipment arranged in a smart park; performing standardization and redundancy elimination processing on the original security and protection data, dividing safety areas of the park through a pattern recognition algorithm, calculating a load intensity index of each area, and generating a security and protection situation summary; according to the security situation summary, a heuristic search algorithm is adopted to determine alarm trigger parameter initial values including detection sensitivity and alarm intervals, and a basic alarm parameter group is generated; performing nonlinear correction on the basic alarm parameter group, and outputting an environment perception alarm parameter group; training the historical security data set by adopting a neural network model, and analyzing the interaction between the load and the threat to obtain a threat diffusion model; and comparing the threat diffusion model with the real-time security data points, performing difference measurement, reconstructing alarm trigger logic according to a measurement result, and completing autonomous regulation and control of security and protection of the smart park.

The invention provides an attack link restoration method and system based on a large language model and a traditional AI model, and effectively solves the problem that attack link restoration is incomplete and inaccurate when a current attack link restoration scheme faces complex factors such as network address translation. The method comprises the following steps: acquiring an attack semantic knowledge base containing an attack context knowledge matrix, wherein the knowledge base is generated by processing an attack framework, a security log and a traceability report by a generative large model; obtaining an asset access relation graph generated by analyzing the metadata of the target network infrastructure by the large model and reasoning in combination with an attack semantic knowledge base; regularly acquiring security alarm logs in a first time window and scoring, and acquiring context logs if the security alarm logs exceed a threshold value; based on a time sequence diagram attention network model, determining the confidence degree that edges in an asset access relation graph corresponding to logs containing access pairs in the alarm logs and the context logs belong to attack links; and performing sub-graph extraction in the atlas to obtain candidate sub-graphs, and then determining a target attack link.

A time sequence post-synchronization quantum key extraction penetration test method comprises the following steps: A) under the condition of penetration test, a QKD system operates normally, and a sending end and a receiving end smoothly complete key distribution; b) the man-in-the-middle selects an initial original key exchange period to establish synchronization and correlation so as to realize clock synchronization with a receiver; c) analyzing quantum bit error rate information obtained from a public channel by a man-in-the-middle, deducing a corresponding relation between a receiver detector and each quantum state, and establishing a mapping model of the quantum states and bit values; d) determining a quantum state type responded by the receiver in each response time slot in a subsequent original key exchange period by the middleman in combination with path information obtained by other sub penetration tests; and E) the intermediary obtains a final key which is the same as the two communication parties by implementing an error correction and privacy amplification process, the quantum bit error rate between the intermediary and the sender is maintained at a relatively low level and is lower than a security threshold, and a security alarm is not triggered in a penetration test process.

A system, method, and computer-implemented method includes generating a security alert for a subscriber, executing an automated investigation protocol for the security alert, obtaining, in response to executing a first plurality of computer-executable investigation queries and a second plurality of computer-executable investigation queries, a corpus of investigation findings data indicative of whether the security alert corresponds to a security threat or a benign security alert, and displaying, using a graphical user interface, the security alert in association with the corpus of investigation findings data.

The invention relates to a security alarm noise reduction method based on rules and a large model, which belongs to the field of network security and comprises the following steps of: collecting security alarm data and security logs and preprocessing the security alarm data and the security logs; constructing a dynamic comprehensive rule knowledge base comprising a screening rule base and a plug-in knowledge base, and periodically updating the dynamic comprehensive rule knowledge base; selecting an open-source large model of the security field, using the open-source data set of the security field and historical security alarm data, and utilizing a distillation technology to finely adjust a noise reduction small model; a knowledge base driven periodic fine tuning and dynamic knowledge injection double-path coordination mechanism is adopted to improve the capability of the noise reduction small model; and finally, realizing efficient and accurate alarm noise reduction based on the screening rule base and the noise reduction small model. According to the invention, the efficiency and accuracy of security alarm noise reduction are effectively improved, and an efficient, accurate and intelligent alarm noise reduction method is provided for the field of network security.

Automated multi-phase investigation of security incident alerts using a Large Language Model (LLM) with converging dialogue. A computerized system receives a Security Alert Message pertaining to a possible security-related incident pertaining to an organization. The system automatically evaluates whether the Security Alert Message is either (I) a False Positive security alert message or (II) a True Positive security alert message, by performing an iterative multi-phase converging process in which the LLM evaluates at least: (i) the content of that Security Alert Message, and (ii) the meta-data of that Security Alert Message, and (iii) organizational context that is related to that Security Alert Message. An iterative process is performed by the LLM, which utilizes an Agent Module to fetch additional context information from organizational sources. The LLM re-updates the Risk Score and re-evaluates the Risk Score until convergence to a decision.

The disclosed techniques automatically identify cyber-security attacks and predict attack next steps. Descriptions of previously observed cyber-attack campaigns are decomposed into attack campaign steps. Real-time security incident signals are generated by cybersecurity software. Attack campaigns are identified by mapping attack campaign steps to security incident signals. Custom-generated telemetry queries are executed to determine if a missing attack campaign step occurred. A machine learning model generates embeddings for attack campaign steps, security incident signals, and telemetry query responses. A security incident signal or a telemetry query response matches an attack campaign step when their embeddings are within a defined distance. A security alert may be raised when most or all of the attack campaign steps of a particular attack campaign are matched. Attack campaign steps that are not matched to security incident signals or telemetry query results are predicted as attack next steps.

The invention belongs to the technical field of security supervision, and particularly relates to a remote security alarm system combining video monitoring and intrusion detection identification technology, which comprises a multispectral dynamic frame acquisition module, a hierarchical feature enhancement fusion module, a space-time correlation intrusion behavior identification module, an intrusion risk quantitative evaluation module and a security supervision end. Monitoring data acquisition is performed through a multispectral dynamic frame acquisition module, a fusion feature map is generated through a layered feature enhancement fusion module to improve the feature identification degree of an intrusion target, intrusion identification fine judgment is performed through time-space correlation comprehensive judgment and introduction of an environment interference coefficient, and the accuracy of effective intrusion identification is improved. A risk assessment system is constructed from three core dimensions of target threat degree, intrusion position importance and behavior intensity, so that a security supervision terminal can clearly master the risk degree of an intrusion event, the system has the capabilities of adapting to a complex environment, accurately identifying intrusion and scientifically assessing risks, and the reliability and supervision efficiency of remote security alarm are effectively improved.

A security alert meta-analysis (SAMA) system is disclosed capable of identifying causally related evidence of a cyberattack in a computing environment. In embodiments, the system builds a security data graph from security alerts generated by other security monitoring services. The security data graph links related entities (e.g. users and resources) in the computing environment and the entities to their associated security alerts. Edges in the graph are filtered based on edge weights to identify sub-graphs that represent clusters of causally related evidence probative of attacks. The evidence clusters are presented to analysts to be investigated further. In embodiments, the meta-analysis process is implemented as periodic jobs executed on a cluster of worker nodes. Advantageously, the disclosed system is able to filter through large volumes of alerts to reduce false positives, and group related alerts, possibly from different monitoring services, so that they can be investigated together.

The invention relates to a mining and protecting method and system for a multi-dimensional high-value target of a big data platform, and the method comprises the steps: collecting multi-source heterogeneous data from a plurality of platform data sources, carrying out the information extraction, and forming a fusion triple comprising entity type feature data, attribute type feature data and relation type feature data, constructing a dynamically updated platform structure map based on the fusion triad; performing asset function value evaluation, asset topology importance evaluation and attacker accessibility evaluation on each type of nodes in the platform structure map to obtain a corresponding comprehensive risk score, and identifying a high-value target set; and in response to a security alarm event, associating alarm information with the platform structure map to position an alarm node, thereby extracting a serialized context sub-graph from the platform structure map in combination with the high-value target set, performing attack intention recognition, and outputting an attack intention report. According to the method, a security protection system with perspectiveness and semantic understanding capability can be provided for a big data platform.

The invention provides a security alarm noise reduction and automatic disposal method based on an intelligent agent, and belongs to the technical field of network security. Comprising the steps of collecting and preprocessing security alarm data, and constructing a noise reduction rule base, a noise reduction knowledge base and an alarm processing knowledge base; a noise reduction small model is finely adjusted by using an open source large model, a noise reduction knowledge base and a knowledge distillation technology, and a script generation large model is finely adjusted by using an alarm disposal knowledge base based on a general reasoning large model; performing two-stage noise reduction on the safety alarm by using a noise reduction rule base and a noise reduction small model to obtain an effective alarm; generating a corresponding disposal script through the large script generation model; creating a task allocation agent and a disposal agent; and after the feasibility of the script is manually judged, the task distribution agent delivers the script to the corresponding disposal agent for execution, and the similarity and success rate of historical cases are fused to assist in judging a subsequent disposal mode. According to the invention, the efficiency and accuracy of security alarm processing are effectively improved.

The invention discloses a thermal management system fault processing method, a thermal management system fault processing device and a related product. And under the condition that the fault alarm signal is monitored, fault information corresponding to the fault alarm signal is input to the influence evaluation model. The influence evaluation model can carry out objective, automatic and standardized influence grade evaluation on a fault from three dimensions of a refrigeration / heating function of the thermal management system, acquisition of parameters of a preset type and a preset safety alarm triggering condition, and finally obtains an influence grade and executes a control strategy corresponding to the influence grade. And a closed-loop automatic process from fault monitoring to grade judgment to strategy execution is formed. And through refined grading and differentiated fault-tolerant strategies, the functions of the thermal management system can be maintained to the maximum extent on the premise of safe operation of the thermal management system so as to improve the availability of the thermal management system. And meanwhile, the method can be popularized and applied only by defining the influence of each fault on three dimensions according to requirements, has high universality and is suitable for various thermal management systems.

A system, method, and computer-implemented method includes generating a security alert for a subscriber, executing an automated investigation protocol for the security alert, obtaining, in response to executing a first plurality of computer-executable investigation queries and a second plurality of computer-executable investigation queries, a corpus of investigation findings data indicative of whether the security alert corresponds to a security threat or a benign security alert, and displaying, using a graphical user interface, the security alert in association with the corpus of investigation findings data.

The invention discloses a security alarm processing method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: carrying out the data preprocessing of multi-source heterogeneous data, and obtaining security alarm data; identifying the security alarm data through an alarm identification model, and determining an alarm type and a threat level; performing graph construction on the security alarm data through a graph database to generate a security knowledge graph; performing association analysis on the security knowledge graph to obtain attack chain information; and carrying out risk research and judgment on the attack chain information according to the alarm type and the threat level to obtain a comprehensive risk level. According to the method, the security alarm data is identified through the alarm identification model, so that the detection capability of novel attacks can be improved; and meanwhile, alarm correlation analysis is carried out in combination with the constructed security knowledge graph, and potential attack chains and complex attack behaviors are effectively identified, so that the alarm can be deeply analyzed, and the hazard degree of the alarm can be accurately judged.

A computer-implemented method of protecting a network is provided. The method receives security alert data from one or more intrusion detection systems. The security alert data comprises a plurality of security alerts relating to the network. The method generates a plurality of similarity matrices from the security alert data. Each similarity matrix is generated using a different respective similarity function and indicates a respective similarity between each of the security alerts according to that similarity function. The method generates one or more attack graphs from the plurality of similarity matrices. Each attack graph represents a respective set of security alerts, wherein a similarity between each of the security alerts in the set, according to at least one of the similarity matrices, is above a predefined threshold. The method causes one or more predetermined actions to be taken with respect to the network to mitigate a respective attack represented by each of the attack graphs.

1. Name of the product in this design: Mobile Monitoring Robot. 2. Purpose of this design: To monitor the environment by means of movement, while also having security alarm and entertainment functions. 3. The key design feature of this product is its shape. 4. The image or photograph that best illustrates the design's key points: 3D view 1.

The invention discloses a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model, and belongs to the technical field of network security. Comprising the following steps: deploying a server in a first network domain for operating a teacher model; a lightweight device is deployed in a second network domain needing to be protected and is used for operating a student model; a knowledge distillation module is established as a communication bridge between two networks. In the first network domain, training a teacher model by using the alarm data; after training is completed, the teacher model generates a knowledge data packet; the teacher model writes the generated knowledge data packet back to the knowledge distillation module and associates the knowledge data packet with the original reference alarm data; and the student model deployed in the second network domain simultaneously reads the reference alarm data and the corresponding knowledge data packet generated by the teacher model from the knowledge distillation module. According to the invention, the efficiency and accuracy of cross-network cooperative security alarm noise reduction are improved, and an efficient alarm noise reduction method is provided for the technical field of network security.

There is provided a method of determining a risk profile for a dwelling. The method includes: determining whether the dwelling is being monitored, the type and extent of dwelling sensors within the dwelling, and the extent to which a security alarm system of the dwelling is activated; adjusting the risk profile in response to said determining; sending the risk profile so adjusted to an insurance provider or broker; and obtaining an insurance quote based on the same. There is also provided a security alarm assembly including dwelling sensors, a security alarm system in communication with the dwelling sensors, and a processor. The processor is configured to determine the number and type of said dwelling sensors, determine the extent to which the security alarm system is activated, determine whether the security alarm assembly and / or the dwelling sensors are monitored, and calculate a risk profile based on the same.

The application discloses a multi-model cooperative alarm log noise reduction and attack threat research and judgment method, and the specific process is as follows: firstly, the data preprocessing is carried out on the multi-source heterogeneous security alarm log, then the two-stage reasoning is carried out by using the cascade classification model based on the light gradient boosting machine, and the attack state is identified; for the high-priority alarm screened out, the context-containing prompt word is constructed, the large language model is called for deep research and judgment, and the intelligent cache mechanism based on the feature hash is introduced, so that the similar attack mode is quickly and accurately identified, and finally, the end-to-end security research and judgment report is output in combination with the automatic flow processing and breakpoint continuation mechanism. The application solves the problems of high alarm false alarm rate and low research and judgment efficiency in the current security operation.

The application provides an agent-based security alarm noise reduction and automatic disposal method, belonging to the technical field of network security. The method comprises the following steps: collecting and preprocessing security alarm data, constructing a noise reduction rule library, a noise reduction knowledge base and an alarm disposal knowledge base; using an open source large model, the noise reduction knowledge base and knowledge distillation technology to fine-tune a noise reduction small model, using the alarm disposal knowledge base to fine-tune a script generation large model based on a general reasoning large model; using the noise reduction rule library and the noise reduction small model to perform two-stage noise reduction on the security alarm to obtain effective alarms; generating corresponding disposal scripts by using the script generation large model; creating a task allocation agent and a disposal agent; after artificial judgment of the feasibility of the script, the task allocation agent delivers the script to the corresponding disposal agent for execution, and the similarity and success rate of historical cases are fused to assist in determining the subsequent disposal mode. The application effectively improves the efficiency and accuracy of security alarm processing.

The application discloses a container image security detection method and system based on self-defined features, and belongs to the technical field of container image security detection, and aims to solve the technical problem of how to conduct targeted security protection on image security in a multi-element security scene mode. The method comprises the following steps: constructing an image feature object and storing the image feature object in a database in the form of a registry, wherein the image feature object is a set of self-defined rules, and the rules are used to define detection behaviors for security evaluation of image features; for an image package pulled from an image warehouse, a scanner is used to analyze the metadata of the image to obtain an analysis result, and the analysis result is stored in a feature database; and the analysis result is evaluated based on the self-defined rules in the image feature object, and a security alarm is generated if the analysis result matches unsafe behaviors defined in the rules.

In the case of security alarms, it was difficult to distinguish between false alarms caused by user error and genuine emergencies, making it difficult for parents to appropriately assess the urgency of the situation and take initial action. [Solution] A monitoring system including a monitored terminal, a management server, and a guardian terminal. The monitored terminal determines whether the alarm sounding of the security buzzer was stopped by an intentional operation by the user, such as pushing back a pin, or whether it was stopped automatically after a predetermined time had elapsed. This determination result, the stop type information, is transmitted to the management server. Based on the stop type information, the management server generates a low-urgency notification if the alarm was stopped intentionally by the user, and a high-urgency notification if it was stopped automatically. The guardian terminal receives and displays the notification information, whose content and display style have been changed according to the urgency level. This allows the guardian to intuitively grasp the level of urgency and take appropriate action.

The application provides a bank in and out security management method and system based on video monitoring behavior analysis, relates to the technical field of video analysis, and the method comprises the steps of: deploying a polarization imaging device in a bank security monitoring area, collecting original polarization images in real time; calculating Stokes parameters, deriving linear polarization degree and polarization angle, and constructing a polarization feature map; inputting the original polarization images and the polarization feature map into a pre-trained polarization decoupling network, decomposing the images into reflection layer images and transmission layer images; extracting the transmission layer images, performing target detection, human skeleton key point extraction and time sequence behavior recognition, and generating behavior analysis results; and outputting a security alarm signal. The application solves the technical problem that the prior art mainly relies on traditional cameras and image processing algorithms for personnel identification and behavior analysis, ignores the processing of reflected light on images, and causes some areas or personnel to be missed, thereby affecting the security protection level of the bank.

Systems, apparatus and methods for automatically testing security alarm devices are disclosed according to various embodiments. In one example, a disclosed system comprises: a plurality of test chambers coupled on a frame, wherein each of the test chambers is configured to house a corresponding one of a plurality of security alarm devices to be tested; and a test computer coupled to the frame, wherein the computer has a processor and a non-transitory computer readable storage medium for automatically testing the plurality of security alarm devices at the same time using a test software, wherein each of the plurality of security alarm devices is connected to the test computer.

The application discloses a private protocol transmission security management system and method based on a one-way communication device, and relates to the technical field of network security. The method comprises the following steps: extracting the communication characteristics of a private protocol and performing normalization processing, and constructing a private protocol feature library; deploying a protocol analysis engine on the low-security side of a one-way optical shutter, performing deep detection on the out-domain data stream, identifying the private protocol, and extracting the current session protocol characteristics; matching the extracted characteristics with the feature library, and performing compliance verification and content filtering according to a security policy after successful matching; the verified data is encapsulated into a transmission format allowed to pass through the one-way optical shutter, and is sent to the high-security side through the one-way optical shutter; the received data is reorganized, and integrity and consistency verification is performed on the high-security side, and after the verification is passed, an audit log is recorded and forwarded to a target system; the protocol behavior and the session state are monitored in real time, and a security alarm is triggered and the transmission is blocked for unknown protocols or abnormal behaviors.

The application discloses a kind of based on centralized Beidou double-frequency RTK positioning algorithm tower safety monitoring method and system, the method includes the following steps: Beidou signal is demodulated and is expanded;The demodulated and expanded Beidou signal is formed with the identification information of current receiving terminal communication frame;Communication frame is identified decoding;The single-point positioning result of the data after decoding is obtained by single-point positioning solution;According to single-point positioning result, establish virtual reference station;Comprehensive mobile station observation data and reference station correction data are carried out RTK real-time positioning solution, after completing RTK real-time solution, compare the difference period of mobile station and reference station data, according to difference period, different solution quality grade is divided, and the final RTK positioning result or safety alarm is output based on solution quality grade.The application is sent to solution center by communication means unified solution, reduce the precision error caused by transmission delay, improve the efficiency and accuracy of tower safety monitoring.

This application discloses a control system and a light-emitting bracket for indicating the location of a fire extinguisher, which is linked to a security alarm. The system includes: a micro central processing unit; a wireless receiving module for wireless communication with the security alarm; a wired connection module for wired communication with the security alarm; a light sensor for sensing ambient light; a low-light module for emitting a weak light to indicate the location of the fire extinguisher in low ambient light; and a high-light module for emitting a strong light to indicate the location of the fire extinguisher during a fire. When the smoke alarm detects a fire hazard, it emits an audible alarm to alert the user. Simultaneously, the smoke alarm sends an alarm signal to the control system. Upon receiving the alarm signal, the control system emits a strong light from the high-light module, allowing the user to clearly observe the location of the fire extinguisher. When the fire hazard is low or controllable, the user can quickly retrieve the fire extinguisher and extinguish the fire.