381 results about "Security alarm" patented technology

Automatically investigating security incidents and generating security incident reports using a Large Language Model (LLM). A computerized system receives an incoming Security Alert Message pertaining to a possible security-related incident. The system automatically feeds into the LLM at least: the content of the Security Alert Message; the metadata of the Security Alert Message; context information describing a security domain; and organization context information pertaining to users and machines of that organization. The system automatically prompts the LLM to automatically investigate the Security Alert Message and to automatically generate a detailed Incident Report pertaining to the Security Alert Message.

The invention discloses a multi-source heterogeneous network security alarm aggregation noise reduction method, system and device. The method comprises the following steps: step 1, constructing a network security alarm ontology model; step 2, standardization processing of multi-source alarm; 3, performing dynamic alarm aggregation based on an entity relationship; 4, multi-level alarm noise reduction and intelligent study and judgment are carried out; according to the method, deep standardization is carried out on multi-source heterogeneous alarms through the network security alarm ontology model, and a data semantic gap is eliminated; a dynamic aggregation strategy based on a core entity and a relationship is adopted, related alarms surrounding the same core entity in a specific time window are aggregated into aggregated alarms, the order of magnitude of the number of the alarms is reduced, and a complete attack scene description is formed; a three-layer progressive noise reduction mechanism is adopted, false alarms and low-value alarms are eliminated, and high credibility of output safety events is guaranteed; automatic conversion from massive original alarms to a small number of high-value security events is realized, and the security operation response speed and decision quality are improved.

Automated multi-phase investigation of security incident alerts using a Large Language Model (LLM) with converging dialogue. A computerized system receives a Security Alert Message pertaining to a possible security-related incident pertaining to an organization. The system automatically evaluates whether the Security Alert Message is either (I) a False Positive security alert message or (II) a True Positive security alert message, by performing an iterative multi-phase converging process in which the LLM evaluates at least: (i) the content of that Security Alert Message, and (ii) the meta-data of that Security Alert Message, and (iii) organizational context that is related to that Security Alert Message. An iterative process is performed by the LLM, which utilizes an Agent Module to fetch additional context information from organizational sources. The LLM re-updates the Risk Score and re-evaluates the Risk Score until convergence to a decision.

The invention relates to the technical field of security alarm, in particular to a home security integrated system and method based on artificial intelligence, and the system comprises a multi-source data collection module which collects environment data through an infrared sensor, a thermal imaging camera and a standard video camera, carries out the data fusion, and generates an environment data fusion result. According to the invention, the acquisition module fuses infrared, thermal imaging and video cameras, so that the monitoring coverage is expanded, the capability of capturing environmental details is enhanced, and the detection rate of abnormal behaviors is improved. Standardized monitoring data is generated through data fusion and format unified processing, high-quality input is provided for feature extraction and behavior analysis, data streams are optimized, and information loss is reduced. A pre-trained deep learning model is applied to an intelligent analysis module, recognition of complex behavior modes is enhanced, and the accuracy and timeliness of anomaly detection are improved.

The invention is suitable for the technical field of network congestion control, and provides a power system RDMA network dynamic congestion control method based on a DCQCN, and the method comprises the steps: collecting the multi-source state data of a power system in real time; inputting the multi-source state data into a preset electric power feature fusion model, and generating a dynamic ECN parameter group containing an ECN marking threshold value, a marking probability and a rate regulation factor; executing dynamic ECN marking on the data packet based on the dynamic ECN parameter group, and embedding a lightweight HMAC signature based on an electric power PKI system into the electric power service message with the highest priority; when a congestion event is detected, discarding a data packet which does not pass the HMAC verification, generating a security alarm log, and migrating congestion link flow to a standby loop according to a service priority weight based on a power double-loop network topology structure; and issuing the congestion decision result to a physical equipment control layer through the electric power SDN controller. According to the invention, while the service quality of the key business is guaranteed, collaborative optimization of the communication network and the power physical system is realized.

The present application relates to a method and apparatus for generating a cyber kill chain, and an electronic device. The method comprises: generating multi-source logs and security alarm logs on the basis of network traffic and terminal behaviors; performing aggregation processing on the security alarm logs to obtain aggregated security alarm logs, and associating the aggregated security alarm logs with the multi-source logs to obtain a user behavior sequence; inputting the user behavior sequence into a pre-trained detection model to detect, on the basis of the detection model, whether there is attack traffic in the user behavior sequence; and when there is attack traffic in the user behavior sequence, inputting the user behavior sequence into a pre-trained generation model to generate, on the basis of the generation model, a cyber kill chain corresponding to the attack traffic. By means of the method, the recognition efficiency and accuracy of detecting the attack traffic can be improved, and the cyber kill chain corresponding to the attack traffic can be accurately restored, so that the cybersecurity personnel can comprehensively assess and promptly deal with cybersecurity threats.

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.

The invention discloses an electric power AI security detection model optimization method and system fusing attribution quantification and adversarial correction. The optimization method comprises the following steps: step 1, carrying out structured semantic representation on heterogeneous security alarms of an electric power network; 2, performing model decision logic analysis based on hybrid attribution quantization; step 3, automatically diagnosing decision prejudice based on domain knowledge masks; step 4, constructing an adversarial sample generated based on an anti-fact text; and 5, performing closed-loop fine adjustment and optimization on the attribution regularization model. According to the method, the interpretable ability of large model decision analysis, the root cause positioning ability of misinformation and the autonomous repair optimization ability are improved, the transparency and credibility of model decision are improved, the model misinformation caused by environmental influence is reduced, and the efficiency of model autonomous correction is improved.

The invention discloses an intelligent security alarm system and method based on wireless networking, and relates to the technical field of Internet of Things and intelligent security, and the system comprises a security data collection module, a security feature extraction module, a security anomaly detection module, a security alarm module and an intelligent security management module. The security and protection data acquisition module acquires human body infrared, environmental sound and three-dimensional vibration data, extracts security and protection characteristics, detects movement and sound abnormity, constructs an alarm model, carries out graded alarm, issues information through a wireless technology, and displays regional security and protection event distribution through a thermodynamic diagram. According to the invention, wireless acquisition and intelligent fusion of multi-modal security data are realized, the accuracy and real-time performance of anomaly detection are significantly improved, security event distribution is visually reflected through hierarchical alarm and thermodynamic diagram display, rapid response and decision are facilitated, the false alarm rate is reduced, system deployment and maintenance are simplified, and the system reliability is improved. And the intelligence and practicability of the security and protection system are enhanced.

Some embodiments bridge a gap between focusing on security alerts raised by conditions and events that have already occurred, and focusing on vulnerabilities that might be exploited in the future. Alerts are organized into alert categories, vulnerabilities are organized into vulnerability categories, and are optionally supplemented with misconfiguration categories. Correlations are identified between alert categories and vulnerability or misconfiguration categories, and the correlation values noted, to produce category association rules. The alerts, vulnerabilities, and other security findings are gathered in some situations from multiple similar environments, and in some cases are filtered to pertain to similar resources or similar configurations. The category association rules are utilized to perform cybersecurity prioritizations such as assigning priority levels to alerts and assigning likelihood levels to potential breaches. Graphs showing resources and data flow paths are annotated with risk scores or with security findings relevant to the applicable category association rules.

The invention relates to a cross-network collaborative security alarm noise reduction method based on security federal learning, and belongs to the field of network security. Comprising the steps that a server prepares and distributes a large model injected with personalized and global parameter modules; the client performs fine adjustment based on local alarm data and only uploads gradient update of the global parameter module; the server dynamically divides a network layer into a low-conflict layer and a high-conflict layer by calculating the gradient conflict degree of each client on each network layer of the global module; the server only aggregates the low-conflict layers to update the global model and distributes the update back to the client, while the client retains its locally trained low-conflict layer. To-be-detected alarms are input into the client large model to be analyzed and processed, and accurate alarms and disposal suggestions are fed back to the data set for continuous optimization after the result is audited by experts. According to the method, client drift is relieved, and the noise reduction accuracy and individuation effect of the model on heterogeneous data are remarkably improved while data privacy is protected.

The invention provides an AI artificial intelligence machine learning system and an intelligent gateway, and relates to the technical field of AI artificial intelligence control, and the system comprises a communication module which is in bidirectional connection with an air conditioning unit, a security and protection sensor array and an intelligent illumination network in a building through a plurality of Internet of Things protocols, collects equipment operation data flow in real time, and sends the data flow to a server; comprising an air conditioner compressor current waveform, a security alarm code and lighting equipment light intensity time sequence data; and the edge calculation module is used for extracting an air conditioner energy consumption characteristic value, a security alarm signal and an environment temperature and humidity data set according to the equipment operation data flow, and storing the processed structured data set to a simulation object memory area through a simulation object classification algorithm. Through cooperation of multiple modules, real-time acquisition and processing of multi-source equipment data, analysis of personnel and environment information, intelligent generation of control instructions and adaptation to various equipment through protocol conversion are realized, so that the building environment comfort, safety and energy utilization efficiency are improved, and system compatibility and emergency response capability are enhanced.

The invention provides an electric power metering system network security situation analysis method and system based on big data, and relates to the technical field of electric power system information security. According to the method, network traffic, system logs, security alarms, asset information, vulnerability records and external threat intelligence are collected, a security data lake is constructed, and security situation factors are extracted; outputting an anomaly detection result and a threat classification result by using the unsupervised anomaly detection model and the supervised threat classification model; calculating an asset security risk value and an overall security risk value by combining the vulnerability severity and the asset importance, and generating an overall security index, an attack threat level and a vulnerability level; and a time sequence prediction model is further constructed based on the network security situation indexes, and future situation prediction and security early warning are realized. According to the invention, comprehensive perception, accurate analysis and active defense of the network security situation can be realized.

The invention provides a network security alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining security logs, configuration information and asset importance levels of all security equipment in a network; performing association analysis on the configuration information, and determining attack surface data of each IP point in the network; performing noise reduction and correlation analysis on the security log to obtain processed log information, matching the processed log information with a preset feature library, and filtering alarms of normal service features and alarms of misreported attack features to obtain filtered alarm data; inputting the attack surface data, the asset importance level and the alarm data into a large language model to generate an alarm priority sequence; and executing an automatic response based on the alarm data, the alarm priority sequence and a configured response script. According to the invention, the problem of high false alarm rate of network security alarm in the prior art can be solved.

The invention relates to the field of application security detection, and provides a mobile application security assessment and automatic detection method, which adopts a data processing technology based on artificial intelligence to carry out syntactic analysis and semantic understanding on an obtained code of a mobile application program so as to obtain a code semantic structured coding feature. Meanwhile, semantic embedding coding is carried out on a set of security vulnerability rules extracted from the security vulnerability rule base to obtain a set of security vulnerability rule semantic embedding coding features; then, a detection result is automatically obtained based on dynamic query analysis representation of a set of code semantic structured coding features and security vulnerability rule semantic embedded coding features, and a security alarm prompt is generated in response to the detection result under the condition that the confidence coefficient of security vulnerabilities in the mobile application program exceeds a preset threshold value. In this way, the accuracy and reliability of the security vulnerability detection result can be effectively improved.

The invention relates to the field of intelligent door and window alarm, in particular to a low-energy-consumption intelligent door and window safety alarm method and system based on environmental perception. The invention discloses a low-energy-consumption intelligent door and window safety alarm system based on environmental perception. The system comprises a correlation calculation module, an initial score calculation module, a monitoring alarm module and a monitoring frequency updating module. According to the method, the system energy efficiency is obviously optimized through a dual periodic scoring mechanism and a monitoring frequency dynamic adjustment strategy; establishing a basic energy consumption baseline based on an initial score generated by a user characteristic parameter, and generating a second importance score to accurately quantify a risk value of each scene in combination with deviation degree analysis and time sequence correction of short-period environment monitoring data; the dynamic regulation and control mode enables the equipment to maintain an ultra-low power consumption state in a risk-free period, and compared with a traditional fixed frequency, the monitoring scheme can significantly reduce energy consumption, and is especially suitable for long-term stable operation of a battery-powered intelligent window control device.

A security system of a building includes a processing circuit. The processing circuit is configured to detect, based on data of security equipment of the building, that a security alarm of the building is a false alarm and search, responsive to the detection of the false alarm, a database to identify a past corrective action accepted for implementation and at least one false alarm occurring after the past corrective action was accepted and before detection of the false alarm. The processing circuits is configured to generate a corrective action to reduce an occurrence of the false alarm based on a result of the search and implement the corrective action to update operation of the security equipment to reduce the occurrence of the false alarm.

The invention relates to the technical field of intelligent security and protection, and discloses an intelligent security and protection alarm method and system based on an intelligent park. The method comprises the following steps: acquiring original security and protection data by using sensing equipment arranged in a smart park; performing standardization and redundancy elimination processing on the original security and protection data, dividing safety areas of the park through a pattern recognition algorithm, calculating a load intensity index of each area, and generating a security and protection situation summary; according to the security situation summary, a heuristic search algorithm is adopted to determine alarm trigger parameter initial values including detection sensitivity and alarm intervals, and a basic alarm parameter group is generated; performing nonlinear correction on the basic alarm parameter group, and outputting an environment perception alarm parameter group; training the historical security data set by adopting a neural network model, and analyzing the interaction between the load and the threat to obtain a threat diffusion model; and comparing the threat diffusion model with the real-time security data points, performing difference measurement, reconstructing alarm trigger logic according to a measurement result, and completing autonomous regulation and control of security and protection of the smart park.

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.

The invention provides an attack link restoration method and system based on a large language model and a traditional AI model, and effectively solves the problem that attack link restoration is incomplete and inaccurate when a current attack link restoration scheme faces complex factors such as network address translation. The method comprises the following steps: acquiring an attack semantic knowledge base containing an attack context knowledge matrix, wherein the knowledge base is generated by processing an attack framework, a security log and a traceability report by a generative large model; obtaining an asset access relation graph generated by analyzing the metadata of the target network infrastructure by the large model and reasoning in combination with an attack semantic knowledge base; regularly acquiring security alarm logs in a first time window and scoring, and acquiring context logs if the security alarm logs exceed a threshold value; based on a time sequence diagram attention network model, determining the confidence degree that edges in an asset access relation graph corresponding to logs containing access pairs in the alarm logs and the context logs belong to attack links; and performing sub-graph extraction in the atlas to obtain candidate sub-graphs, and then determining a target attack link.

A time sequence post-synchronization quantum key extraction penetration test method comprises the following steps: A) under the condition of penetration test, a QKD system operates normally, and a sending end and a receiving end smoothly complete key distribution; b) the man-in-the-middle selects an initial original key exchange period to establish synchronization and correlation so as to realize clock synchronization with a receiver; c) analyzing quantum bit error rate information obtained from a public channel by a man-in-the-middle, deducing a corresponding relation between a receiver detector and each quantum state, and establishing a mapping model of the quantum states and bit values; d) determining a quantum state type responded by the receiver in each response time slot in a subsequent original key exchange period by the middleman in combination with path information obtained by other sub penetration tests; and E) the intermediary obtains a final key which is the same as the two communication parties by implementing an error correction and privacy amplification process, the quantum bit error rate between the intermediary and the sender is maintained at a relatively low level and is lower than a security threshold, and a security alarm is not triggered in a penetration test process.

A system, method, and computer-implemented method includes generating a security alert for a subscriber, executing an automated investigation protocol for the security alert, obtaining, in response to executing a first plurality of computer-executable investigation queries and a second plurality of computer-executable investigation queries, a corpus of investigation findings data indicative of whether the security alert corresponds to a security threat or a benign security alert, and displaying, using a graphical user interface, the security alert in association with the corpus of investigation findings data.

The invention relates to a security alarm noise reduction method based on rules and a large model, which belongs to the field of network security and comprises the following steps of: collecting security alarm data and security logs and preprocessing the security alarm data and the security logs; constructing a dynamic comprehensive rule knowledge base comprising a screening rule base and a plug-in knowledge base, and periodically updating the dynamic comprehensive rule knowledge base; selecting an open-source large model of the security field, using the open-source data set of the security field and historical security alarm data, and utilizing a distillation technology to finely adjust a noise reduction small model; a knowledge base driven periodic fine tuning and dynamic knowledge injection double-path coordination mechanism is adopted to improve the capability of the noise reduction small model; and finally, realizing efficient and accurate alarm noise reduction based on the screening rule base and the noise reduction small model. According to the invention, the efficiency and accuracy of security alarm noise reduction are effectively improved, and an efficient, accurate and intelligent alarm noise reduction method is provided for the field of network security.

Systems and methods for facilitating electronic safety alert communications by a safety alert management system are disclosed herein. A method includes receiving an electronic safety alert for a specific safety event from a user electronic device via a safety alert application, the safety alert including at least one user message from a user associated with the user device. The method includes initiating an electronic chat session between the user and the safety agent attending the safety management application and, for at least one user message received at the safety management application, determining a reply message to send to the user device in response to the at least one user message. In embodiments, a machine learning model is used to analyze the user message and determine one or more recommended reply messages to display to the agent. A method for training a safety chat language model in a safety alert management system is also disclosed.

The invention provides an intelligent identification and automatic disposal method for intranet malicious traffic, which belongs to the technical field of network security and comprises the following steps: acquiring security alarm information by monitoring intranet traffic data; performing data cleaning on the security alarm information, and performing formatting processing according to a predefined format to obtain preprocessed alarm information; key features are extracted according to the preprocessed alarm information, vectorization processing is carried out, and vector alarm feature information is obtained; performing similarity calculation according to the vector alarm feature information and vector data information in a vector database to obtain similar vector data information; and constructing a prompt template according to the preprocessed alarm information, the similar vector data information and a constraint rule, inputting the prompt template into the large model for processing, obtaining a judgment result, executing a corresponding disposal strategy, and feeding back the judgment result and a disposal condition to safety management personnel. According to the method, intelligent identification of the safety alarm information is realized, and corresponding treatment is automatically executed according to the judgment result.

Automated multi-phase investigation of security incident alerts using a Large Language Model (LLM) with converging dialogue. A computerized system receives a Security Alert Message pertaining to a possible security-related incident pertaining to an organization. The system automatically evaluates whether the Security Alert Message is either (I) a False Positive security alert message or (II) a True Positive security alert message, by performing an iterative multi-phase converging process in which the LLM evaluates at least: (i) the content of that Security Alert Message, and (ii) the meta-data of that Security Alert Message, and (iii) organizational context that is related to that Security Alert Message. An iterative process is performed by the LLM, which utilizes an Agent Module to fetch additional context information from organizational sources. The LLM re-updates the Risk Score and re-evaluates the Risk Score until convergence to a decision.

An electronic device for artificial intelligence (AI) based resolution of security alarm events using video data is provided. The electronic device receives alarm data related to an alarm event associated with a point of access to a physical area of a premises. The electronic device transmits a video data request corresponding to the received alarm data. The electronic device receives the video data corresponding to the received alarm data. The electronic device determines a tag associated with the alarm event based on at least one of the received video data or the received alarm data. The electronic device applies an AI model on the determined one tag and the received alarm data. The electronic device determines a severity score indicating a level of authenticity of the alarm event. The electronic device controls rendering of information corresponding to the alarm event on a user interface based on the determined severity score.

The disclosed techniques automatically identify cyber-security attacks and predict attack next steps. Descriptions of previously observed cyber-attack campaigns are decomposed into attack campaign steps. Real-time security incident signals are generated by cybersecurity software. Attack campaigns are identified by mapping attack campaign steps to security incident signals. Custom-generated telemetry queries are executed to determine if a missing attack campaign step occurred. A machine learning model generates embeddings for attack campaign steps, security incident signals, and telemetry query responses. A security incident signal or a telemetry query response matches an attack campaign step when their embeddings are within a defined distance. A security alert may be raised when most or all of the attack campaign steps of a particular attack campaign are matched. Attack campaign steps that are not matched to security incident signals or telemetry query results are predicted as attack next steps.

The invention belongs to the technical field of security supervision, and particularly relates to a remote security alarm system combining video monitoring and intrusion detection identification technology, which comprises a multispectral dynamic frame acquisition module, a hierarchical feature enhancement fusion module, a space-time correlation intrusion behavior identification module, an intrusion risk quantitative evaluation module and a security supervision end. Monitoring data acquisition is performed through a multispectral dynamic frame acquisition module, a fusion feature map is generated through a layered feature enhancement fusion module to improve the feature identification degree of an intrusion target, intrusion identification fine judgment is performed through time-space correlation comprehensive judgment and introduction of an environment interference coefficient, and the accuracy of effective intrusion identification is improved. A risk assessment system is constructed from three core dimensions of target threat degree, intrusion position importance and behavior intensity, so that a security supervision terminal can clearly master the risk degree of an intrusion event, the system has the capabilities of adapting to a complex environment, accurately identifying intrusion and scientifically assessing risks, and the reliability and supervision efficiency of remote security alarm are effectively improved.

A security alert meta-analysis (SAMA) system is disclosed capable of identifying causally related evidence of a cyberattack in a computing environment. In embodiments, the system builds a security data graph from security alerts generated by other security monitoring services. The security data graph links related entities (e.g. users and resources) in the computing environment and the entities to their associated security alerts. Edges in the graph are filtered based on edge weights to identify sub-graphs that represent clusters of causally related evidence probative of attacks. The evidence clusters are presented to analysts to be investigated further. In embodiments, the meta-analysis process is implemented as periodic jobs executed on a cluster of worker nodes. Advantageously, the disclosed system is able to filter through large volumes of alerts to reduce false positives, and group related alerts, possibly from different monitoring services, so that they can be investigated together.