757 results about "Security analytics" patented technology

A system and method for securing inter-process communications (IPCs) between generative AI and external tool servers, including intercepting IPCs having a requested operation, performing a security analysis on the IPCs for security threats, performing a permission validation for permissions for the requested operation of each IPC, and either approving or blocking the requested operation of each IPC based on the security analysis and the permission validation.

Method and system for analyzing software or firmware of computing systems to assess security properties includes loading predicate device input data including characteristics about predicate devices; translating predicate device input data into predicate device model data describing characteristics or dependencies of the predicate device input data relevant to the analysis; determining digital twin configuration data used to configure digital twin; loading the digital twin configuration data onto the digital twin; storing configuration data in the memory; instructing the digital twin to configure itself to implement the loaded digital twin configuration data; determining security analysis to be carried out on the digital twin; simulating the predicate device; executing security analysis on the digital twin; generating output data describing the result of execution of the security analysis; storing output data pertaining to the result; and determining if the result satisfies a predetermined condition, and if so, executing action corresponding to the result.

The invention relates to the technical field of code security analysis, and discloses a control flow analysis and retrieval enhancement-based large model code security review method, which comprises the following steps of: analyzing an incremental code to generate an abstract syntax tree and data flow analysis information; retrieving local knowledge base association business rules and historical vulnerabilities based on grammatical features, and generating a context enhancement prompt; calling a large language model to jointly analyze codes and contexts, identifying vulnerabilities and outputting a structured report; and combining with a historical false alarm data optimization result and then integrating to a development assembly line. Multi-source information is fused through an RAG technology to enhance semantic understanding, and control flow node tracking and cross-version semantic association are combined, so that the problems of a traditional tool business logic vulnerability detection blind area, incremental code analysis failure and high false alarm rate are solved, synchronous improvement of security examination accuracy and efficiency is realized, and the method is adaptive to an agile development scene.

In some implementations, a cybersecurity threat detection and mitigation system is provided. The system refines an artificial intelligence (AI) model with a corpus of historical data that represents security events that occurred, queries that were submitted by security analysts in response to the security events, and actions that were performed for mitigating the security events. Telemetry data that corresponds to behavior and performance of a computer network is collected and provided to the AI model. Based on the telemetry data, the AI model predicts a potential security threat to the computer network and performs an assessment of risk to the computer network. When the assessment of risk to the computer network indicates that the potential security threat is an actual security threat, a security alert that corresponds to the actual security threat is triggered. Other embodiments are described and claimed.

The invention relates to the field of internet attack detection, in particular to a data security event real-time monitoring method and system, and the method comprises data collection, multi-modal fusion, threat detection, causal reasoning, dynamic response and feedback optimization. Compared with the traditional security analysis which depends on isolated data dimension or simple rule association, is difficult to capture a cross-data-source complex attack mode, and is faced with the limitations of low calculation efficiency, slow link traceability, storage access bottleneck and the like in mass data association analysis, the scheme integrates multi-source heterogeneous data into a dynamic association network through graph structure modeling, so that the security analysis efficiency is improved. Hidden association and behavior patterns among users, equipment and IPs are deeply mined by utilizing a GNN framework, the suspicious degree among entities can be accurately quantified, and hidden attack chains can be identified; and meanwhile, a hybrid storage architecture and a query optimization technology are adopted, so that a security analyst can backtrack a complex attack path in a second level while breaking through the bottleneck of large-scale graph data access performance, and the threat hunting efficiency and the high-level attack traceability are remarkably improved.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

The invention discloses a three-dimensional GIS (geographic information system) system for safety assessment of an urban gas pipeline internet of things. A gas pipe network monitoring and assessment system combining the internet of things, a mobile internet and BIM / GIS information is established. Firstly, an overall framework based on sensing, transmission, knowing and use of the internet of things is established; secondly, a front-end sensing system deployment scheme is established, a database system is built, and index data are collected and stored; thirdly, a gas leakage hazard model is constructed, and possible hazard consequences are evaluated; 4, a pipe network monitoring system application layer module is constructed, and underground space information management, safety analysis, prediction and early warning and an auxiliary decision making module are achieved; and establishing a gas pipe network risk identification module, a basic information checking module, a monitoring and explosion early warning module, a three-dimensional visualization module and an auxiliary decision-making module. The system monitors the operation condition of the gas pipe network in real time, analyzes the operation rule of the gas pipe network, evaluates the risk of the gas pipe network, predicts, early warns and decides in time, changes passive first-aid repair into active protection, and is high in monitoring stability, precision and efficiency.

The invention provides a cable safety monitoring system based on a digital twin technology. The cable safety monitoring system comprises a digital modeling module, a data acquisition module and a simulation analysis module, wherein the digital modeling module is used for acquiring cable physical data and building a digital twin model according to the acquired cable physical data; wherein the cable physical data comprises cable basic information and cable field equipment basic information; the data acquisition module is used for acquiring cable safety monitoring data and inputting the acquired cable safety monitoring data into the digital twin model; wherein the cable safety monitoring data comprises cable monitoring data and field monitoring data; and the simulation analysis module is used for performing dynamic evolution simulation according to the digital twin model to obtain dynamic evolution information of the safety monitoring data, and performing safety analysis processing on the dynamic evolution information by adopting the trained safety analysis model to obtain a cable safety analysis result. According to the invention, the reliability and the intelligent level of cable safety monitoring can be improved.

The invention relates to the technical field of mine safety analysis, and discloses a mine personnel trajectory prediction method, system and device based on artificial intelligence. The method comprises the following steps: collecting mine personnel positioning data, and performing standardization processing; calculating trajectory quality through a neural network; converting the spatio-temporal feature vector to perform image recognition; performing multi-time scale prediction by applying an activation function; matching with a mine space structure, and clustering to identify a group behavior mode; and calculating a safety index, and generating a safety scheduling strategy. According to the method, the future trajectory of the mine personnel can be accurately predicted through the special environment constraint of the mine and the working behavior mode of the miner, and the prediction result is converted into a safe scheduling strategy.

The invention provides a security event association analysis and question answering method and system and a medium, and the method comprises the following steps: context-aware query completion: receiving an original query input by a user, obtaining a historical record of a current dialogue, and forming a context enhanced query according to the original query and the historical record of the current dialogue; dynamic task identification: outputting a prediction task model according to the context enhancement query in combination with a dynamic task identification strategy; multi-dimensional retrieval: performing multi-dimensional retrieval on the prediction task model to obtain a final knowledge context packet; and knowledge-driven response generation: generating a knowledge-driven response based on the knowledge context packet, and outputting a final security analysis report after the generated content passes verification. According to the method, efficient, accurate and explainable intelligent association analysis of the multi-source heterogeneous security data is realized by constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism and realizing context-aware query completion.

The invention discloses a big language model generation content security test system and method in a black box scene. The system comprises a jailbreak prompt word library module used for storing jailbreak prompt words for performing security test on a big language model; the violation question and answer pair module is used for storing violation question and answer pairs covering different types; the response acquisition module is used for obtaining a data request packet according to query content formed by the jailbreak prompt word and the query request; the security analysis module is used for calculating the similarity between response data corresponding to the query request and an expected violation answer, taking the similarity as a security score, and inputting the security score into the adaptive optimization module; and the adaptive optimization module is used for optimizing the jailbreak prompt words output by the jailbreak prompt word bank module by using a genetic algorithm according to the security score output by the security analysis module. According to the method and the device, the security of the large language model generation content can be effectively tested.

The invention discloses a digital twin-driven bushing operation monitoring and early warning system, which relates to the technical field of digital twin bushing operation monitoring and early warning, and comprises a multi-source acquisition, transmission, analysis, early warning and interaction module, an acquisition module adopts an ad hoc network, a self-powered sensor acquires data in a multi-mode manner, and the sampling frequency is dynamically adjusted. The transmission module guarantees data transmission through LPWAN, satellite communication and quantum encryption, the analysis module builds a multi-scale coupling model to predict the state and the service life, the model can be adaptively adjusted, the early warning module determines the early warning level in combination with a fuzzy decision and a Bayesian network and gives decision suggestions, and the interaction module provides immersive experience and natural interaction based on VR / AR / MR. According to the invention, comprehensive monitoring, stable and safe data transmission, accurate analysis and prediction, scientific and reliable early warning, convenient man-machine interaction, rapid fault diagnosis, cooperation of all modules, real-time and accurate monitoring and early warning, fault reduction, service life prolonging of a sleeve, safety guarantee and benefit and competitiveness improvement are realized through multi-source acquisition.

The invention relates to the technical field of information security, in particular to an anti-quantum computing public key cryptography method and system. The method comprises the following steps: acquiring a large prime number p and constructing a multivariable polynomial ring; randomly generating a group of polynomial coefficients, generating a polynomial embedding rule public key, and generating a multivariable polynomial ring embedding public key; the method comprises the following steps: acquiring a quantum computer message, performing polynomial space mapping conversion and message public key encryption, and meanwhile, generating a quantum message public key encrypted ciphertext by introducing a polynomial perturbation term and a transcendental coding term; the quantum message public key encryption ciphertext and the corresponding polynomial ring embedded public key are transmitted to a quantum message decryption party for inversion decryption processing, and a quantum computer message decryption plaintext is generated; and performing anti-quantum computing security analysis on the encryption and decryption processes, and regenerating a multivariable polynomial ring dynamic public key. According to the method, the attack of quantum computing can be effectively resisted, so that the security of quantum information transmission is guaranteed.

A computer system comprises a plurality of endpoints at which security agents generate security alerts and a machine-learning (ML) system that receives the security alerts from the endpoints and that separates the security alerts into a plurality of clusters, wherein the ML system is configured to execute on a processor of a hardware platform to: determine that a group of first alerts of the security alerts belongs to a first cluster of the clusters; create a first representative alert from metadata of the first alerts belonging to the first cluster; and in response to a security analytics platform evaluating the first representative alert as being harmless to the computer system, store information indicating that all of the first alerts are harmless.

The invention provides a distributed power supply communication gateway resource scheduling method and system based on dual-mode communication, and relates to the technical field of carrier wireless dual-mode communication, and the system comprises a time division module, a node evaluation module, a channel real-time monitoring module, a channel strategy making module, an efficiency monitoring module and a security analysis module. According to the invention, the output of the distributed power supply is monitored in real time and the access parameters are automatically adjusted to match the power grid demand, so that the efficiency and reliability of energy management are remarkably improved, the data loss is reduced, the communication security is enhanced, the nodes of carrier wireless dual-mode communication are identified, and the time distribution of the nodes in communication is verified; according to the method, the communication network can flexibly cope with load changes, load management of the network is optimized, resource waste or congestion caused by fixed time allocation is reduced, encryption keys are dynamically updated, abnormal data modes are identified, and data safety and tamper-proof capacity are greatly improved.

The invention relates to the technical field of power systems, in particular to a method for constructing a general knowledge base in the power safety industry based on a large model. Performing data classification and sorting on the data source of the electric power safety industry to obtain classified data; constructing a plurality of agents based on the large model, and processing the classified data by using the plurality of agents to obtain structured data; and carrying out vectorization processing on the structured data to generate vector data, storing the vector data into a vector database, and constructing a universal knowledge base in the electric power safety industry. The data source comprises intrinsic safety analysis historical data, an intrinsic safety analysis report, electric power safety rules and regulations and operation specifications. The intelligent agents comprise a file analysis intelligent agent, an analysis report information extraction intelligent agent, a rule and regulation information extraction intelligent agent and an operation instruction information extraction intelligent agent. Through a multi-agent cooperative processing and vectorization storage mechanism, efficient organization and intelligent application of electric power safety knowledge are realized.

The invention relates to the field of software security, and particularly discloses a software supply chain security analysis method which comprises the following steps: S1, collecting data of components of a software supply chain, and calculating a historical security risk weight for each component in the supply chain; s2, collecting behavior data of the software during operation, and performing association analysis in combination with the supply chain data; s3, preprocessing the collected behavior data and supply chain data, and extracting key features; according to the software supply chain security analysis method, through dynamic behavior analysis, runtime threats, such as zero-day vulnerabilities and hidden backdoor threats, which cannot be detected by static analysis can be found, the coverage rate of threat detection is remarkably improved, meanwhile, historical security risk weights are introduced, historical security problems of supply chain components are quantified, and the security of the software supply chain is improved. And intelligent risk assessment and threat traceability are realized by combining a knowledge graph and a graph neural network technology.

An apparatus for detecting fraudulent activity includes a device property data processing circuit, a security analysis circuit, an alert circuit, and an alert provisioning circuit. The device property data processing circuit is structured to interpret device property data corresponding to a device registered with an Internet of Things (IoT) device registry. The security analysis circuit is structured to determine, based at least in part on the device property data, that the device is subject to a fraud event. The alert circuit is structured to generate, responsive to the determined fraud event, a message that identifies the device. The alert provisioning circuit is structured to transmit the message.

The invention discloses a network attack path prediction method and device based on ATTCK mapping and a storage medium, relates to the technical field of network security, and discloses a network attack path prediction method based on ATTCK mapping, comprising: detecting risk data of a host, mapping the risk data to a corresponding ATTCK technical entry, and generating an attack path description; constructing an ATTCK enhanced attack path graph based on the attack path description; calculating a security risk score of the host according to the risk data and asset information of the host; and determining an attack path prediction result based on the ATTCK enhanced attack path graph and the security risk score. According to the method, the risk data is mapped, so that a clear attack means is provided for security analysis, and defense is more targeted. Meanwhile, the security risk score is calculated in combination with the risk data and the asset information, so that the risk assessment is more comprehensive, and the network security defense level is effectively improved.

Disclosed is a cloud-based security system implemented using API notifications provided by a GenAI service or application. The security system provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system receives notifications of traffic including requests directed to the GenAI service from endpoints as well as the GenAI responses. The security system includes a GenAI request classifier trained to classify prompts as benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses as normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies based on both the requests and responses that may include triggering alerts to administrators, deleting data stored by the GenAI service, and the like.

The invention discloses a power sensitive data identification analysis method and system, and relates to the technical field of power data security analysis, and the method comprises the steps: collecting cross-domain data packets in real time, carrying out the preprocessing, extracting the features of the cross-domain data packets, and carrying out the preliminary screening; constructing a sensitive data identification formula to identify sensitive data in real time; a comprehensive sensitivity model is constructed to calculate the comprehensive sensitivity of the sensitive data, grading is carried out, and corresponding measures are made; and marking the high-sensitivity cross-domain data packet as an abnormal behavior and generating an abnormal behavior report. A constructed sensitive data identification formula is combined with multi-dimensional features such as data packet size, protocol type, transmission time interval and access frequency, dynamic identification of sensitive data is realized, the accuracy of data packet classification is improved, a sensitivity model is synthesized to evaluate the complexity of data packets through information entropy, and a relation between a transmission rate and a data volume is combined, so that the accuracy of data packet classification is improved. Accurate grading of sensitive data is realized.

Methods, systems, and computer storage media for providing brand-focused security administration in an item listing system are described. Using a brand-focused machine learning model, the brand-focused security administrator engine supports generating different comprehensive reports and analytics on brand-related security metrics, including brand compliance rates, infringement incidents, enforcement actions taken, and overall item listing system integrity. The brand-focused security administrator engine also supports visualizing the brand-focused security analytics results data in a manner that enhances usability and decision-making by presenting complex brand-focused security analytics results data in a clear, actionable format. In operation, brand-focused security data is accessed. The brand-focused security data is analyzed using a brand-focused machine learning model that is trained based on a multi-dimensional authenticity analysis dataset. Brand-focused security analytics results data is generated. The brand-focused security analytics results data is communicated to cause display of one or more visualizations based on the brand-focused security analytics results data.

The invention belongs to the technical field of software security, and particularly discloses a warehouse-level vulnerability detection method and device based on a large model function semantic abstract. The method comprises the following steps: generating a vulnerability detection abstract syntax tree according to a to-be-detected source code; generating an assembly prompt word according to the complete source code of the node function in the unprocessed state and the target semantic abstract, and analyzing the node function in the unprocessed state according to the assembly prompt word by calling the target large model; and determining a vulnerability detection result of the to-be-detected source code according to the initial function semantic abstract and the structured function semantic abstract. Through the above mode, the vulnerability detection abstract syntax tree is generated by using the program structure modeling strategy and the full function call graph is constructed, and then the semantic abstract of the structured function is determined by using the semantic understanding capability of the target large model, that is, deep security analysis and vulnerability mining are performed from the local function to the global context. Therefore, the accuracy and comprehensiveness of warehouse-level vulnerability detection can be effectively improved.

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user / entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies / threats were previously known. The security platform can include both real-time and batch paths / modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system / process / computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.

The invention provides a security analysis method in a software research and development process. The security analysis method can be applied to the technical field of big data and the technical field of artificial intelligence. The method comprises the following steps: embedding a security analysis plug-in in an integrated development environment; scanning codes written by a user in the integrated development environment in real time through safety rule information preset in the safety analysis plug-in and a heuristic algorithm; identifying a target security problem in response to the security analysis plug-in, marking the target security problem by using the security analysis plug-in, and providing repair suggestion information; and responding to the condition that the user modifies the code based on the repair suggestion information, and utilizing the security analysis plug-in to re-scan the modified code to verify the modification effect.

The invention discloses an air-space integrated safety monitoring method for distribution network construction based on an unmanned aerial vehicle, and the method comprises the following steps: A, constructing an air-space integrated cooperative monitoring network, and collecting the multi-source data of a distribution network construction region through the air-space integrated cooperative monitoring network; c, constructing a construction safety analysis model; the construction safety analysis model comprises a data acquisition and preprocessing module, a multi-source data fusion analysis module, a risk diagnosis and evaluation module, an intelligent prediction and early warning module, an early warning decision and disposal module and a visualization and feedback module; and D, based on the trained construction safety analysis model, collecting multi-source data by using an air-space integrated cooperative monitoring network, and carrying out online monitoring, early warning and disposal on the construction safety of the distribution network in combination with a meteorological database. Unmanned aerial vehicle near-earth monitoring and satellite remote sensing data can be fused, the distribution network construction process is effectively monitored, and potential safety hazards are reduced.

The invention relates to a public multi-mode cloud network resource software security enhancement method based on neural symbol fusion reasoning, which comprises the following steps: an intermediate representation generation stage: generating and optimizing an intermediate representation of a program through a fine-tuned large language model, and establishing semantic mapping from a source code to a structured logic representation; in the symbol language conversion stage, the intermediate representation generated by the large language model is converted into a domain-specific language fact set which can be recognized in the symbol logic reasoning stage, and formal and logic expression of program semantics is achieved; and a symbol logic reasoning stage: matching the fact set with the rule base through a symbol logic reasoning engine, performing detection and verification according to the safety rule, generating a structured report, and feeding back a result for optimization. The method is suitable for security enhancement of various core software systems in a public cloud network multi-modal network environment, high-precision security analysis is carried out on cross-modal and cross-subsystem fragmented codes in a compiling-free environment, and verifiable technical support is provided for public cloud network security control.

The invention belongs to the technical field of thermal power plant safety analysis, and relates to a risk assessment method, system and device for a hydrogen storage system of a thermal power plant and a storage medium. Comprising the following steps: collecting operation data of the hydrogen storage system in real time, and preprocessing the data; based on the preprocessed data, utilizing a trained Bayesian LSTM model to predict the hydrogen leakage probability; if the hydrogen leakage probability exceeds a preset threshold value, CFD is combined with the preprocessed data to simulate a diffusion behavior after hydrogen leakage, and the severity of a leakage event is calculated based on a simulation result; and inputting the hydrogen leakage probability and the severity of the leakage event into a Bayesian network model, calculating a risk value, and triggering a grading early warning mechanism according to the risk value. According to the method, the sensitivity and accuracy of risk identification are improved, the scientificity of early warning decision making is enhanced, and intelligent guarantee is provided for safe operation of the hydrogen storage system of the thermal power plant.

The invention relates to the technical field of chemical safety intelligent analysis, and discloses a chemical safety production safety intelligent analysis system based on a large language model, and the system comprises a semantic data construction module which is used for obtaining multi-source data and building a standardized database, a semantic anchor point library and a causal fragment set; the mechanism constraint modeling module is used for generating a mechanism constraint library and mapping the mechanism constraint library with the device unit; the semantic compiling constraint module is used for compiling the natural language intention into a formalized constraint set; the interlocking generation matching module is used for generating a semantic interlocking table and an action list; the check amplitude limiting decision module is used for determining a reserved action list, an amplitude limiting parameter and an execution sequence; the simulation verification and evaluation module is used for carrying out full-track simulation and outputting a feasibility result; and the deviation revision backfilling module is used for comparing the actual working condition with the simulation track and generating a revision proposal. According to the method, self-adaptive closed-loop optimization of semantic knowledge unified modeling and safety analysis in the chemical safety production process is realized.