310 results about "Security analytics" patented technology

The invention discloses a big language model generation content security test system and method in a black box scene. The system comprises a jailbreak prompt word library module used for storing jailbreak prompt words for performing security test on a big language model; the violation question and answer pair module is used for storing violation question and answer pairs covering different types; the response acquisition module is used for obtaining a data request packet according to query content formed by the jailbreak prompt word and the query request; the security analysis module is used for calculating the similarity between response data corresponding to the query request and an expected violation answer, taking the similarity as a security score, and inputting the security score into the adaptive optimization module; and the adaptive optimization module is used for optimizing the jailbreak prompt words output by the jailbreak prompt word bank module by using a genetic algorithm according to the security score output by the security analysis module. According to the method and the device, the security of the large language model generation content can be effectively tested.

The invention belongs to the technical field of software security, and particularly discloses a warehouse-level vulnerability detection method and device based on a large model function semantic abstract. The method comprises the following steps: generating a vulnerability detection abstract syntax tree according to a to-be-detected source code; generating an assembly prompt word according to the complete source code of the node function in the unprocessed state and the target semantic abstract, and analyzing the node function in the unprocessed state according to the assembly prompt word by calling the target large model; and determining a vulnerability detection result of the to-be-detected source code according to the initial function semantic abstract and the structured function semantic abstract. Through the above mode, the vulnerability detection abstract syntax tree is generated by using the program structure modeling strategy and the full function call graph is constructed, and then the semantic abstract of the structured function is determined by using the semantic understanding capability of the target large model, that is, deep security analysis and vulnerability mining are performed from the local function to the global context. Therefore, the accuracy and comprehensiveness of warehouse-level vulnerability detection can be effectively improved.

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user / entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies / threats were previously known. The security platform can include both real-time and batch paths / modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

The invention discloses an air-space integrated safety monitoring method for distribution network construction based on an unmanned aerial vehicle, and the method comprises the following steps: A, constructing an air-space integrated cooperative monitoring network, and collecting the multi-source data of a distribution network construction region through the air-space integrated cooperative monitoring network; c, constructing a construction safety analysis model; the construction safety analysis model comprises a data acquisition and preprocessing module, a multi-source data fusion analysis module, a risk diagnosis and evaluation module, an intelligent prediction and early warning module, an early warning decision and disposal module and a visualization and feedback module; and D, based on the trained construction safety analysis model, collecting multi-source data by using an air-space integrated cooperative monitoring network, and carrying out online monitoring, early warning and disposal on the construction safety of the distribution network in combination with a meteorological database. Unmanned aerial vehicle near-earth monitoring and satellite remote sensing data can be fused, the distribution network construction process is effectively monitored, and potential safety hazards are reduced.

The invention relates to a public multi-mode cloud network resource software security enhancement method based on neural symbol fusion reasoning, which comprises the following steps: an intermediate representation generation stage: generating and optimizing an intermediate representation of a program through a fine-tuned large language model, and establishing semantic mapping from a source code to a structured logic representation; in the symbol language conversion stage, the intermediate representation generated by the large language model is converted into a domain-specific language fact set which can be recognized in the symbol logic reasoning stage, and formal and logic expression of program semantics is achieved; and a symbol logic reasoning stage: matching the fact set with the rule base through a symbol logic reasoning engine, performing detection and verification according to the safety rule, generating a structured report, and feeding back a result for optimization. The method is suitable for security enhancement of various core software systems in a public cloud network multi-modal network environment, high-precision security analysis is carried out on cross-modal and cross-subsystem fragmented codes in a compiling-free environment, and verifiable technical support is provided for public cloud network security control.

The invention relates to the technical field of chemical safety intelligent analysis, and discloses a chemical safety production safety intelligent analysis system based on a large language model, and the system comprises a semantic data construction module which is used for obtaining multi-source data and building a standardized database, a semantic anchor point library and a causal fragment set; the mechanism constraint modeling module is used for generating a mechanism constraint library and mapping the mechanism constraint library with the device unit; the semantic compiling constraint module is used for compiling the natural language intention into a formalized constraint set; the interlocking generation matching module is used for generating a semantic interlocking table and an action list; the check amplitude limiting decision module is used for determining a reserved action list, an amplitude limiting parameter and an execution sequence; the simulation verification and evaluation module is used for carrying out full-track simulation and outputting a feasibility result; and the deviation revision backfilling module is used for comparing the actual working condition with the simulation track and generating a revision proposal. According to the method, self-adaptive closed-loop optimization of semantic knowledge unified modeling and safety analysis in the chemical safety production process is realized.

The invention relates to the technical field of network security awareness, in particular to a security awareness method and system for a GPU cluster, and the method comprises the steps: collecting multi-source security situation data, and providing basic information for subsequent security analysis; by constructing and updating a cluster security situation map in real time, information timeliness is updated and ensured in real time, and powerful support is provided for risk assessment; a dynamic risk assessment model is utilized to calculate vertex and edge scores, high-risk vertexes and key risk conduction paths are identified, and a basis is provided for resource isolation and scheduling; the targeted instruction is generated according to the security risk score and the preset security policy library, different security risks are effectively handled, and safe and stable operation of the cluster is guaranteed; by converting the instruction into a specific control command and distributing and executing the specific control command, effective implementation of security measures is ensured, and the cluster security protection capability is improved; by setting a finite-state machine monitoring instruction execution state, a recovery mechanism is automatically triggered, and continuous and safe operation of the cluster is guaranteed.

The invention provides a nuclear power safety analysis report examination method and an applicable system and a readable medium thereof, and relates to the technical field of nuclear power. The review method comprises the following steps: converting each design file into document fragment data through a knowledge maintenance agent, and storing the document fragment data into a knowledge base; converting the nuclear power safety analysis report into a plurality of to-be-examined text blocks through a document analysis agent; extracting at least one technical expression statement and a corresponding retrieval problem and a matched knowledge fragment from each to-be-examined text block through a retrieval composite agent; performing consistency judgment on each technical expression statement, and a retrieval problem and a matched knowledge fragment corresponding to the technical expression statement through a technical review agent to obtain initial review data; and obtaining a final examination decision agent and a historical examination database, and generating corresponding final examination data through the final examination decision agent according to the historical examination database and the initial examination data.

The invention relates to the technical field of sensing data processing, and discloses an old people home safety decision service system fusing multi-mode sensing data, which comprises a data interaction analysis unit, a data change analysis unit, a data calculation unit, a safety analysis unit and a safety decision unit. The hidden association of the multi-modal indexes is accurately captured, the early degradation of the collaboration level can be perceived through the graph condensation degree and the graph equilibrium value, the collaboration degradation track can be used for analyzing the collaboration state, and the finally generated safety decision instruction can perform early warning in advance. According to the scheme, single-mode threshold dependence is broken through, hidden dangers hidden in data correlation evolution are recognized in advance, and the lagging of home safety decision of old people is solved.

The invention belongs to the technical field of power transmission line modeling, and provides a power transmission line channel point cloud modeling method and system, and the technical scheme is that based on standardized point cloud data, global statistical features are extracted, channel scene categories are automatically judged, and adaptive feature weight vectors are generated according to the judged scene categories; performing weighted calculation on the similarity by using the feature weight vector, and performing superbody clustering segmentation on the standardized point cloud data to obtain an optimized superbody set formed by a plurality of superbodies with similar internal features; based on multi-dimensional feature statistics and context rules, screening the optimized superbody set, and rejecting small non-ground interference superbodies to obtain a ground candidate superbody set; and performing identification, merging and curved surface fitting on the ground candidate superbody set to generate a continuous power transmission line channel ground model. High-precision identification of ground points is realized, and a high-quality ground reference can be provided for safety analysis of a power transmission channel.

The invention relates to the technical field of safety monitoring artificial intelligence, and discloses a safety management method and system based on artificial intelligence and big data. The method comprises the steps that multi-modal real-time monitoring data is collected through a distributed sensor array, and a standardized sequence is generated after preprocessing; the system accesses a historical security event library, adaptively divides risk category clusters by using an unsupervised clustering algorithm, and extracts key risk features and influence domains for each cluster. On the basis, a plurality of special self-adaptive security analysis engines are configured to perform parallel analysis on real-time data to generate a plurality of security analysis feature maps. And carrying out weighted fusion and enhancement on the feature maps through a feature fusion network to obtain a unified security situation feature vector, and finally outputting a security level and a management and control instruction through a decision model. According to the method, autonomous identification, dynamic evaluation and accurate response of complex risks are realized, and the intelligent level of safety management and the decision accuracy are improved.

Disclosed embodiments relate to systems and methods for centrally analyzing and managing source code. Techniques include identifying, at a centralized resource in a network environment, a first source code; identifying the first source code as a candidate for an execution of an access control action; identifying, at the centralized resource, a security risk indication for the first source code, the security risk indication being based on permissions associated with a functionality of the first source code; performing, based on the security risk indication, at least one of: developing a least privilege set of permissions for the source code, or modifying the least privilege set of permissions.

The invention discloses an identity privacy protection system and method oriented to power data security sharing, which combine single-factor combination authentication and identity traceability and utilize the transparency and tamper resistance of a block chain. Comprising an electric power key generation center, an electric power cloud service provider, an electric power data owner, an electric power data user and a block chain, user identity privacy is ensured, safe identity verification is supported, identity traceability is achieved under necessary conditions, and meanwhile safe distribution of keys is achieved. In addition, services and resources are isolated by using groups, so that the flexibility and the expandability of the services and the resources are enhanced. Security analysis and experimental evaluation prove that the method can effectively resist selected plaintext attacks, and meanwhile, high efficiency and practicability are kept.

The invention provides a dam safety monitoring data analysis method and system based on a multi-modal knowledge graph and a large language model, and belongs to the technical field of calculation models. The method comprises the following steps: collecting multi-modal data of dam monitoring, and preprocessing the multi-modal data; constructing a dam safety analysis knowledge graph by adopting a water conservancy object multi-modal knowledge graph construction mode; an intelligent positioning function is used for finding an associated object for the monitored abnormal signals, information of the associated object is obtained, and a dam analysis model is used for association analysis; generating an abnormal associated sub-graph; and forming a multi-dimensional analysis report conclusion by using a pre-trained water conservancy professional knowledge large language model in combination with cue words and user questions. Multi-aspect information generated in the dam safety management process is integrated by utilizing the knowledge graph to form a comprehensive information network, efficient query and reasoning are realized by virtue of a graph computing technology, and a monitoring analysis result for explaining the dam is clearly, intuitively, accurately and comprehensively presented.

The invention discloses a power grid tower cross-domain adaptive type selection method, system and device and a medium. The method comprises the steps that tower data and multi-domain environment data are collected; inputting the tower data and the multi-region environment data into a domain adversarial neural network, and constructing a tower-region calculation model; based on the multi-region environment data, obtaining environment parameters of a target region through an LSTM prediction model, and obtaining tower parameters through a multi-objective evolutionary algorithm; and according to the environmental parameters and the tower parameters, generating a three-dimensional tower model, and performing safety analysis on the three-dimensional tower model to generate an optimal cross-domain adaptive type selection scheme. According to the method, multi-region data cross-domain sharing and privacy protection are realized through federated learning and homomorphic encryption, the domain adversarial neural network, LSTM prediction and a multi-objective evolutionary algorithm are combined, and a BIM modeling and knowledge graph reinforcement scheme is matched, so that the cross-region type selection suitability and precision of the power grid tower are improved, the type selection is safe and efficient, and the method is suitable for large-scale popularization and application. The problems that traditional model selection data are limited, and dynamic optimization is weak are solved.

The invention discloses a CVE-ATTamp (Cascade Vector Enhanced ATTamp) for a network security scene. The invention discloses a CK association fusion RAG construction method, and relates to the technical field of network security. The method comprises the following steps: (1) carrying out structured analysis and vectorization on CVE vulnerability information data, extracting features and fusing CVSS scores to carry out semantic embedding; (2) ATTamp; semantic modeling of a CK threat matrix is carried out, and a threat semantic space containing tactical level information is constructed; (3) heterogeneous knowledge association and graph construction: calculating cross-domain semantic similarity and establishing logic mapping between vulnerabilities and tactics in combination with expert rules to form a heterogeneous knowledge graph; and (4) attack logic-oriented RAG retrieval and generation: retrieving a key attack path sub-graph based on a hybrid scoring mechanism, and driving a large model to generate a security analysis report with logic depth. According to the method, attack logic is stored through mapping, so that the problems that the traditional RAG lacks inference ability and security data fragmentation are solved, and the accuracy and tactical value of automatic threat analysis are remarkably improved.

The invention discloses a detection data security analysis method, system and equipment based on dynamic monitoring, and relates to the technical field of data analys.The method comprises the steps that semantic extraction is conducted on detection data, regular behavior characteristics and irregular behavior characteristics of all monitoring objects are obtained, and the dynamic credibility of all the monitoring objects is determined; for each monitoring object, taking the monitoring object as a target object, and performing first semantic association mining on a target regular behavior feature corresponding to the target object based on a non-target regular behavior feature corresponding to a non-target object to obtain a behavior association feature of the target object; based on the irregular behavior characteristics, second semantic association mining is carried out on the behavior association characteristics, and abnormal behavior association characteristics are obtained; and on the basis of the dynamic credibility, performing weighted analysis on each behavior anomaly association feature to obtain a security analysis result. The method has the effect of improving the accuracy of data security analysis.

The invention provides an intelligent time sequence security analysis method and device based on a large language model, and relates to the technical field of information security, and the method comprises the steps: collecting an original log from a multi-source heterogeneous system to obtain a standardized log event; inputting the standardized log event into a preset large language model to generate a historical semantic log event; constructing a user digital portrait based on the historical semantic log event, and establishing a dynamic behavior baseline model associated with the user digital portrait by using a long-short term memory neural network model; obtaining a semantic log event stream output by the large language model in real time, and querying a dynamic behavior baseline model of a user corresponding to the semantic log event stream; and evaluating whether the current semantic log event is an abnormal event: if the current semantic log event is an abnormal event, calling a large language model to generate a semantic alarm, and injecting the semantic alarm into a rule engine. The technical problems that a traditional static rule system is poor in adaptability, high in false alarm rate and high in maintenance cost are effectively solved.

A natural language (NL) prompt is received by a security analytics platform. The NL prompt is provided as input to a large language model (LLM). An output of the LLM is obtained. The output comprises an indication that an intent of the NL prompt is associated with a security investigation service of a plurality of security investigation services of the security analytics platform. The NL prompt is modified based on one or more parameters associated with the security investigation service. The modified NL prompt is provided as input to the security investigation service.

The invention discloses an intelligent detection method for network security vulnerabilities, and relates to the technical field of network security vulnerability detection, and the method comprises the following steps: analyzing source codes to construct an abstract syntax tree, a control flow graph and a call graph, identifying sensitive operation points based on a rule base, and screening hotspot functions in combination with code indexes and the call graph; extracting a candidate path from a program entry to a sensitive operation point, encoding to generate a path context snapshot, and scoring through a pre-training model; selecting a high-risk path to execute sparse symbolic execution, simplifying constraints by using variable interval information, and dynamically feeding back and adjusting scores; poC input verification is generated for the path triggering the vulnerability constraint, a report containing the path constraint, the triggering condition and the PoC is output, program analysis and machine learning are combined, the vulnerability detection efficiency and precision are improved, and the method is suitable for code security analysis of scenes such as an embedded system.

The invention discloses a URL (Uniform Resource Locator) security analysis method and device for an end-side large language model and a medium, and belongs to the field of network and information security. The method comprises the steps of collecting multi-modal data such as a URL analysis structure, DNS / certificate metadata, front-end code sampling, an OCR text and a dynamic behavior event sequence; performing exponential decay weighted aggregation on the dynamic events in the sliding time window; generating a static structure feature, a text semantic feature and a threat intelligence similarity based on the multi-modal data; fusing the multi-modal features by adopting a gating attention mechanism; inputting the fusion features and the readable context into an end-side large language model, and calling a security analysis tool set under limited decoding; a risk score and a minimum sufficient evidence are obtained through two-stage scoring; and executing an end-side security policy according to the scoring threshold value and leaving a trace by using a JSONL structure. According to the method, in-end closed-loop analysis is realized, the detection accuracy is remarkably improved, and the method is suitable for various deployment scenes such as mobile terminals and edge gateways.

The invention discloses an industrial Internet of Things production line safety analysis method, system and device and a medium, and relates to the technical field of industrial Internet of Things, and the method comprises the steps: obtaining the operation environment time sequence data of a target production line and the corresponding fault record data; through a semantic mining model included in a target production line data analysis network, respectively performing semantic coding on the operation environment time sequence data and the fault record data to obtain corresponding operation environment features and fault features; performing cross-domain association semantic coding on the operating environment features and the fault features through the semantic analysis model to obtain corresponding environment fault association features; and performing safety situation assessment on the target production line according to the environment fault correlation features through a safety assessment model to obtain a corresponding operation safety assessment result. The method has the effect of improving the accuracy of safety analysis of the production line.

The application provides a security analysis method and device for image data individual privacy protection. In one example, the method comprises: performing sensitive metadata extraction on input image data to determine a corresponding target scene; performing encryption processing on the input image according to an individualized parameter corresponding to the target scene; performing down-sampling processing on the input image data and the encrypted image data respectively to obtain input image data and encrypted image data of T different resolutions; determining visual security scores of different resolutions respectively according to the perceptual features of the input image data and the encrypted image data of different resolutions; and determining a visual security evaluation score of the encrypted image data according to the visual security scores of the T different resolutions. The method can improve the accuracy of security analysis of image data.

A system and method for implementing user and entity behavioral analytics (UEBA) in a cybersecurity analytics platform. An example method includes receiving, by one or more processing devices of a security analytics platform, security data associated with a specified entity; generating, based on at least a subset of the security data, one or more security signals associated with the specified entity and occurring within a specified time window; computing, for each security signal of the one or more security signals, a respective risk score associated with the specified time window; computing, by aggregating risk scores associated with the one or more security signals, a risk score associated with the specified entity for the specified time window; and modifying, based on an attribute of a security watchlist associated with the specified entity, the risk score of the specified entity.

The invention provides a double-layer optimization micro-grid planning method, device and equipment, and relates to the technical field of micro-grid planning. The method comprises the following steps: acquiring historical operation data of a micro-grid to be planned; based on historical operation data and a bilevel planning model giving consideration to planning targets of the power distribution network and the micro-grid, optimization solution is carried out, and a plurality of planning schemes for the distributed energy and energy storage system are obtained; aiming at each planning scheme, through electromagnetic transient model simulation and disturbance interference analysis, obtaining a dynamic performance index of an electromagnetic transient model in each disturbance state; based on the dynamic performance index of each planning scheme in each disturbance state, performing dynamic safety analysis on frequency, voltage and oscillation stability, and performing preliminary screening to obtain a plurality of preliminary screening schemes; and carrying out multi-dimensional quantitative evaluation on the plurality of preliminary screening schemes, and carrying out secondary screening to obtain a final planning scheme of the micro-grid. According to the invention, the dynamic security risk caused by the access of high-proportion power electronic equipment can be reduced.

Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (LLM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the LLM. Actions for evaluating the events may be determined based on the LLM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.

Anomalies regarding a specified entity that occurred within a specified time period are selected from anomalies identified by security analysis performed on raw events. The selected anomalies are enhanced with additional information regarding the selected anomalies. A prompt is generated based on the selected anomalies as have been enhanced. The prompt is generated to solicit a response from a large language model (LLM) including a natural language summary synthesizing the selected anomalies. The generated prompt as input to the LLM, and the response is received as output from the LLM.

An improved context-aware security system may include an artificial intelligence (Al) reasoning security system. The context-aware security system may be configured to receive security input data from a plurality of input sources, generate a contextual security analysis, identify a security response, and send instructions to a security system output device to execute the security response. The context-aware security system may include a plurality of security input sources configured to provide security inputs and contextual data, including credential readers, physical access controllers, security sensors, environmental sensors, or external information sources. The context-aware security system may include a directive input subsystem configured to receive security directives from an authorized user interface. A plurality of security system output devices may be configured to execute the security response, including credential reading systems, biometric systems, alerting systems, logging systems, or notification systems.

The invention relates to an intelligent fire exit door state monitoring method, system and device, and the method comprises the steps: collecting magnetic field distribution data through a magnetic field induction array disposed on the contact surface of a door body and a door frame of a fire exit door, carrying out the change analysis, and obtaining the opening and closing information of the door body; performing signal filtering and feature extraction on the door body opening and closing information to generate door body state information; the door body state information is uploaded to a cloud analysis platform, safety analysis is carried out in combination with fire exit door data, and a door body evaluation conclusion is generated; and generating equipment regulation and control parameters according to the door body evaluation conclusion, and performing parameter optimization adjustment on the magnetic field induction array to obtain optimized monitoring parameters. According to the method, a complete closed-loop system from data acquisition, local processing, cloud analysis to parameter optimization can be constructed, and the accuracy, reliability and operation and maintenance efficiency of state monitoring of the intelligent fire exit door are comprehensively improved.

Methods, systems, and computer storage media for providing generative artificial intelligence (AI) security management using a generative AI security engine in an item listing system. A generative AI security engine supports generative AI security management based on security analysis and detection operations for a plurality of generative-AI-supported applications and generative AI models. In operation, a request associated with prompt data is communicated from a generative AI client. Based on communicating the request, a response that is generated based on a redacted version of the prompt data is received at the generative AI client. The prompt data is analyzed using a plurality of security engine operations to cause generation of the redacted version of the prompt data. The redacted version of the prompt data is used to generate the response at a generative AI model. The response is caused to be generated at an interface associated with the generative AI client.