984 results about "Security analytics" patented technology

The invention provides a data security analysis method and an intelligent calculation data security workstation, and the method comprises the steps that the intelligent calculation data security workstation obtains data of different data sources, and the data comprises a user operation log and a data access and transmission log; classifying and grading the data based on a preset rule base and a machine learning model, and marking sensitive data; analyzing a user behavior mode based on the user operation log, and identifying an abnormal behavior; and based on the data access and transmission log, evaluating a data leakage risk, and generating a risk report.

A system and method for securing inter-process communications (IPCs) between generative AI and external tool servers, including intercepting IPCs having a requested operation, performing a security analysis on the IPCs for security threats, performing a permission validation for permissions for the requested operation of each IPC, and either approving or blocking the requested operation of each IPC based on the security analysis and the permission validation.

Method and system for analyzing software or firmware of computing systems to assess security properties includes loading predicate device input data including characteristics about predicate devices; translating predicate device input data into predicate device model data describing characteristics or dependencies of the predicate device input data relevant to the analysis; determining digital twin configuration data used to configure digital twin; loading the digital twin configuration data onto the digital twin; storing configuration data in the memory; instructing the digital twin to configure itself to implement the loaded digital twin configuration data; determining security analysis to be carried out on the digital twin; simulating the predicate device; executing security analysis on the digital twin; generating output data describing the result of execution of the security analysis; storing output data pertaining to the result; and determining if the result satisfies a predetermined condition, and if so, executing action corresponding to the result.

The invention relates to the technical field of code security analysis, and discloses a control flow analysis and retrieval enhancement-based large model code security review method, which comprises the following steps of: analyzing an incremental code to generate an abstract syntax tree and data flow analysis information; retrieving local knowledge base association business rules and historical vulnerabilities based on grammatical features, and generating a context enhancement prompt; calling a large language model to jointly analyze codes and contexts, identifying vulnerabilities and outputting a structured report; and combining with a historical false alarm data optimization result and then integrating to a development assembly line. Multi-source information is fused through an RAG technology to enhance semantic understanding, and control flow node tracking and cross-version semantic association are combined, so that the problems of a traditional tool business logic vulnerability detection blind area, incremental code analysis failure and high false alarm rate are solved, synchronous improvement of security examination accuracy and efficiency is realized, and the method is adaptive to an agile development scene.

Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system / process / computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.

In some implementations, a cybersecurity threat detection and mitigation system is provided. The system refines an artificial intelligence (AI) model with a corpus of historical data that represents security events that occurred, queries that were submitted by security analysts in response to the security events, and actions that were performed for mitigating the security events. Telemetry data that corresponds to behavior and performance of a computer network is collected and provided to the AI model. Based on the telemetry data, the AI model predicts a potential security threat to the computer network and performs an assessment of risk to the computer network. When the assessment of risk to the computer network indicates that the potential security threat is an actual security threat, a security alert that corresponds to the actual security threat is triggered. Other embodiments are described and claimed.

The invention relates to the field of internet attack detection, in particular to a data security event real-time monitoring method and system, and the method comprises data collection, multi-modal fusion, threat detection, causal reasoning, dynamic response and feedback optimization. Compared with the traditional security analysis which depends on isolated data dimension or simple rule association, is difficult to capture a cross-data-source complex attack mode, and is faced with the limitations of low calculation efficiency, slow link traceability, storage access bottleneck and the like in mass data association analysis, the scheme integrates multi-source heterogeneous data into a dynamic association network through graph structure modeling, so that the security analysis efficiency is improved. Hidden association and behavior patterns among users, equipment and IPs are deeply mined by utilizing a GNN framework, the suspicious degree among entities can be accurately quantified, and hidden attack chains can be identified; and meanwhile, a hybrid storage architecture and a query optimization technology are adopted, so that a security analyst can backtrack a complex attack path in a second level while breaking through the bottleneck of large-scale graph data access performance, and the threat hunting efficiency and the high-level attack traceability are remarkably improved.

The invention relates to the technical field of data security analysis, in particular to a data security analysis system and method based on artificial intelligence. The method comprises the following steps: a data processing unit performs parallel cleaning and standardization processing on network flow data, user behavior data and system log data, and integrates the data into a comprehensive feature vector; the anomaly detection unit uses a DBSCAN algorithm to carry out clustering analysis on the comprehensive feature vectors, and a Gaussian mixture model is used to carry out probability modeling to screen abnormal points; the behavior analysis unit determines the type of an abnormal point through mode matching, carries out risk assessment on the abnormal point, and generates a safety analysis report; and the safety response unit adopts an automatic response mechanism based on the abnormal point risk level and generates a safety response report. According to the data security analysis system and method based on artificial intelligence, efficient abnormal point division is realized by dynamically adjusting clustering parameters and a density sensing technology, and abnormal detection and security risk assessment are realized by combining a Gaussian mixture model and a posterior probability screening mechanism.

An integrated security analysis data structure and a method for multi-container software projects. A data repository storing containers and a software bill of materials (SBOM) is queried. The SBOM includes first data describing the containers and second data describing software images in the containers. The software images include corresponding components. The SBOM further includes metadata about the containers, the software images, and the one or more corresponding components. A dependency graph, showing dependencies among the software images, of the software images is built automatically. Usage data describing usage of the containers as deployed in an enterprise system is retrieved automatically. The SBOM, the dependency graph, and the usage data are transformed into a SBOM data structure. The SBOM data structure includes a searchable data object that is searchable by: the containers, the software images, the one or more corresponding components of the software images, the metadata, and the usage data.

Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (LLM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the LLM. Actions for evaluating the events may be determined based on the LLM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

The invention discloses a three-dimensional GIS (geographic information system) system for safety assessment of an urban gas pipeline internet of things. A gas pipe network monitoring and assessment system combining the internet of things, a mobile internet and BIM / GIS information is established. Firstly, an overall framework based on sensing, transmission, knowing and use of the internet of things is established; secondly, a front-end sensing system deployment scheme is established, a database system is built, and index data are collected and stored; thirdly, a gas leakage hazard model is constructed, and possible hazard consequences are evaluated; 4, a pipe network monitoring system application layer module is constructed, and underground space information management, safety analysis, prediction and early warning and an auxiliary decision making module are achieved; and establishing a gas pipe network risk identification module, a basic information checking module, a monitoring and explosion early warning module, a three-dimensional visualization module and an auxiliary decision-making module. The system monitors the operation condition of the gas pipe network in real time, analyzes the operation rule of the gas pipe network, evaluates the risk of the gas pipe network, predicts, early warns and decides in time, changes passive first-aid repair into active protection, and is high in monitoring stability, precision and efficiency.

A computing system assists in large language model system assisted investigations. The computing system includes network connection hardware configured to connect to a large language model and configured provide to investigation context and investigation goals to the large language model system. The network connection receives from the large language model system, an indication of suggested steps to perform in an investigation, including specific computer executable code to perform a skill in the first step, the skill comprising a supplemental access, analytic or enrichment function. The computing system includes a user interface with a tree interface that causes display of the indication of the suggested steps in a tree format. The computing system is configured to execute the computer executable code to cause the computer system to perform the supplemental access, analytic or enrichment function.

The invention provides a cable safety monitoring system based on a digital twin technology. The cable safety monitoring system comprises a digital modeling module, a data acquisition module and a simulation analysis module, wherein the digital modeling module is used for acquiring cable physical data and building a digital twin model according to the acquired cable physical data; wherein the cable physical data comprises cable basic information and cable field equipment basic information; the data acquisition module is used for acquiring cable safety monitoring data and inputting the acquired cable safety monitoring data into the digital twin model; wherein the cable safety monitoring data comprises cable monitoring data and field monitoring data; and the simulation analysis module is used for performing dynamic evolution simulation according to the digital twin model to obtain dynamic evolution information of the safety monitoring data, and performing safety analysis processing on the dynamic evolution information by adopting the trained safety analysis model to obtain a cable safety analysis result. According to the invention, the reliability and the intelligent level of cable safety monitoring can be improved.

The invention relates to the technical field of mine safety analysis, and discloses a mine personnel trajectory prediction method, system and device based on artificial intelligence. The method comprises the following steps: collecting mine personnel positioning data, and performing standardization processing; calculating trajectory quality through a neural network; converting the spatio-temporal feature vector to perform image recognition; performing multi-time scale prediction by applying an activation function; matching with a mine space structure, and clustering to identify a group behavior mode; and calculating a safety index, and generating a safety scheduling strategy. According to the method, the future trajectory of the mine personnel can be accurately predicted through the special environment constraint of the mine and the working behavior mode of the miner, and the prediction result is converted into a safe scheduling strategy.

Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (ELM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the ELM. Actions for evaluating the events may be determined based on the ELM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.

The invention provides a security event association analysis and question answering method and system and a medium, and the method comprises the following steps: context-aware query completion: receiving an original query input by a user, obtaining a historical record of a current dialogue, and forming a context enhanced query according to the original query and the historical record of the current dialogue; dynamic task identification: outputting a prediction task model according to the context enhancement query in combination with a dynamic task identification strategy; multi-dimensional retrieval: performing multi-dimensional retrieval on the prediction task model to obtain a final knowledge context packet; and knowledge-driven response generation: generating a knowledge-driven response based on the knowledge context packet, and outputting a final security analysis report after the generated content passes verification. According to the method, efficient, accurate and explainable intelligent association analysis of the multi-source heterogeneous security data is realized by constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism and realizing context-aware query completion.

The invention discloses a big language model generation content security test system and method in a black box scene. The system comprises a jailbreak prompt word library module used for storing jailbreak prompt words for performing security test on a big language model; the violation question and answer pair module is used for storing violation question and answer pairs covering different types; the response acquisition module is used for obtaining a data request packet according to query content formed by the jailbreak prompt word and the query request; the security analysis module is used for calculating the similarity between response data corresponding to the query request and an expected violation answer, taking the similarity as a security score, and inputting the security score into the adaptive optimization module; and the adaptive optimization module is used for optimizing the jailbreak prompt words output by the jailbreak prompt word bank module by using a genetic algorithm according to the security score output by the security analysis module. According to the method and the device, the security of the large language model generation content can be effectively tested.

The invention discloses a digital twin-driven bushing operation monitoring and early warning system, which relates to the technical field of digital twin bushing operation monitoring and early warning, and comprises a multi-source acquisition, transmission, analysis, early warning and interaction module, an acquisition module adopts an ad hoc network, a self-powered sensor acquires data in a multi-mode manner, and the sampling frequency is dynamically adjusted. The transmission module guarantees data transmission through LPWAN, satellite communication and quantum encryption, the analysis module builds a multi-scale coupling model to predict the state and the service life, the model can be adaptively adjusted, the early warning module determines the early warning level in combination with a fuzzy decision and a Bayesian network and gives decision suggestions, and the interaction module provides immersive experience and natural interaction based on VR / AR / MR. According to the invention, comprehensive monitoring, stable and safe data transmission, accurate analysis and prediction, scientific and reliable early warning, convenient man-machine interaction, rapid fault diagnosis, cooperation of all modules, real-time and accurate monitoring and early warning, fault reduction, service life prolonging of a sleeve, safety guarantee and benefit and competitiveness improvement are realized through multi-source acquisition.

The invention relates to the technical field of information security, in particular to an anti-quantum computing public key cryptography method and system. The method comprises the following steps: acquiring a large prime number p and constructing a multivariable polynomial ring; randomly generating a group of polynomial coefficients, generating a polynomial embedding rule public key, and generating a multivariable polynomial ring embedding public key; the method comprises the following steps: acquiring a quantum computer message, performing polynomial space mapping conversion and message public key encryption, and meanwhile, generating a quantum message public key encrypted ciphertext by introducing a polynomial perturbation term and a transcendental coding term; the quantum message public key encryption ciphertext and the corresponding polynomial ring embedded public key are transmitted to a quantum message decryption party for inversion decryption processing, and a quantum computer message decryption plaintext is generated; and performing anti-quantum computing security analysis on the encryption and decryption processes, and regenerating a multivariable polynomial ring dynamic public key. According to the method, the attack of quantum computing can be effectively resisted, so that the security of quantum information transmission is guaranteed.

A computer system comprises a plurality of endpoints at which security agents generate security alerts and a machine-learning (ML) system that receives the security alerts from the endpoints and that separates the security alerts into a plurality of clusters, wherein the ML system is configured to execute on a processor of a hardware platform to: determine that a group of first alerts of the security alerts belongs to a first cluster of the clusters; create a first representative alert from metadata of the first alerts belonging to the first cluster; and in response to a security analytics platform evaluating the first representative alert as being harmless to the computer system, store information indicating that all of the first alerts are harmless.

The invention provides a distributed power supply communication gateway resource scheduling method and system based on dual-mode communication, and relates to the technical field of carrier wireless dual-mode communication, and the system comprises a time division module, a node evaluation module, a channel real-time monitoring module, a channel strategy making module, an efficiency monitoring module and a security analysis module. According to the invention, the output of the distributed power supply is monitored in real time and the access parameters are automatically adjusted to match the power grid demand, so that the efficiency and reliability of energy management are remarkably improved, the data loss is reduced, the communication security is enhanced, the nodes of carrier wireless dual-mode communication are identified, and the time distribution of the nodes in communication is verified; according to the method, the communication network can flexibly cope with load changes, load management of the network is optimized, resource waste or congestion caused by fixed time allocation is reduced, encryption keys are dynamically updated, abnormal data modes are identified, and data safety and tamper-proof capacity are greatly improved.

The invention relates to the technical field of power systems, in particular to a method for constructing a general knowledge base in the power safety industry based on a large model. Performing data classification and sorting on the data source of the electric power safety industry to obtain classified data; constructing a plurality of agents based on the large model, and processing the classified data by using the plurality of agents to obtain structured data; and carrying out vectorization processing on the structured data to generate vector data, storing the vector data into a vector database, and constructing a universal knowledge base in the electric power safety industry. The data source comprises intrinsic safety analysis historical data, an intrinsic safety analysis report, electric power safety rules and regulations and operation specifications. The intelligent agents comprise a file analysis intelligent agent, an analysis report information extraction intelligent agent, a rule and regulation information extraction intelligent agent and an operation instruction information extraction intelligent agent. Through a multi-agent cooperative processing and vectorization storage mechanism, efficient organization and intelligent application of electric power safety knowledge are realized.

The invention discloses an intelligent property safety management platform based on data analysis, and relates to the technical field of data management, and the platform comprises the steps: collecting property monitoring equipment, and constructing a monitoring data network; obtaining a property sample database, and determining a security event level and data relevance; constructing a training data set to obtain a security analysis decision model; establishing mapping association between the monitoring data and the security events, and segmenting a plurality of monitoring data blocks; obtaining a security identification event; and generating safety early warning information based on the matching early warning mode. The technical problems of incomplete property safety management coverage, low management efficiency and hysteresis of safety early warning caused by difficulty in coping with complex and changeable property management requirements and lack of deep integration and analysis capability on massive real-time monitoring data in existing property safety management are solved, intelligent monitoring management of property safety is realized, and the property safety management efficiency is improved. The technical effect of improving real-time performance and accuracy of property safety early warning is achieved.

The invention relates to the field of software security, and particularly discloses a software supply chain security analysis method which comprises the following steps: S1, collecting data of components of a software supply chain, and calculating a historical security risk weight for each component in the supply chain; s2, collecting behavior data of the software during operation, and performing association analysis in combination with the supply chain data; s3, preprocessing the collected behavior data and supply chain data, and extracting key features; according to the software supply chain security analysis method, through dynamic behavior analysis, runtime threats, such as zero-day vulnerabilities and hidden backdoor threats, which cannot be detected by static analysis can be found, the coverage rate of threat detection is remarkably improved, meanwhile, historical security risk weights are introduced, historical security problems of supply chain components are quantified, and the security of the software supply chain is improved. And intelligent risk assessment and threat traceability are realized by combining a knowledge graph and a graph neural network technology.

An apparatus for detecting fraudulent activity includes a device property data processing circuit, a security analysis circuit, an alert circuit, and an alert provisioning circuit. The device property data processing circuit is structured to interpret device property data corresponding to a device registered with an Internet of Things (IoT) device registry. The security analysis circuit is structured to determine, based at least in part on the device property data, that the device is subject to a fraud event. The alert circuit is structured to generate, responsive to the determined fraud event, a message that identifies the device. The alert provisioning circuit is structured to transmit the message.

The invention discloses a network attack path prediction method and device based on ATTCK mapping and a storage medium, relates to the technical field of network security, and discloses a network attack path prediction method based on ATTCK mapping, comprising: detecting risk data of a host, mapping the risk data to a corresponding ATTCK technical entry, and generating an attack path description; constructing an ATTCK enhanced attack path graph based on the attack path description; calculating a security risk score of the host according to the risk data and asset information of the host; and determining an attack path prediction result based on the ATTCK enhanced attack path graph and the security risk score. According to the method, the risk data is mapped, so that a clear attack means is provided for security analysis, and defense is more targeted. Meanwhile, the security risk score is calculated in combination with the risk data and the asset information, so that the risk assessment is more comprehensive, and the network security defense level is effectively improved.

Disclosed is a cloud-based security system implemented using API notifications provided by a GenAI service or application. The security system provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system receives notifications of traffic including requests directed to the GenAI service from endpoints as well as the GenAI responses. The security system includes a GenAI request classifier trained to classify prompts as benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses as normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies based on both the requests and responses that may include triggering alerts to administrators, deleting data stored by the GenAI service, and the like.

A scenario analysis unit (22) identifies an attack scenario indicating a chronological sequence of attack methods up to occurrence of a threat that may occur in a constituent element of a system. A past case collection unit (231) collects information on attack cases that have occurred in the past. A past case analysis unit (232) identifies a past scenario indicating a chronological sequence of attack methods for each attack case. A likelihood calculation unit (233) calculates a similarity between the attack scenario and the past scenario. Then, the likelihood calculation unit (233) calculates a likelihood of occurrence of the threat based on the similarity.

Disclosed are systems and methods for identifying prompts that cause a machine learning model to generate insecure code. A secure prompt that generates similar code, but without the security vulnerability, is proposed instead. In some configurations, a table of insecure prompts and corresponding secure prompts is pre-computed. Insecure prompts are generated by asking a code generation model for prompts that could have generated a piece of insecure code. A security analyzer confirms which of these potentially vulnerable prompts actually generate insecure code. A secure alternative to a potentially vulnerable prompt is create by asking the code generation model to identify a security vulnerability that an insecure prompt could generate. The code generation model is then asked to rewrite the potentially vulnerable prompt to not generate the security vulnerability. When an insecure user-supplied prompt is received, the table of insecure prompts is consulted to propose a secure alternative.