758 results about "Security bug" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

The invention provides an intelligent vulnerability mining platform construction method and system based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code snippets with the security risks, arranges the code snippets into risk code paragraphs, identifies target code paragraphs, determines known vulnerabilities, generates context information, captures key events in actual operation, and records real execution paths and state changes. The method comprises the steps of generating a dynamic execution track, simulating different paths, generating an attack vector path, predicting unknown vulnerabilities and credibility scores of the unknown vulnerabilities, testing prediction results of high-credibility scores, confirming and generating real vulnerability information, recording the information to a vulnerability knowledge base, and generating a security report containing vulnerability description, influence ranges, risk levels and repair suggestions. According to the technical scheme provided by the embodiment of the invention, the detection accuracy and efficiency of the security vulnerabilities in the software system are improved.

The invention relates to the technical field of computer security, and discloses a computer remote login identification device based on artificial intelligence, which comprises a user side device module used for collecting biological identification data and input behavior data of a user; the authentication and verification module is used for executing multi-mode identity authentication and dynamically adjusting an authentication strategy; the behavior analysis and risk assessment module is used for analyzing a behavior mode and a login environment of the user; the database and storage module is used for storing user identity information, behavior characteristic data and authentication logs; and the security monitoring and alarming module is used for monitoring the login activity of the user in real time and detecting potential security threats. According to the invention, the design based on multi-modal authentication greatly improves the security of remote login. By combining a plurality of authentication means such as face recognition, fingerprint recognition and voice recognition, the system can effectively prevent security vulnerabilities such as password stealing, fingerprint counterfeiting or facial image attack.

The invention discloses a network security vulnerability identification and repair method and system, a medium and a program product, and the method comprises the steps: segmenting a system behavior sequence into a plurality of subsequences; constructing a behavior dependency graph; calculating functional similarity, and dividing the functional similarity into node clusters; calculating a behavior consistency score, and determining a potential vulnerability region; determining call chain information; constructing a vulnerability propagation path, and calculating criticality; dividing first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the criticality; determining a repair priority, and generating a vulnerability report; according to the vulnerability types, the repair priorities and the propagation path information, corresponding repair strategies are sequentially matched from a preset repair template library according to the sequence of the repair priorities; and performing hierarchical repair on the application code based on the repair strategy obtained by matching to obtain a repair code, and deploying the repair code to the target system. According to the invention, the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

The invention relates to the technical field of data security, in particular to a financial data security management system and method, and the system comprises a data monitoring module, a vulnerability prediction module, a dynamic isolation module, a behavior analysis module and a security response module. According to the invention, through deep monitoring and analysis of financial data, the capability of identifying and processing abnormal operation is improved, so that the data security is enhanced, and through real-time collection of financial transaction and account behavior data and detailed analysis of fund flow frequency and account access frequency, risks are effectively identified and potential security vulnerabilities are predicted. By dynamically analyzing the association between the transaction node and the risk event, evaluating the risk level and automatically adjusting the data storage position and the access authority according to the risk evaluation, the security of the data in the transmission and storage process is remarkably improved, in addition, by monitoring the behavior mode change of the isolated account, the abnormal activity is further identified and corrected, and the safety of the data transmission and storage process is improved. And the overall safety and stability of the financial data environment are ensured.

An end-to-end approach for (i) identifying potential vulnerabilities in software applications, including security vulnerabilities, (ii) verifying / confirming the potential vulnerabilities as actual vulnerabilities and (iii) in response, identifying the necessary remedial actions necessary to eliminate or at least mitigate the vulnerabilities. An intelligent agent is implemented that is configured to detect a change to the application's code or computing environment and, as a result of detection of changes to the code or computing environment, identify potential vulnerabilities, verify / confirm the potential vulnerabilities as actual vulnerabilities through determination / creation of vulnerability test cases and automatically identify the necessary remedial actions necessary to eliminate or mitigate the vulnerabilities.

The invention is applicable to the technical field of vulnerability detection, and provides a power system software security vulnerability dynamic and static combined detection method, which comprises the following steps: acquiring static source code data of power system software and dynamic behavior log data during operation; generating a hierarchical abstract syntax tree and structured time series data; performing multi-dimensional feature extraction on the static source code data and the dynamic behavior log data based on a vulnerability knowledge graph of the power system; generating a domain constraint confrontation sample based on the power protocol features and the abnormal features during operation, and inputting the domain constraint confrontation sample into the constructed hybrid detection model for confrontation training to obtain a trained hybrid detection model; and performing automatic detection on the power system software by utilizing the trained hybrid detection model, and outputting a detection result containing a static code defect position and a dynamic attack path. The full-life-cycle accurate detection of the software vulnerability of the power system is realized, and the network security protection capability of the power system is improved.

The invention discloses a streaming knowledge injection and adversarial self-optimization large language model training method and system, and the method comprises the steps: collecting the newest knowledge of an authoritative information source in real time, converting the newest knowledge into a structured constraint rule through a semantic analyzer, and dynamically updating a knowledge base; based on the updated knowledge base, adopting a PPO algorithm to optimize a generator, actively constructing a high-risk adversarial sample, and forcing the model to expose security vulnerabilities; after user input and adversarial samples are input into the model, total loss is calculated through constraint detection, gradient updating is blocked if the total loss exceeds a threshold value, and otherwise, a multi-level safety verification stage is started; and finally, fusing a security verification result and the adversarial loss, updating a total loss function and cooperatively adjusting model parameters to form a continuous self-optimization training cycle. According to the method, compliance is guaranteed through streaming knowledge injection, vulnerabilities are actively mined in combination with adversarial training, verification precision is improved by means of multi-level detection and dynamic threshold adjustment, and safety and reliability of a large language model in a complex scene are enhanced.

Security vulnerability analysis may be performed using policy inference. Application code may have operations that are labeled according to the respective functions that they perform. Some operations may be labeled according to a knowledge database of known operations while others may be inferred through similarity to known operations. The knowledge database may be associated with libraries of programmatic interfaces. Once components of the application code are labeled, a vulnerability database may be that identifies potential vulnerabilities based on data sources, data sinks and threat mitigation operations. Using the labeled operations, one or more potential vulnerabilities may be identified based on labeled data sources and data sinks. The application may then be evaluated for potential security threats based on the identified potential vulnerabilities.

An industrial security system leverages generative artificial intelligence (AI) to automate the process of identifying software or hardware insecurities on industrial assets, generate recommendations for mitigating these vulnerabilities, and, where appropriate, deploy countermeasures to the vulnerable assets. By leveraging automated asset discovery, real-time asset and network monitoring, and generative AI-assisted vulnerability detection and remediation, the system can reduce the amount of time spent by security administrators in identifying and closing security vulnerabilities within their plant environments, and can alert administrators of potential security issues before those issues become critical.

The invention discloses a big language model security vulnerability test method and device based on a genetic algorithm and attention distribution, and a medium. The method comprises the following steps: selecting an AdvBench data set as a vulnerability test problem; performing malicious vocabulary extraction and lexical element decomposition on a test problem sample in the AdvBench data set; randomly selecting a plurality of lexical elements as an initial population, and calculating and amplifying attention scores corresponding to the selected lexical elements; performing coding flipping on the initial population according to the mutation probability so as to optimize the population; inputting a test problem corresponding to the optimized population into a large language model, and judging model response; when the model response is refusal, determining that the large language model does not have security vulnerabilities; and when the model response is compliant, determining that the large language model has security vulnerabilities.

The invention discloses a security access control method and system oriented to DNS (Domain Name Server) analysis, and relates to the technical field of network security, and the method comprises the steps: collecting DNS data, carrying out the preprocessing, and calculating the dynamic spectrum intensity based on the preprocessed DNS data; calculating the threat degree based on the dynamic spectrum intensity, constructing a long-short-term memory network model, predicting the future threat degree, and drawing a threat degree trend curve; and constructing a visual interface to display a threat degree trend curve, and storing, collecting and analyzing the generated DNS data. A dimension reduction feature matrix is generated through a multi-scale embedding technology and a nonlinear dimension reduction method, rapid detection and protection of potential network threats are achieved, the capability of preventing potential network attacks is improved, the threat degree is calculated in combination with nonlinear dynamic weighting, the sensitivity to complex attack behaviors is enhanced, the recognition precision of DNS traffic abnormal behaviors is improved, and the method is suitable for popularization and application. And the occurrence probability of security vulnerabilities is reduced.

The present invention provides a fuzz testing system and method based on a virtual computer model. Traditional fuzz testing approaches primarily modify external inputs to detect security vulnerabilities, making it difficult to monitor internal state changes in real-time. This invention constructs a test environment using a virtual computer model and incorporates automatic assertion generation and detection functions, enabling precise analysis of both internal and external signals of the system. After executing fuzz testing, assertion data is analyzed to assess test coverage and identify untested code regions, allowing for an optimized testing strategy. This improves the detection rate of security vulnerabilities, enhances test automation and reliability, and can be applied in various fields such as networks, automotive ECUs, IoT, finance, aerospace, and semiconductors.

The invention relates to the technical field of security vulnerability analysis, in particular to a big data-based security vulnerability management method, which comprises the following steps of: constructing a real-time data acquisition strategy, capturing an internal source network equipment log, a server running state and application system flow data through a distributed log collection component, and storing the internal source network equipment log, the server running state and the application system flow data; meanwhile, vulnerability information of the exogenous threat intelligence platform is synchronized through an API interface; constructing a dynamic risk assessment model, and updating the risk assessment of the security vulnerability in real time by taking the four-dimensional model [IP address, service type, port number and software version] as a reference; and triggering a response strategy according to risk value grading, wherein the response strategy comprises automatic isolation of high-risk equipment, dynamic configuration of firewall rules and generation of a repair work order. According to the invention, through the synergistic effect of real-time data acquisition, dynamic asset modeling, intelligent risk assessment, a hierarchical response mechanism and a closed-loop verification system, the accuracy, efficiency and defense capability of security vulnerability management are significantly improved.

The invention discloses an artificial intelligence model traceability and tamper-proofing method and system based on block chain enhancement, and relates to the technical field of artificial intelligence model traceability and tamper-proofing. According to the technical key points, the method comprises the following steps: carrying out simulation attack by utilizing penetration testing to obtain multi-type data containing security vulnerability data; preprocessing the multi-type data; constructing an anomaly detection and attack recognition model based on a variable parameter neural network, and training the anomaly detection and attack recognition model based on the preprocessed data; performing Merkle tree encryption on the preprocessed data and model parameters obtained by training, encoding model prediction output, embedding the encoded model prediction output into a Merkle tree structure, and completing recording on a block chain through an intelligent contract; and for a to-be-evaluated artificial intelligence model, calling the global root hash value on the block chain for verification. According to the invention, the whole process of the artificial intelligence model from data acquisition to reasoning output is verifiable, traceable and tamper-proof.

The invention is suitable for the technical field of vulnerability security management, and provides a full-life-cycle vulnerability security management method and system, and the method comprises the steps: recognizing potential security vulnerabilities in a system based on active scanning and passive monitoring; preprocessing the related data of the identified potential security vulnerabilities, inputting the preprocessed data into a trained Transform model, extracting features by using a self-attention mechanism, and predicting from a time sequence, an affected asset type and a vulnerability type to obtain a vulnerability prediction report; formulating a vulnerability repair strategy based on the vulnerability prediction report, and then performing repair according to the formulated strategy; the repaired vulnerability is verified by combining an automatic tool and manual confirmation, a comprehensive vulnerability prevention and management strategy is generated, full life cycle management from vulnerability discovery, prediction and repair to subsequent prevention is covered, and vulnerability analysis accuracy and vulnerability repair efficiency are effectively improved.

The invention discloses an open source vulnerability analysis method. The method comprises the steps of generating a security vulnerability knowledge graph of a to-be-analyzed software product; the security vulnerability knowledge graph comprises vulnerability nodes, software nodes of the to-be-analyzed software product, a calling relationship between the to-be-analyzed software product and open source software, and a dependency relationship between the open source software; the calling relationship comprises a calling relationship between functions in the software code; scanning a reachable path from the vulnerability node to the software node in the security vulnerability knowledge graph based on a graph search algorithm; and generating a vulnerability analysis result based on the scanning condition. Open source vulnerability analysis is carried out through the security vulnerability knowledge graph, and the technical problems of low vulnerability investigation efficiency and high investigation cost caused by the phenomenon that propagation paths between dependency levels of open source software cannot be identified and vulnerability analysis has false alarms can be solved.

The invention relates to the technical field of computer network security, in particular to a computer network information security management method and system, which comprises the following steps: S1, risk assessment, S2, security policy making, S3, security protection measure implementation, S4, management measure implementation, S5, security training and propaganda, S6, emergency response, and S7, accident handling and asset identification: comprehensively carding network assets in an enterprise or an organization, comprise hardware equipment, software systems, network services, data and the like, and the importance and value are determined. According to the computer network information security management method and system, through an information security management method, such as a data encryption technology, the data can be converted into a ciphertext form for storage and transmission, and only an authorized officer with a correct key can decrypt and restore the data into original data; therefore, abnormal user access behaviors and potential security holes can be found in time, a basis is provided for improving security measures, and the situation that a database is stolen or leaked in the data transmission process is effectively prevented.

Techniques are described for techniques for an actionable artificial intelligence bot based on data security correlations. An example method comprises determining, by a data platform implemented by a computing system, a plurality of tags for a snapshot executed by the data platform, detecting, by the data platform, an indication of a security breach relating to the snapshot, processing, by the data platform and using a machine learning model, a plurality of attributes of the security breach and the plurality of tags to identify a potential compromise of the snapshot, processing, by the data platform and using a large language model, at least the plurality of attributes to generate an actionable prompt including a natural language description of at least one security response, and outputting, by the data platform, the actionable prompt.

The invention relates to the technical field of information security, and particularly discloses an information security protection method and system applied to an electronic information platform, and the method comprises the steps: collecting information data, evaluating the reliability of a data source based on a Bayesian network model, analyzing the structural integrity of the information data through an auto-encoder algorithm, and calculating a comprehensive accuracy coefficient; based on an accuracy evaluation result, extracting a data exception rate and an access exception frequency, training a decision tree model in combination with historical data, establishing a risk prediction model, and dynamically calculating a risk coefficient; according to the real-time change of the risk coefficient, generating defense strategies such as data correction, access control, flow limitation and high-risk operation isolation, and re-evaluating the risk coefficient and data accuracy of the platform after execution; potential risks can be identified, various security threats can be flexibly handled, data loss and security vulnerabilities are reduced, and the stability and the anti-risk capability of an electronic information platform are improved.

Systems and methods for providing user-induced variable identification of end-to-end computing system security impact information via a user interface are disclosed. The system receives at a graphical user interface (GUI), a user calibration of a graphical security vulnerability element. The system then determines a set of computing system components that interact with data associated with the network operation based on a transmission of the network operation associated with a computing system. The system then determines a set of security vulnerabilities associated with each computing system component of the set of computing system components using a third-party resource. The system then applies a decision engine on the set of security vulnerabilities to determine a set of impacted computing-aspects associated with the set of computing system components. The system then generates for display a graphical representation of the set of impacted computing-aspects satisfying the security condition of the user calibration.

The invention discloses a large visual language model vulnerability detection method and device based on security sensitive layer activation guidance and a storage medium, and belongs to the technical field of artificial intelligence security, the method comprises the following steps: S1, constructing a security sensitive layer activation induction sample data set; s2, performing quantitative analysis on activation differences of the model intermediate layer under attack and normal input; s3, on the basis of the recognized security sensitive layer combination and an output layer of the large visual language model, generating an in-process confrontation image with an attack attribute through optimization of a loss function; and S4, recording an optimal security sensitive layer combination and a harmful response path guided by the optimal security sensitive layer combination, and constructing a structured representation of the potential security vulnerabilities of the model. According to the method, the security fragile links of the model are accurately positioned, the attack guiding force is improved in combination with multiple losses, the generated confrontation disturbance is controllable and imperceptible, the good cross-instruction migration capability is achieved, and the method adapts to various security assessment and red team test tasks.

The invention discloses a code generation method and device based on a large model, equipment, a medium and a product, and the method comprises the steps: carrying out the code generation through a first code large model according to target code demand data, and obtaining an initial code; according to the first code snippet, generating a test code through a second code large model to obtain a unit test code; according to the unit test code and the initial code, code repair based on editing distance regularization is conducted through a third code large model, and a to-be-analyzed code is obtained; performing iterative optimization on the to-be-analyzed code and the unit test code to obtain a target code corresponding to the target code demand data; according to the method, code generation, unit test generation and code repair are carried out in a multi-model cooperation mode, the reliability and accuracy of code generation can be effectively improved, software security vulnerabilities are reduced, and therefore the stability and security of a software system are improved.

A system and method that uses midservers located between an enterprise network and an external network to provide mass scanning network traffic detection and analysis capabilities for the enterprise network. The midserver may be loaded with configurations that allow it to operate as a mass scan event detector capable of detecting network sniffers, botnets, and malicious peer-to-peer connections which can lead to security vulnerabilities. In such configurations, midserver may receive and analyze network traffic to determine if the network traffic is suspicious based on heuristic and signature-based techniques, and then generate an appropriate response action which can be implemented to mitigate the risk.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The invention relates to the technical field of network security, and discloses a security vulnerability AI positioning method and system based on log files. The method comprises the following steps: firstly, analyzing user feedback describing open source component security vulnerabilities to extract fault key entity information, screening related log entries based on the fault key entity information, and constructing a vulnerability propagation graph; identifying a vulnerability triggering initial point set by using a graph traversal algorithm and a graph neural network, calling a component vulnerability case library to deduce a vulnerability utilization propagation chain and calculating a matching degree with a known open source component vulnerability utilization chain feature, and obtaining a maximum probability vulnerability utilization propagation chain and an associated vulnerability triggering initial point set; and generating a root cause positioning report, and updating the knowledge base or model training data according to a user verification result. According to the method, the initial vulnerability point and the complete vulnerability propagation chain of the security vulnerability of the open source component can be accurately and efficiently positioned, and the positioning accuracy and timeliness are improved.

Techniques for determining a tag for a security deficiency (e.g., a security vulnerability and / or exposure) using a generative machine learning model. In examples, a system may perform the following operations: (i) identifying a deficiency identifier associated with the security deficiency, (ii) retrieving one or more texts that correspond to the deficiency identifier, (iii) generating a prompt for a generative model to process the text(s) to detect a tag, (iv) providing the prompt to the generative machine learning model, (v) receiving the output of the machine learning model, (vi) determine whether the output satisfies one or more output constraints (e.g., one or more output constraints specified by format and / or content requirements specified in the prompt), and (vii) if the output satisfies the output constraint(s), determine the tag based on the validated output.

The invention discloses an automatic use case construction method and system for private protocol testing, and relates to the technical field of communication protocol testing. Comprising the following steps: step 1, identifying a field structure, a state conversion rule and a dependency relationship of a private protocol through traffic sniffing and deep packet analysis; step 2, dynamically generating a test case set covering a normal scene, a boundary scene and an abnormal scene based on a reinforcement learning algorithm in combination with a protocol state machine and a historical test result; and step 3, injecting the generated test flow in the simulation environment, monitoring response data of the target system in real time, calculating and adjusting an evaluation value, and adjusting a generation strategy of the test case according to the value. Through adaptive execution and multi-dimensional anomaly analysis in the simulation environment, the test strategy is adjusted in real time, logic errors, resource leakage and security vulnerabilities are accurately recognized, efficient robustness verification of the private protocol is achieved, and the test efficiency and protocol security are remarkably improved.

The invention discloses an encrypted communication method and system for a trusted execution environment, and the method comprises the steps: a client agent receives a connection request, and builds a connection with a server agent when receiving the connection request; the client agent and the server agent negotiate a session key; and the client agent adopts the session key to perform encrypted communication with the server agent so as to realize automatic encrypted transmission of out-of-domain data of the trusted execution environment. According to the method, the server agent is arranged inside the trusted execution environment, the client agent is arranged outside the trusted execution environment, session key negotiation is performed through the server agent and the client agent, and encrypted communication is performed by adopting the session key obtained through negotiation. In this way, automatic encryption transmission of the out-of-domain data of the trusted execution environment is achieved, and security vulnerabilities caused by stealing or tampering of the out-of-domain data are avoided.

The invention relates to a multi-protocol integration method and device, equipment, a storage medium and a program product, which are applied to a bastion host, and the bastion host comprises a communication port. The method comprises the following steps: firstly, receiving a first access request generated based on a first protocol and sent by each client through a communication port, then, determining target equipment needing to be accessed by each client according to the first access request, then, determining a second protocol supported by each target equipment based on preset configuration of each target equipment, and finally, sending the second protocol to the client through the communication port. And converting each first access request based on the first protocol and the second protocol, determining a second access request of each client, and accessing the corresponding target device through the second access request. By adopting the method, the number of communication ports can be reduced, so that the network attack surface is reduced, potential security holes and threats are reduced, and the access security of the target equipment is improved.