1150 results about "Security bug" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

An example operation may include one or more of monitoring communications that occur with user devices over a shared computer network, detecting a security threat from the monitored communications, generating a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on a description of the security threat and a repository of source code, installing the source code for simulating the security threat on a system associated with the computer network, and executing the source code for simulating the security threat via the system.

Described herein are systems and methods for identifying security vulnerabilities. The systems and methods herein can utilize security vulnerability information to identify potential security threats and can utilize this information to generate an attack using a machine learning model, such as a large language model. Generated attacks can be carried out to assess impact of a security vulnerability. An output can be provided that represents the assessed impact. In some implementations, the systems and methods herein generate patches or other mitigations for security vulnerabilities, which can be tested and deployed to address security vulnerabilities.

The invention provides an intelligent vulnerability mining platform construction method and system based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code snippets with the security risks, arranges the code snippets into risk code paragraphs, identifies target code paragraphs, determines known vulnerabilities, generates context information, captures key events in actual operation, and records real execution paths and state changes. The method comprises the steps of generating a dynamic execution track, simulating different paths, generating an attack vector path, predicting unknown vulnerabilities and credibility scores of the unknown vulnerabilities, testing prediction results of high-credibility scores, confirming and generating real vulnerability information, recording the information to a vulnerability knowledge base, and generating a security report containing vulnerability description, influence ranges, risk levels and repair suggestions. According to the technical scheme provided by the embodiment of the invention, the detection accuracy and efficiency of the security vulnerabilities in the software system are improved.

A behavior analytics method for detecting and preventing different types of API based threats and attacks is disclosed. The method includes collecting request and response data of API calls from plurality of user sessions and storing it in a data lake. The method further includes extracting and combining features of the collected request and response data. The features may be associated with login behavior, API request content and behavior, API object accessing content and behavior, and API response content and behavior. The method also includes encoding the combined features via a neural network model to create a behavior fingerprint of each of the user sessions. Also, the method includes clustering the created behavior fingerprint to detect normal or abnormal user behavior. Thereafter, the method includes reporting the detected abnormal user behavior.

The invention relates to the technical field of information security, in particular to an archive electronic information security system which comprises an archive operation behavior prediction module, an archive data encryption and security storage module, an archive security protection strategy execution module and an archive resource scheduling and security monitoring module. According to the method, through time series data analysis, potential risk behaviors can be recognized in advance, illegal access and abnormal operation can be prevented, losses caused by human errors or malicious behaviors are reduced, data integrity and confidentiality are guaranteed, archive data are stored in blocks, encryption is carried out according to sensitivity and access frequency, and the security of the archive data is improved. Multi-factor identity verification is executed, the flexibility and accuracy of protection measures are enhanced, security vulnerabilities are reduced, priority protection of sensitive archives is ensured through real-time monitoring and resource scheduling optimization, resource waste and risk exposure are avoided, and the security of the sensitive archives is improved. And the overall safety protection capability of archive management in a complex threat environment is improved by collaborative measures.

The invention relates to the technical field of computer security, and discloses a computer remote login identification device based on artificial intelligence, which comprises a user side device module used for collecting biological identification data and input behavior data of a user; the authentication and verification module is used for executing multi-mode identity authentication and dynamically adjusting an authentication strategy; the behavior analysis and risk assessment module is used for analyzing a behavior mode and a login environment of the user; the database and storage module is used for storing user identity information, behavior characteristic data and authentication logs; and the security monitoring and alarming module is used for monitoring the login activity of the user in real time and detecting potential security threats. According to the invention, the design based on multi-modal authentication greatly improves the security of remote login. By combining a plurality of authentication means such as face recognition, fingerprint recognition and voice recognition, the system can effectively prevent security vulnerabilities such as password stealing, fingerprint counterfeiting or facial image attack.

A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.

The invention provides an SCA and SAST combined vulnerability reachable path detection method and device. The method comprises the steps of obtaining a to-be-detected item; extracting an entry function based on the to-be-detected item; when the to-be-detected item is a source code item or a product item, generating a function call graph based on call graph generation logic corresponding to the source code item or call graph generation logic corresponding to the product item; identifying a vulnerability function in the dependent component of the item to be detected through a software component analysis tool based on preset software bill of material information; taking the vulnerability function as a starting point, performing depth-first search traversal in the function call graph, and detecting whether an entry function is traversed or not; and if yes, determining a path from the entry function to the vulnerability function as a vulnerability reachable path. According to the method and the device, the reachable path of the vulnerability can be automatically detected, so that whether the security vulnerability is triggered or not is determined, invalid checking of the SCA tool in the use process can be avoided, and the reliability of the SCA tool is improved.

The invention discloses a network security vulnerability identification and repair method and system, a medium and a program product, and the method comprises the steps: segmenting a system behavior sequence into a plurality of subsequences; constructing a behavior dependency graph; calculating functional similarity, and dividing the functional similarity into node clusters; calculating a behavior consistency score, and determining a potential vulnerability region; determining call chain information; constructing a vulnerability propagation path, and calculating criticality; dividing first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the criticality; determining a repair priority, and generating a vulnerability report; according to the vulnerability types, the repair priorities and the propagation path information, corresponding repair strategies are sequentially matched from a preset repair template library according to the sequence of the repair priorities; and performing hierarchical repair on the application code based on the repair strategy obtained by matching to obtain a repair code, and deploying the repair code to the target system. According to the invention, the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

The invention relates to the technical field of data security, in particular to a financial data security management system and method, and the system comprises a data monitoring module, a vulnerability prediction module, a dynamic isolation module, a behavior analysis module and a security response module. According to the invention, through deep monitoring and analysis of financial data, the capability of identifying and processing abnormal operation is improved, so that the data security is enhanced, and through real-time collection of financial transaction and account behavior data and detailed analysis of fund flow frequency and account access frequency, risks are effectively identified and potential security vulnerabilities are predicted. By dynamically analyzing the association between the transaction node and the risk event, evaluating the risk level and automatically adjusting the data storage position and the access authority according to the risk evaluation, the security of the data in the transmission and storage process is remarkably improved, in addition, by monitoring the behavior mode change of the isolated account, the abnormal activity is further identified and corrected, and the safety of the data transmission and storage process is improved. And the overall safety and stability of the financial data environment are ensured.

The invention discloses a multi-agent automatic penetration testing system fusing a large model and reinforcement learning, and relates to the technical field of network security, and the system comprises the steps: starting a mixed multi-agent automatic penetration testing process combined with the large model through inputting a URL (Uniform Resource Locator); multi-agent joint action is carried out to comprehensively collect and classify website information; multiple agents execute vulnerability mining in parallel, and a result is fed back to perform deep reinforcement learning optimization; the multi-agent formulates a specific utilization scheme for the mined vulnerabilities; the potential vulnerabilities are subjected to validity verification through multi-agent cooperation, results are recycled, and the decision accuracy is gradually improved through a deep learning feedback mechanism; the multi-agent generates a safety report according to a module result, and feeds back the safety report to the related agent to enhance the deep learning performance and improve the decision effectiveness. According to the method, large model analysis and reasoning capabilities are integrated, multi-agent collaborative scheduling is realized, automatic security scanning is executed on a target website, and potential security vulnerabilities are effectively detected and evaluated.

The invention discloses a security risk assessment system and method based on the Internet of Things, and relates to the technical field of digital information transmission. According to the security risk assessment method based on the Internet of Things, whether hardware equipment can work normally or not is judged, and if the hardware equipment cannot work normally, early warning prompt is carried out; if the hardware equipment can work normally, evaluating the vulnerability degree of the Internet of Things platform; according to the method, the security risk of the Internet of Things platform is evaluated, the security risk level is obtained, and equipment faults and potential security vulnerabilities are found in time through systematic hardware and software evaluation. By judging the normal working state of hardware equipment, early warning can be effectively carried out, occurrence of security events can be reduced, and the vulnerability degree, the recovery capability and the data security of the platform can be comprehensively known, so that scientific risk level assessment is provided for enterprises, the enterprises are helped to formulate corresponding security measures and optimization strategies, security risks are effectively reduced, and the safety of the enterprises is improved. And the user data and privacy are protected.

An end-to-end approach for (i) identifying potential vulnerabilities in software applications, including security vulnerabilities, (ii) verifying / confirming the potential vulnerabilities as actual vulnerabilities and (iii) in response, identifying the necessary remedial actions necessary to eliminate or at least mitigate the vulnerabilities. An intelligent agent is implemented that is configured to detect a change to the application's code or computing environment and, as a result of detection of changes to the code or computing environment, identify potential vulnerabilities, verify / confirm the potential vulnerabilities as actual vulnerabilities through determination / creation of vulnerability test cases and automatically identify the necessary remedial actions necessary to eliminate or mitigate the vulnerabilities.

The invention is applicable to the technical field of vulnerability detection, and provides a power system software security vulnerability dynamic and static combined detection method, which comprises the following steps: acquiring static source code data of power system software and dynamic behavior log data during operation; generating a hierarchical abstract syntax tree and structured time series data; performing multi-dimensional feature extraction on the static source code data and the dynamic behavior log data based on a vulnerability knowledge graph of the power system; generating a domain constraint confrontation sample based on the power protocol features and the abnormal features during operation, and inputting the domain constraint confrontation sample into the constructed hybrid detection model for confrontation training to obtain a trained hybrid detection model; and performing automatic detection on the power system software by utilizing the trained hybrid detection model, and outputting a detection result containing a static code defect position and a dynamic attack path. The full-life-cycle accurate detection of the software vulnerability of the power system is realized, and the network security protection capability of the power system is improved.

The invention discloses a password security enhancement method based on secret communication, and particularly relates to the technical field of password security. Transmission and information negotiation of a quantum state are realized by constructing a quantum communication channel and a classical communication channel; after the photons are coded and transmitted, the time delay condition of the photons is analyzed, if the delay is abnormal, a pulse light source simulates photon signals, the trigger probability of the detector is recorded, the time window deviation is judged, delay data and the trigger probability deviation are comprehensively evaluated, the security vulnerability risk caused by non-ideality of the photon detector is quantified, and the security vulnerability risk is evaluated. The method comprises the steps of dividing risks into a high level, a middle level and a low level, implementing corresponding management, dynamically adjusting a compression ratio of privacy amplification by utilizing fuzzy logic according to the middle risk level in combination with a preliminary key bit error rate and a detector risk value, strengthening the anti-eavesdropping capability of a key, and improving the security of a quantum key distribution system through real-time monitoring and dynamic adjustment. The time migration attack is defended, and the long-term security of encrypted communication is guaranteed.

The invention relates to the technical field of computers, in particular to an open source component security vulnerability processing method and system.The open source component information and vulnerability information are collected from a project code warehouse and a vulnerability disclosure platform and subjected to standardization processing, multi-dimensional atlas generation and cross correlation analysis, and a dependency graph is generated and dynamically optimized; a distributed Bayesian reasoning and co-evolution model is used for carrying out multi-level data fusion analysis, finally, future vulnerability outbreak is predicted through a space-time regression model and a cross-dimension joint prediction model, and a staged preventive repair strategy is formulated and executed. According to the method, the accuracy and timeliness of vulnerability processing are remarkably improved, and the security risk is effectively reduced.

The invention discloses a streaming knowledge injection and adversarial self-optimization large language model training method and system, and the method comprises the steps: collecting the newest knowledge of an authoritative information source in real time, converting the newest knowledge into a structured constraint rule through a semantic analyzer, and dynamically updating a knowledge base; based on the updated knowledge base, adopting a PPO algorithm to optimize a generator, actively constructing a high-risk adversarial sample, and forcing the model to expose security vulnerabilities; after user input and adversarial samples are input into the model, total loss is calculated through constraint detection, gradient updating is blocked if the total loss exceeds a threshold value, and otherwise, a multi-level safety verification stage is started; and finally, fusing a security verification result and the adversarial loss, updating a total loss function and cooperatively adjusting model parameters to form a continuous self-optimization training cycle. According to the method, compliance is guaranteed through streaming knowledge injection, vulnerabilities are actively mined in combination with adversarial training, verification precision is improved by means of multi-level detection and dynamic threshold adjustment, and safety and reliability of a large language model in a complex scene are enhanced.

The invention discloses a quadruple port hiding method and device based on a zero-trust architecture, and belongs to the field of computer network security. The quadruple port hiding method comprises a first door knocking operation and a terminal trust evaluation method based on a space-time matrix fusion multi-factor model; performing multiple identity authentication based on trust; knocking a door at a tunnel port; and knocking the service port. According to the invention, a quadruple-port hidden zero-trust access control scheme is adopted, and door knocking is carried out on a zero-trust security management platform, an identity authentication port, a VPN tunnel port in an SDP gateway and a service port, so that comprehensive protection enhancement of user access and service is realized. According to the invention, an additional security layer is added through a quadruple port hiding technology, so that an attacker is difficult to find an effective attack entry point easily; and meanwhile, more refined access control can be realized based on a trust identity authentication mechanism, and a complex network environment can be adapted, so that security vulnerabilities existing in a traditional SPA mechanism are avoided.

The invention discloses a network risk assessment model construction method and device, equipment and a storage medium, and the method comprises the steps: collecting information data, and carrying out the preprocessing of the information data; setting a topological weight strategy, a service weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data; and constructing a risk assessment mechanism according to the topological weight strategy, the service weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and finally forming a network risk assessment model. The network risk assessment model construction method can solve the problems that an information network platform has security vulnerabilities and threats, a network security assessment mechanism is imperfect and the information network platform is difficult to adapt to a rapidly changing network security environment, and has the characteristics of convenience in implementation, high accuracy, high usability and relatively high migration and generalization capabilities.

Security vulnerability analysis may be performed using policy inference. Application code may have operations that are labeled according to the respective functions that they perform. Some operations may be labeled according to a knowledge database of known operations while others may be inferred through similarity to known operations. The knowledge database may be associated with libraries of programmatic interfaces. Once components of the application code are labeled, a vulnerability database may be that identifies potential vulnerabilities based on data sources, data sinks and threat mitigation operations. Using the labeled operations, one or more potential vulnerabilities may be identified based on labeled data sources and data sinks. The application may then be evaluated for potential security threats based on the identified potential vulnerabilities.

The invention provides an operating system kernel fuzz testing method, device and equipment, and relates to the technical field of kernel fuzz testing. The method comprises the following steps: acquiring initial input, and splitting the initial input to generate an input set; performing a fuzzy test on the input set and obtaining a fuzzy test result; storing the fuzzy test result into a key component inference file to generate a key component inference table; and generating a seed selection strategy in the seed bank in combination with the key component inference table so as to guide seed variation selection. By identifying and utilizing key components in a system calling sequence, the coverage rate of the fuzzy test is improved. And establishing a corresponding relationship between the key component in the system call sequence and the basic block of the corresponding path, so as to better mine potential security vulnerabilities. Different variation strategies are executed according to selection of variation points, so that an existing fuzzy testing method is effectively improved, and the vulnerability mining efficiency and quality are improved.

An industrial security system leverages generative artificial intelligence (AI) to automate the process of identifying software or hardware insecurities on industrial assets, generate recommendations for mitigating these vulnerabilities, and, where appropriate, deploy countermeasures to the vulnerable assets. By leveraging automated asset discovery, real-time asset and network monitoring, and generative AI-assisted vulnerability detection and remediation, the system can reduce the amount of time spent by security administrators in identifying and closing security vulnerabilities within their plant environments, and can alert administrators of potential security issues before those issues become critical.

The invention discloses a big language model security vulnerability test method and device based on a genetic algorithm and attention distribution, and a medium. The method comprises the following steps: selecting an AdvBench data set as a vulnerability test problem; performing malicious vocabulary extraction and lexical element decomposition on a test problem sample in the AdvBench data set; randomly selecting a plurality of lexical elements as an initial population, and calculating and amplifying attention scores corresponding to the selected lexical elements; performing coding flipping on the initial population according to the mutation probability so as to optimize the population; inputting a test problem corresponding to the optimized population into a large language model, and judging model response; when the model response is refusal, determining that the large language model does not have security vulnerabilities; and when the model response is compliant, determining that the large language model has security vulnerabilities.

According to a present invention embodiment, software is analyzed for security vulnerabilities. Information from a security scan of code is analyzed to identify a security issue pertaining to a code portion. A machine learning model determines an initial risk factor score for the security issue based on a history of information pertaining to one or more prior security scans. The initial risk factor score is refined to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score. The initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion. A classification of the security issue is determined as one of a valid security issue and a false positive based on the overall risk factor score.

The invention discloses a database security secrecy system based on storage encryption, and relates to the technical field of information security. The database encryption platform is in communication connection with a key management module, an encryption and decryption management module, a performance monitoring module, a load evaluation module, a distributed storage optimization module, an early warning analysis module and an audit log module. According to the system, the early warning analysis module is combined with burden evaluation and security vulnerability detection of encryption and decryption performance, the abnormal degree of encryption and decryption processes is comprehensively analyzed, the early warning level is set, potential abnormal conditions are analyzed, and early warning information is sent out, so that a system administrator can respond in time, and the system safety is improved. A preposed risk management strategy enables a system administrator to take corresponding countermeasures before the risk actually occurs, thereby effectively reducing the influence of security threats, and meanwhile, according to different early warning levels, the countermeasures can be flexibly adjusted, and reasonable allocation of resources is ensured.

Disclosed are systems and methods for identifying prompts that cause a machine learning model to generate insecure code. A secure prompt that generates similar code, but without the security vulnerability, is proposed instead. In some configurations, a table of insecure prompts and corresponding secure prompts is pre-computed. Insecure prompts are generated by asking a code generation model for prompts that could have generated a piece of insecure code. A security analyzer confirms which of these potentially vulnerable prompts actually generate insecure code. A secure alternative to a potentially vulnerable prompt is create by asking the code generation model to identify a security vulnerability that an insecure prompt could generate. The code generation model is then asked to rewrite the potentially vulnerable prompt to not generate the security vulnerability. When an insecure user-supplied prompt is received, the table of insecure prompts is consulted to propose a secure alternative.

The invention discloses an intelligent contract code data dependency analysis method and system based on large language model driving. According to the system, intelligent contract codes are input into a static code analysis unit and a large language model processing unit, data dependency relationships are generated respectively, then results of the static code analysis unit and the large language model processing unit are merged through a code analysis result merging unit, and the static code analysis unit is driven to perform enhanced security vulnerability detection. According to the method, the semantic comprehension capability of a large language model is utilized, and a traditional static analysis technology is combined, so that the accuracy of data dependence analysis is effectively improved, and missing report and false report are reduced. The system is suitable for the field of security analysis and vulnerability detection of the smart contract, and particularly has a wide application prospect in a block chain application scene.

The invention discloses a security access control method and system oriented to DNS (Domain Name Server) analysis, and relates to the technical field of network security, and the method comprises the steps: collecting DNS data, carrying out the preprocessing, and calculating the dynamic spectrum intensity based on the preprocessed DNS data; calculating the threat degree based on the dynamic spectrum intensity, constructing a long-short-term memory network model, predicting the future threat degree, and drawing a threat degree trend curve; and constructing a visual interface to display a threat degree trend curve, and storing, collecting and analyzing the generated DNS data. A dimension reduction feature matrix is generated through a multi-scale embedding technology and a nonlinear dimension reduction method, rapid detection and protection of potential network threats are achieved, the capability of preventing potential network attacks is improved, the threat degree is calculated in combination with nonlinear dynamic weighting, the sensitivity to complex attack behaviors is enhanced, the recognition precision of DNS traffic abnormal behaviors is improved, and the method is suitable for popularization and application. And the occurrence probability of security vulnerabilities is reduced.

The invention discloses a model testing method and device. A plurality of risk queries of an initial model are obtained, each risk query is split to obtain a query group, the query group comprises a plurality of sub-queries, the initial model is trained based on the query group to obtain a red team model, and a to-be-tested model is tested through the red team model. Therefore, a single round of query is divided into multiple rounds of query, so that a security protection mechanism of the to-be-tested model is bypassed, security vulnerabilities of the to-be-tested model are mined and exposed, and the effectiveness of model testing is improved.