1624 results about "Security policy" patented technology

The invention relates to the technical field of data security management, in particular to a self-adaptive data security management and risk early warning system based on intelligent analysis under a cloud platform. Comprising a multi-dimensional data acquisition module; an intelligent analysis module; a self-adaptive strategy generation module; a risk early warning module; and a user behavior portrait construction module. In the design, the security policy can be dynamically adjusted along with the risk situation of the cloud platform, the problem that a static policy cannot adapt to real-time change is solved, and dynamic mapping of risk characteristics-policy parameters is realized; according to the design, the one-sidedness of single-dimension analysis is broken through, multi-modal feature association modeling of user behaviors is achieved, an abnormal behavior triggering threshold value is accurately recognized, and the integrity and accuracy of risk feature analysis are improved; the security policy can be continuously optimized through historical event data, so that protection efficiency attenuation caused by long-term static operation is avoided, and an autonomous lifting link of data driving, algorithm optimization and policy evolution is realized.

The invention discloses a security risk autonomous sensing system and method based on a digital twin industrial control network. The method comprises the following steps: performing four-dimensional multi-modal modeling on an industrial control network, and constructing a twin model integrating entities, rules, services and behaviors; constructing a high-fidelity simulation network by utilizing a containerization technology based on the model; deploying a gateway at an actual network boundary, collecting traffic characteristics in real time and identifying suspicious behaviors; performing protocol restoration and behavior reconstruction on the suspicious traffic to generate a behavior sequence; performing anomaly recognition and attack classification on the behavior sequence through a deep learning model; evaluating a risk level; and matching and verifying a defense strategy according to an evaluation result, and automatically synchronizing the defense strategy to a master control network to realize a detection-response-protection closed loop. According to the invention, autonomous identification of suspicious behaviors in the industrial control network and intelligent decision-making of security policies are realized, and the method has the advantages of high simulation, low invasion, closed-loop controllability and the like.

The invention provides an enterprise employee behavior analysis and safety risk early warning monitoring method and system, and relates to the technical field of enterprise risk management, and the method comprises the steps: collecting employee terminal operation behavior data, building an activity thermal distribution diagram based on office area grid behavior association intensity, and training a behavior evaluation model. And inputting the behavior scoring matrix into a deep neural network to extract target behavior characteristics, calculating an abnormal behavior risk weight coefficient in combination with a department security policy, performing classification and analyzing a risk diffusion probability, and generating a risk situation index to determine an early warning level. Starting a response strategy according to the early warning level, blocking high-risk early warning in real time, tracking associated accounts, establishing a risk association map, identifying potential risk propagation nodes and performing active protection, finally generating an early warning report and feeding back effective protection rules to a behavior baseline model, and realizing continuous optimization of a risk early warning mechanism. And the accuracy and effectiveness of safety risk early warning in the enterprise are improved.

The invention relates to a network information security protection method and system based on artificial intelligence dynamic defense. The method comprises the following steps: constructing a multi-level security policy library containing basic defense, scene defense and emergency response based on preprocessed network data features (including protocol features, behavior sequences and abnormal indexes); then, combining real-time threat intelligence and a network environment state, and utilizing a strategy combination optimization algorithm to generate a weight matrix reflecting strategy priorities and dependency relationships; dynamically extracting and fusing various defense strategies from a strategy library according to the weight matrix to form a customized defense scheme; and eliminating resource competition and logic contradiction between strategies through a conflict detection mechanism, and finally deploying a conflict-free optimization scheme to a target node. By adopting the method, collaborative deployment of multi-dimensional security policies can be realized, and the accuracy and real-time performance of security protection in a complex network environment are remarkably improved.

A federated mining method for multimodal data based on multiple security policies includes: a federated learning framework is used as a data mining model for distributed data mining; a multiple authentication mechanism is designed; a local edge node is selected to participate in a federated computation to obtain authenticated local edge node and aggregate a dataset; a multimodal data fusion and a multimodal data classification are performed on the dataset by a generalized multimodal data feature fusion model based on a multi-headed attention mechanism; and an adaptive perturbation mechanism based on cyclic correlation analysis and differential privacy is designed to add noise round by round and dynamically. A federated mining method for multimodal data is further provided.

The invention relates to the technical field of financial data security, and discloses an intelligent ERP financial system data security management and authentication method. The method comprises the following steps: acquiring an original transaction data stream in an ERP system, extracting key financial fields, and dividing the key financial fields into a sensitive data set and a common data set according to a preset rule; a dynamic encryption strategy framework is constructed based on sensitive data set attributes, the framework comprises multiple levels of encryption strength parameters, and the corresponding encryption strength can be automatically matched according to the authentication level of an access request. And monitoring a system data access behavior in real time, collecting feature data, inputting the feature data into the anomaly detection model, and triggering access blocking when an output anomaly access probability exceeds a threshold value. And generating a periodic integrity verification instruction according to the sensitive data updating frequency, performing integrity verification by using a hash chain technology, recording a result and marking a tampering risk level. And based on the association relationship between the tampering risk level and the abnormal access probability, generating an updated security policy and synchronizing the updated security policy to each data access node.

The invention discloses a cross-domain computing task processing method, a program product, equipment and a medium, and relates to the technical field of cloud computing. The method comprises the following steps: determining a computing node for executing a cross-domain computing task in a cross-domain collaborative scene, and generating an identity certificate bound with the computing node based on a hardware credible state of the node; collecting security policies of a plurality of management domains for conflict detection and decision, and generating a conflict-free session policy; scheduling the cross-domain computing task to a target computing node meeting a preset credible requirement, and issuing a revocable dynamic session token; and recording the operation information of the cross-domain calculation task in the whole life cycle as an audit event, and generating a chained audit log which is linked by the hash value and is digitally signed through a preset verifiable audit interface. By means of the technical scheme, it can be ensured that the whole life cycle of any computing task meets the closed-loop safety requirements of identity credibility, permission controllability, execution propriability and behavior traceability in the complex distributed computing environment.

The present disclosure provides a system for secure compute using artificial intelligence agents. The system includes a hardware execution environment with one or more computerized processors and electronic storage media. The processors are configured to establish a secure agent comprising a secure state management module, an encrypted state transition management module, a threshold cryptography implementation, and a digital signature verification module. The system also includes a plurality of atomic agents, each configured to perform a composite task and comprising a task-specific execution module, a state management interface, and a communication module. An orchestrator agent coordinates secure execution of the atomic agents and includes a task distribution module, a result aggregation module, a workflow management module, and a security policy enforcement module. The orchestrator agent integrates encrypted outputs from the atomic agents to perform composite tasks while maintaining data integrity and security through the secure state management module.

The invention relates to the technical field of management of the Internet of Things, and discloses a security control method and system for remote control of the Internet of Things, and the system comprises a security remote control platform, a zero-trust gateway, an authentication module, a security policy engine, edge proxy equipment and an encryption communication module. And the authentication module is used for performing identity authentication on the equipment and the user. The security policy engine dynamic access control table comprises access rule entries and associated signature information, and is issued to the edge proxy device through the zero-trust gateway. And the edge proxy device stores the dynamic access control table, verifies the signature information based on the platform public key, and performs matching and verification according to the access rule entry when receiving the control instruction. And the encryption communication module is used for performing encryption transmission on the access control table, the control instruction and the execution result. According to the invention, the whole process of remote control of the Internet of Things is dynamic, secure and credible, and the anti-attack capability and operation reliability of the system are effectively improved.

The invention relates to a graph-based network security event modeling method and system, and the method comprises the steps: obtaining topological data and security policy information of a network where network security equipment is located, and carrying out the hierarchical construction of a knowledge graph, and obtaining a multi-layer security graph; acquiring real-time monitoring data of the network security equipment, and performing graph adversarial learning association with the multilayer security graph to obtain a dynamic evolution graph sequence; obtaining alarm data of the network security device, and performing anomaly detection on the multilayer security map to obtain an anomaly propagation situation; performing security assessment construction on the dynamic evolution diagram sequence and the abnormal propagation situation to obtain an initial security assessment scheme; performing alarm identification and attack link prediction on the alarm data to obtain a link prediction result; and performing evaluation and prediction on the initial security evaluation scheme and the link prediction result to obtain a security situation evaluation strategy. According to the invention, the security condition of the current network can be evaluated more accurately.

The invention relates to the technical field of intelligent control, in particular to a dynamic encryption-based data link security management and control system and method.The dynamic encryption-based data link security management and control system comprises a dynamic encryption engine, a key management cluster, a link monitoring unit and a security policy execution array, the switching between the SM9 cryptographic algorithm and the quantum resistance NTRU algorithm is supported; the key management cluster realizes distributed key negotiation and storage through a block chain smart contract, and establishes a bidirectional authentication channel with the dynamic encryption engine; the link monitoring unit is integrated with a multi-dimensional flow probe, and continuously collects link delay jitter, data packet entropy characteristics and protocol compliance indexes; the security policy execution array is deployed at a boundary node of a data link, and is configured with a dynamic access control list and a hardware-level data purification module. Therefore, the problems of insufficient encryption algorithm resistance, significant key update delay, multi-dimensional threat sensing blind areas, dynamic strategy response delay and the like in the prior art are solved.

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

Systems and methods include discovering and classifying any of data discovered by inline cloud inspection, data stored across one or more cloud services, and data stored across one or more endpoints; continuously monitoring access to and usage of classified data, wherein the monitoring is performed in real-time and includes analyzing data access patterns, user behaviors, and application interactions; evaluating a security posture of the classified data by identifying misconfigurations, compliance violations, excessive permissions, and vulnerabilities; and enforcing one or more security policies based on the evaluated security posture.

The invention relates to the technical field of automatic deployment of cloud computing platforms, in particular to a self-adaptive deployment method and system oriented to a credential heterogeneous environment. Aiming at three technical bottlenecks of low multi-CPU architecture adaptation efficiency, frequent software dependence conflicts and complex security baseline configuration in a localization process, a heterogeneous computing resource intelligent scheduling engine and a dynamic security policy generation mechanism are innovatively provided. The method comprises the following steps: constructing a heterogeneous resource portrait through a hardware feature automatic identification technology, and realizing component installation sequence optimization based on a DAG dependency relationship analysis algorithm and Kahn topological sorting; and creating an adaptive network security policy, and sensing the firewall state of the target system in real time through a probe. Compared with a traditional deployment mode, the method supports cross-architecture compatibility, solves the problem of dependency conflicts, improves deployment efficiency, and guarantees consistency and safety of the system.

The invention discloses a network / security equipment security policy generation and evaluation method and system based on a large language model, and the method comprises the steps: carrying out the fine adjustment of a base model through employing a threat research and judgment data set and a policy generation data set, and obtaining a threat research and judgment LLM and a policy generation LLM; a threat research and judgment LLM performs threat research and judgment on the received abnormal log output by the log acquisition module, and outputs a threat information tetrad; the policy generation LLM generates an equipment security policy by calling a knowledge base Agent according to a threat information quadruple output by the threat research and judgment LLM; and the policy generation LLM call evaluation Agent evaluates the equipment security policy from three aspects of policy correctness evaluation, policy validity evaluation and policy suitability evaluation. According to the invention, the effectiveness and reliability of the equipment security policy are improved.

The invention relates to an industrial control system security policy adaptive configuration method and device and a readable storage medium. According to the method, a control instruction stream, a process variable sampling value and link layer message metadata are synchronously collected, an association hypergraph fusing network semantics, control semantics and physical semantics is constructed to represent a system state, and a sampling period is divided into a plurality of time slots with fixed lengths. In each time slot, self-supervised learning is utilized to extract a topology embedded vector group, and a system operation rule is represented. A robustness envelope interval is generated by calculating a statistical distance between a current time slot and a historical baseline, and is used for driving a reinforcement learning model to generate a security policy parameter set. And executing corresponding access control, traffic shaping and integrity verification operations in the next time slot, generating receipt vector feedback model update according to an execution result, outputting a micro-policy patch with a hash signature and a timestamp, and sending the micro-policy patch to the edge security gateway to realize deployment, thereby realizing closed-loop adaptive optimization of the security policy in the dynamic environment.

Systems, methods, and devices to detect unauthorized third-party connections within a network infrastructure, such as by analyzing network traffic data using fuzzy matching and machine learning techniques. One aspect includes receiving network traffic data comprising records of communication events involving network identifiers, determining communication relationships between network entities identified by the network identifiers, accessing entity identifiers associated with known third-party systems, and determining associations between the network identifiers and the entity identifiers using a fuzzy matching process. Other aspects include identifying communication relationships involving the third-party systems based on the associations and detecting unregistered or unknown third-party connections within the network infrastructure. Further aspects include normalizing identifiers, computing string similarity metrics, assigning confidence scores, incorporating external data sources, building network association patterns, comparing current patterns to baseline patterns to detect anomalies, and updating security policies or firewall rules in response to detected anomalies. Additional aspects are provided.

The invention relates to the technical field of safety management and risk prediction, in particular to an intelligent safety management and risk prediction method and system based on cloud computing. The method comprises the following steps: dynamically accessing multi-source heterogeneous data through a cloud platform, and forming unified event representation through time alignment and credibility labeling; constructing a hierarchical mixed probability safety twin model, updating dynamic parameters by adopting credibility weighted online variational Bayesian, and outputting a state interface by combining structural adaptation, cross-object graph regularization and physical constraint projection; mapping the twinborn state into a causal feature, constructing an intervening causal graph, generating causal embedding by using a credibility weighted attention network, simulating an intervention operation in an embedding space, and quantifying a risk probability; and generating a multi-candidate security policy, evaluating and sorting through a multi-objective utility function, executing an optimal policy, collecting feedback data, and updating the model and the policy. According to the method, credibility regulation and control, probability twinning and causal intervention are fused, and real-time intelligent decision making of an industrial safety scene is supported.

The invention relates to the technical field of edge device security policy deployment, in particular to an edge device-oriented lightweight AI security policy adaptive deployment method. The method comprises the following steps: collecting operation state information of edge equipment, and constructing a current multi-dimensional environment vector and a sliding window feature vector; constructing a strategy candidate library, constructing a strategy adaptability scoring function based on the current multi-dimensional environment vector and a real-time perceived network threat event, and scoring and sorting all candidate strategy items to obtain a strategy execution candidate set; and performing scheduling optimization on the strategy execution candidate set by adopting a multi-objective optimization algorithm, and selecting a strategy combination with the highest deployment score as a deployment result. According to the method, a multi-dimensional strategy adaptability scoring function is constructed, candidate strategy items are screened according to current network threat events and system resource conditions, a strategy screening mechanism from fixed template type configuration to resource awareness and attack scene linkage is converted, and the pertinence and accuracy of strategy deployment are improved.

The invention discloses a network space security situation awareness detection analysis system and method, and the system comprises a heterogeneous network flow feature deep extraction unit which obtains a flow feature vector through a distributed probe array and an adaptive sampling strategy; the edge computing gateway multi-dimensional threat feature mapping unit realizes feature space mapping through a multi-dimensional feature mapping matrix; the dynamic weight multi-head attention feature fusion unit fuses features by using an optimized multi-head attention mechanism; the time-space sequence security situation evolution modeling unit constructs an evolution model in combination with the time sequence and the fusion features; the security threat risk quantitative evaluation unit carries out risk quantification; and the heterogeneous security policy collaborative response unit generates a response instruction. According to the method, flow collection, feature mapping, fusion, modeling, quantification and response operation are sequentially executed based on all units of the system. According to the method, efficient perception and accurate response of the network space security situation are realized through a multi-unit cooperation and innovation model.

Techniques are described for providing a natural language network security policy assistant for allowing a network administrator to implement network security policies using natural language security policy requests. A natural language request can be received by a user and can be translated using Artificial Intelligence into one or more security policy clauses. If the natural language security policy request leads to ambiguities with regard to intended security policies, one or more clarifying questions can be generated as natural language questions and sent to the user for clarification. One or more security policies can be implemented based on the one or more security policy clauses generated in response to the natural language security policy request and / or the natural language response to the clarifying questions.

The invention discloses a market supervision data exchange platform migration and security enhancement method and system based on a credential environment, and relates to the technical field of network security. In the data migration process, the consistency and privacy protection of the data are ensured through Hash check and a multi-party security computing technology; a domestic commercial cryptographic algorithm and a quantum resistance encryption technology are introduced, so that the protection capability of the platform to existing security threats is effectively improved, and the resistance to future quantum computing threats is enhanced; an intrusion detection system and a virtual honeypot node are integrated, and a defense strategy is monitored and updated in real time in combination with a deep learning model, so that novel attack behaviors can be detected and coped with in real time; according to an intrusion detection alarm and a block chain audit result, a security policy and resource allocation are dynamically adjusted in combination with a machine learning technology, it is ensured that high-risk nodes are monitored in time, resource allocation is automatically optimized, and the resource utilization efficiency and security of the system are improved.

The invention relates to the technical field of road maintenance intelligence, and discloses a road intelligent maintenance decision-making system based on multi-dimensional evaluation and deep reinforcement learning, and the system comprises a geographic space data preprocessing module, a fuzzy TOPSI S evaluation module, a context awareness DQN strategy module, a credibility driving recommendation module, and a security strategy library module. The method comprises the following steps: generating a road health degree and a clustering label through multi-source data geographical weighted preprocessing and fuzzy TOPSI S dynamic weight evaluation; a reinforcement learning reward function is configured based on label differentiation, and a strategy space is explored in combination with noise; the confidence is verified through multiple models, a historical security policy is matched, and model optimization is driven through priority sampling injection samples. According to the method, the evaluation precision is improved through entropy weight-clustering dynamic weight, and flexible decision is realized in combination with reinforcement learning; and three-level security verification and closed-loop optimization are constructed to ensure that the risk is controllable, historical experience migration and multi-source data expansion are supported, and the cross-scene adaptive capacity is enhanced.

The invention relates to the technical field of Internet of Things, and discloses a multi-factor dynamic authentication Internet of Things network security access platform, which adopts a multi-factor authentication mechanism, combines biological characteristics, behavior characteristics and environment characteristics of equipment, performs identity verification through biological recognition, equipment fingerprints and behavior analysis, and utilizes a dynamic authentication strategy. Detecting an abnormal IP behavior and triggering a security policy by adopting a dynamic IP binding technology, combining with equipment fingerprint identification and learning and analyzing an equipment network behavior mode; a dynamic key management mechanism is adopted, and keys are automatically generated, distributed and updated according to different devices, application scenes and communication requirements; machine learning and artificial intelligence technologies are utilized to comprehensively analyze historical access data, abnormal behavior modes, environment security states and the like of equipment, and the security risk of equipment access is automatically evaluated if suspicious equipment is detected. The method has the advantage of improving the security of the Internet of Things.

Disclosed are systems, apparatuses, methods, and computer-readable media for inventory monitoring in a multi-cloud network environment. A method includes receiving user input via a controller's interface, wherein the input includes first account information granting access to a first virtual private cloud and a second virtual private cloud, both hosted by a cloud service provider (CSP). The controller queries the first and second virtual private clouds using the respective account information and the CSP's APIs to identify resources, gathering them into an inventory, and maintains a mapping of tags to the resources, associating each tag with a specific security policy. The controller forwards a first subset of tag-resource mappings to a first security gateway in the first virtual private cloud, enabling automatic application of corresponding security policies upon instantiation of tagged resources.

The invention discloses an enterprise information security management method and system based on artificial intelligence, and belongs to the technical field of information management, and the method comprises the steps: inputting original data, integrating the original data into a first behavior graph structure, and constructing an attribute vector for a user node; threat perception and behavior risk assessment are carried out through a graph learning model, and the threat probability of each edge is output; identifying and quantifying attack paths in the graph, and generating an attack path set and a path risk score set; generating a protection strategy candidate set for each path, performing evaluation to obtain a grading result of the protection strategies, and sorting the protection strategies according to the grading result; and a protection strategy is deployed, the deployment state and protection feedback are monitored, after strategy deployment is completed, the state of a deployment target is recorded, a lightweight monitoring assembly is installed on the deployment target, and deployment feedback information is collected. According to the method, potential security threats are identified in real time in a mode of combining intelligent prediction and simulation, and the security policy is dynamically adjusted according to the change of the threats.

The invention belongs to the technical field of network security, and particularly relates to an intelligent association and global situation risk monitoring method based on multi-source data, which comprises the following steps: acquiring a multi-source heterogeneous data set; the multi-source heterogeneous data set is preprocessed, and preprocessed multi-source data is obtained; obtaining an attack behavior association graph according to the multi-source data, and performing anomaly detection on the association graph by using a graph neural network to obtain an explicit attack link and a potential attack link; obtaining a network security situation dynamic graph based on the explicit attack link and the potential attack link; and generating a risk assessment report according to the network security situation dynamic graph, triggering a corresponding security policy, and performing risk monitoring according to the security policy. According to the method, the accuracy and response speed of threat detection are remarkably improved, the global network security situation awareness capability is enhanced, and an intelligent solution is provided for security protection in a complex network environment.

The invention belongs to the technical field of multi-source heterogeneous data processing and intelligent strategy self-adaption, and discloses a real-time data stream classification and security strategy self-adaption system based on an AI model, which comprises the following steps: acquiring a multi-source heterogeneous data stream, injecting five-dimensional semantic tags, complementing an implicit relationship among the tags through association reasoning, and generating a standardized enhanced data stream; the optimal AI model is matched to execute real-time data flow classification, credibility grading is carried out, and a candidate strategy set is generated through matching; matching an association rule through a rule relation graph, and combining system real-time state mirror image execution strategy influence chain rehearsal to generate a rehearsal verification strategy set; cross-domain transactions are packaged according to cross-domain transaction description specifications, and transaction execution states and physical feedback data are collected in real time through four-stage submission protocol execution; life cycle management is implemented through rule efficiency evaluation, and a rule evolution instruction and sample enhancement data are obtained by combining full-link auditing and are fed back to a preorder link to form a closed loop.

Techniques for enforcing policies on Internet of Things (IoT) device communications are disclosed. Information associated with a network communication of an IoT device is received. The received information is used to determine a device profile, including a device type, to associate with the IoT device. A recommended security policy to be applied to the IoT device by a security appliance is generated.

The invention provides a security code automatic generation method and system based on a full information theory and mechanism ambiguity, and the method comprises the steps: S1, carrying out the feature extraction of a grammar verification layer of an input demand, extracting the grammar features of a code through the topological features of an abstract syntax tree, and carrying out the formalized rule verification of the extracted grammar features; s2, constructing a semantic association model of a cross-code snippet through a semantic analysis layer, and forming a propagation path for tracking a data flow and a control flow; s3, in the pragmatic optimization layer, combining pragmatic constraints of the business scene, and generating a security policy through a dynamic utility function; and step S4, optimizing parameters and security policies of the dynamic utility function through knowledge federal evolution and a closed-loop feedback mechanism. According to the method, a deep collaboration mechanism of grammar, semantic and pragmatic three-dimensional information and a dynamic strategy generation model are reconstructed, security logic is converted from external attributes to endogenous cognitive competence, and the security, interpretability and adaptability of automatic code generation are improved.