1091 results about "Security policy" patented technology

The invention relates to the technical field of financial data security, and discloses an intelligent ERP financial system data security management and authentication method. The method comprises the following steps: acquiring an original transaction data stream in an ERP system, extracting key financial fields, and dividing the key financial fields into a sensitive data set and a common data set according to a preset rule; a dynamic encryption strategy framework is constructed based on sensitive data set attributes, the framework comprises multiple levels of encryption strength parameters, and the corresponding encryption strength can be automatically matched according to the authentication level of an access request. And monitoring a system data access behavior in real time, collecting feature data, inputting the feature data into the anomaly detection model, and triggering access blocking when an output anomaly access probability exceeds a threshold value. And generating a periodic integrity verification instruction according to the sensitive data updating frequency, performing integrity verification by using a hash chain technology, recording a result and marking a tampering risk level. And based on the association relationship between the tampering risk level and the abnormal access probability, generating an updated security policy and synchronizing the updated security policy to each data access node.

The invention discloses a cross-domain computing task processing method, a program product, equipment and a medium, and relates to the technical field of cloud computing. The method comprises the following steps: determining a computing node for executing a cross-domain computing task in a cross-domain collaborative scene, and generating an identity certificate bound with the computing node based on a hardware credible state of the node; collecting security policies of a plurality of management domains for conflict detection and decision, and generating a conflict-free session policy; scheduling the cross-domain computing task to a target computing node meeting a preset credible requirement, and issuing a revocable dynamic session token; and recording the operation information of the cross-domain calculation task in the whole life cycle as an audit event, and generating a chained audit log which is linked by the hash value and is digitally signed through a preset verifiable audit interface. By means of the technical scheme, it can be ensured that the whole life cycle of any computing task meets the closed-loop safety requirements of identity credibility, permission controllability, execution propriability and behavior traceability in the complex distributed computing environment.

The invention relates to the technical field of management of the Internet of Things, and discloses a security control method and system for remote control of the Internet of Things, and the system comprises a security remote control platform, a zero-trust gateway, an authentication module, a security policy engine, edge proxy equipment and an encryption communication module. And the authentication module is used for performing identity authentication on the equipment and the user. The security policy engine dynamic access control table comprises access rule entries and associated signature information, and is issued to the edge proxy device through the zero-trust gateway. And the edge proxy device stores the dynamic access control table, verifies the signature information based on the platform public key, and performs matching and verification according to the access rule entry when receiving the control instruction. And the encryption communication module is used for performing encryption transmission on the access control table, the control instruction and the execution result. According to the invention, the whole process of remote control of the Internet of Things is dynamic, secure and credible, and the anti-attack capability and operation reliability of the system are effectively improved.

The invention relates to a graph-based network security event modeling method and system, and the method comprises the steps: obtaining topological data and security policy information of a network where network security equipment is located, and carrying out the hierarchical construction of a knowledge graph, and obtaining a multi-layer security graph; acquiring real-time monitoring data of the network security equipment, and performing graph adversarial learning association with the multilayer security graph to obtain a dynamic evolution graph sequence; obtaining alarm data of the network security device, and performing anomaly detection on the multilayer security map to obtain an anomaly propagation situation; performing security assessment construction on the dynamic evolution diagram sequence and the abnormal propagation situation to obtain an initial security assessment scheme; performing alarm identification and attack link prediction on the alarm data to obtain a link prediction result; and performing evaluation and prediction on the initial security evaluation scheme and the link prediction result to obtain a security situation evaluation strategy. According to the invention, the security condition of the current network can be evaluated more accurately.

The invention relates to the technical field of safety management and risk prediction, in particular to an intelligent safety management and risk prediction method and system based on cloud computing. The method comprises the following steps: dynamically accessing multi-source heterogeneous data through a cloud platform, and forming unified event representation through time alignment and credibility labeling; constructing a hierarchical mixed probability safety twin model, updating dynamic parameters by adopting credibility weighted online variational Bayesian, and outputting a state interface by combining structural adaptation, cross-object graph regularization and physical constraint projection; mapping the twinborn state into a causal feature, constructing an intervening causal graph, generating causal embedding by using a credibility weighted attention network, simulating an intervention operation in an embedding space, and quantifying a risk probability; and generating a multi-candidate security policy, evaluating and sorting through a multi-objective utility function, executing an optimal policy, collecting feedback data, and updating the model and the policy. According to the method, credibility regulation and control, probability twinning and causal intervention are fused, and real-time intelligent decision making of an industrial safety scene is supported.

The invention relates to the technical field of edge device security policy deployment, in particular to an edge device-oriented lightweight AI security policy adaptive deployment method. The method comprises the following steps: collecting operation state information of edge equipment, and constructing a current multi-dimensional environment vector and a sliding window feature vector; constructing a strategy candidate library, constructing a strategy adaptability scoring function based on the current multi-dimensional environment vector and a real-time perceived network threat event, and scoring and sorting all candidate strategy items to obtain a strategy execution candidate set; and performing scheduling optimization on the strategy execution candidate set by adopting a multi-objective optimization algorithm, and selecting a strategy combination with the highest deployment score as a deployment result. According to the method, a multi-dimensional strategy adaptability scoring function is constructed, candidate strategy items are screened according to current network threat events and system resource conditions, a strategy screening mechanism from fixed template type configuration to resource awareness and attack scene linkage is converted, and the pertinence and accuracy of strategy deployment are improved.

The invention belongs to the technical field of multi-source heterogeneous data processing and intelligent strategy self-adaption, and discloses a real-time data stream classification and security strategy self-adaption system based on an AI model, which comprises the following steps: acquiring a multi-source heterogeneous data stream, injecting five-dimensional semantic tags, complementing an implicit relationship among the tags through association reasoning, and generating a standardized enhanced data stream; the optimal AI model is matched to execute real-time data flow classification, credibility grading is carried out, and a candidate strategy set is generated through matching; matching an association rule through a rule relation graph, and combining system real-time state mirror image execution strategy influence chain rehearsal to generate a rehearsal verification strategy set; cross-domain transactions are packaged according to cross-domain transaction description specifications, and transaction execution states and physical feedback data are collected in real time through four-stage submission protocol execution; life cycle management is implemented through rule efficiency evaluation, and a rule evolution instruction and sample enhancement data are obtained by combining full-link auditing and are fed back to a preorder link to form a closed loop.

The invention provides a network security policy automatic execution method and system based on an artificial intelligence large model, and relates to the technical field of network security, and the method comprises the steps: firstly obtaining a network threat chain data set comprising a threat initiating node, an intermediate propagation node, a target attacked node and propagation path description; calling a pre-trained threat chain analysis large model to carry out hierarchical disassembly and variation trend prediction, outputting a threat chain disassembly map, then extracting a matching strategy gene segment from a preset security strategy gene pool, generating candidate security strategies through model gene recombination and cross-strategy collaborative adaptation, and carrying out threat chain analysis on the candidate security strategies; inputting the candidate strategies, the current network topology and the equipment resource load data into a strategy execution deduction system, outputting an executable security strategy set adaptive to the current network state, finally issuing the executable security strategy set to network security equipment, and collecting execution feedback data for updating the threat chain analysis large model. And automatic, efficient and accurate generation and execution of the network security policy are realized.

The invention relates to the technical field of operation and maintenance safety compliance, and discloses an operation and maintenance service automation safety compliance detection system and method. The system comprises an operation and maintenance event acquisition unit, a strategy execution unit, a compliance analysis unit, a strategy optimization unit and a violation tracing unit. The operation and maintenance event acquisition unit captures operation and maintenance operation events and execution environment parameters in real time, packages the operation and maintenance operation events and the execution environment parameters into event data packets and transmits the event data packets to the strategy execution unit; the strategy execution unit extracts a reference strategy rule from the security strategy library, performs matching verification on the event and generates a result; the compliance analysis unit analyzes compliance fluctuation characteristics through a multi-dimensional compliance deviation model in combination with historical records; the strategy optimization unit dynamically adjusts the event capture frequency and corrects a strategy matching rule according to the fluctuation characteristics; the violation tracing unit counts the risk cumulant and generates a violation tracing instruction when the risk cumulant exceeds a preset capacity. According to the system, automation and dynamic adjustment of operation and maintenance safety compliance detection are realized, and a risk accumulation process can be effectively tracked.

The invention discloses a network threat knowledge automatic extraction method, electronic equipment and a storage medium, and the method comprises the following steps executed by a computer hardware system: collecting threat intelligence data related to an APT organization from a multi-source network security text, and processing the threat intelligence data to generate a standardized corpus; using the pre-training sentence vector model to generate semantic embedding for a corpus input text and a manual annotation example library text, and retrieving similar examples to construct an ICL prompt template; inputting a large language model subjected to LoRA fine tuning, and extracting structured triples of multiple types of entities and semantic relationships; generating standardized entity nodes and updated relation information by adopting semantic aggregation; and constructing an APT organization network threat intelligence knowledge graph and outputting a structured file. The method provides key technical support for APT attack tracing, threat situation awareness and automatic security policy generation.

The invention relates to an intrusion detection method based on cross-domain security management and a shared behavior model. The method comprises the following steps: acquiring multi-dimensional original data according to a preset cross-domain data acquisition rule and multi-domain node deployment; performing compliance, integrity and format matching degree verification on the original data, shielding sensitive information by using a dynamic desensitization technology based on a verification result, converting a heterogeneous data format, filtering missing field abnormal data, and obtaining compliance data; the method comprises the following steps: extracting a multi-dimensional feature set of user cross-domain access, constructing a shared behavior feature vector through weighted calculation, constructing a reference behavior model library in combination with a cross-domain security policy, and screening out intrusion behaviors and feature deviation data through feature comparison and behavior deviation calculation; according to the method, cross-domain security audit logs are fused for correlation analysis, intrusion behavior types and risk levels are judged by means of a Bayesian network model, differential security response strategies are generated and executed, and cross-domain intrusion detection and protection are achieved.

A computerized system for dynamic cybersecurity policy using AI-based contextual adaptive learning includes an AI system that evaluates business contexts, risk tolerance, and productivity impact to generate threat intelligence assessments. The system includes a Contextual Adaptive Learning module that dynamically adjusts cybersecurity policies based on threat assessments to create security workflows. A Cybersecurity Mesh Development module that integrates policies across security frameworks. A Dynamic Scenario Catalog module that updates policy adjustments based on threat intelligence. An Automated Workflow Orchestration module that creates and refines security workflows for optimal efficiency. A Policy Recommendation and Automation module that generates prioritized security recommendations and automates policy changes based on organizational risk profiles and current security controls. This system harmonizes security policies while considering business context, risk, and productivity impacts.

The invention provides a smart power grid cloud edge collaborative heterogeneous data security access method, which comprises the following steps: collecting multi-source heterogeneous power equipment data in real time based on a deployed multi-mode sensor network; based on a lightweight federated learning edge inference engine deployed on an edge end network, performing adaptive semantic enhancement preprocessing on the multi-source heterogeneous power equipment data to generate an edge encryption feature tensor; performing three-dimensional credible security authentication and knowledge fusion on the edge encryption feature tensor based on an electric power space-time knowledge graph fusion engine deployed on the cloud side to generate secure and credible electric power data; and performing space-time causal reasoning and twin mirror image comparison on the secure and credible power data based on a federated block chain-driven digital twin decision engine deployed at a cloud end to generate a dynamic security policy map and store the dynamic security policy map. According to the scheme, the data security is enhanced, intelligent analysis and dynamic decision can be performed according to the real-time state of the power grid, and optimal scheduling and stable operation of the power grid are realized.

The invention relates to the technical field of data management, in particular to a safety management method for financial data synchronization, which comprises the following steps: acquiring an original financial data stream, and performing data fragmentation processing on the original financial data stream to obtain fragmented data packets and data fingerprints; performing storage node mapping on the redundant coded data packet according to the storage network to obtain a storage node address chain; and performing abnormal access behavior identification on the storage node address chain according to the security threshold model to obtain a security policy instruction, and deploying the financial scheduling model to a cloud edge collaboration platform to realize security management of financial data synchronization. According to the method, data fragmentation processing, encryption and identity binding are performed on the original financial data, so that the confidentiality of the data can be effectively protected, the data is prevented from being accessed or tampered by an unauthorized third party in a transmission process, and the encrypted data packet ensures secure transmission of the data.

The invention relates to the technical field of information security, in particular to a security baseline setting method and system equipment based on clustering decision and a medium, and the method comprises the steps: collecting original data, carrying out the construction of a feature vector through feature conversion, generating a sample, and marking and extracting the sample; constructing a classification model by using manifold learning, inputting the extracted feature vectors into the constructed classification model, optimizing the model through training, and outputting classification labels; processing the decision boundary by using constraint optimization and feature scaling to obtain a standardized feature vector converted by a decision boundary model, grouping based on the standardized feature vector, and extracting a baseline; the security policy is generated through data analysis, and the data is dynamically updated and continuously monitored, so that the unified configuration and centralized management of the security policy are realized, and the policy implementation efficiency and the system expansibility are remarkably improved.

The invention relates to a notebook software vulnerability scanning method based on a security policy. According to the method, firstly, a security policy library of a target notebook is obtained, and the security policy library comprises access control rules, data operation limiting conditions and vulnerability detection reference requirements for different software types; collecting software running data of the target notebook computer, wherein the software running data comprises current running process information, file system operation records, network connection states and software configuration parameters; performing matching analysis on the software operation data and the security policy library to generate a preliminary scanning result; evaluating the risk level of the software vulnerability according to the preliminary scanning result; and finally, based on the risk level and the repair guide terms in the security policy library, generating software vulnerability repair guide information. Therefore, notebook software vulnerabilities can be scanned comprehensively and accurately, and effective repair guidance is provided.

The invention belongs to the technical field of base station equipment management, and discloses a base station equipment management method and system based on big data. The method comprises the following steps: firstly, collecting security situation data of a physical layer, a network layer and an application layer, extracting time sequence behavior characteristics, performing cross-layer correlation analysis, and constructing an equipment security credibility dynamic evaluation model; then, identifying vulnerability indexes of control nodes according to the trust attenuation curve, and constructing a cascade risk conduction model in combination with a topological connection relationship; dynamically dividing a security isolation domain based on the model and generating protection parameters and control rules; further, a differentiated security policy is configured, and a cross-domain collaborative response channel is established; and finally, dynamically adjusting the isolation domain boundary and the security policy by monitoring the security event frequency and the interception success rate in real time. According to the invention, the conversion from passive defense to active prediction is realized, and the safety protection capability and operation stability of the base station equipment are improved.

The invention discloses a data encryption method for multilevel key stream control in an industrial gateway, and particularly relates to the technical field of data encryption and network security. The method comprises the steps of obtaining a session identification code and communication context information; generating a first-level basic key based on the session identification code, and generating a multi-level key stream control matrix in combination with communication context information and a multi-source dynamic random factor; according to the hierarchical relationship of the matrix, key stream sequences of corresponding levels are distributed to data packets of different priorities, and the key stream sequences are switched or combined in real time according to data packet types, transmission paths and security policies in the encryption process, and time fragmentation processing and disturbance coding are executed; the encrypted data packet is sent through a multi-protocol forwarding module of the industrial gateway, and the receiving end carries out decryption by using the key stream control matrix; according to the invention, dynamic generation, hierarchical calling and safe switching of the key stream can be realized, and the data confidentiality, integrity and anti-attack capability of the industrial gateway in a complex network environment are remarkably improved.

The invention discloses an internal and external network security service passing method and system based on edge computing, and belongs to the technical field of network security, and the method comprises the steps: obtaining multi-dimensional attribute information of an edge node, generating a security policy basic data set, generating a traffic feature fingerprint and a self-adaptive environment adaptive fingerprint, and calculating a fusion matching degree; edge security entity nodes are generated in combination with service scene adaptive threshold clustering, and then a security policy meta-model with a security policy blueprint as a core is constructed; analyzing the security policy meta-model through a multi-modal semantic analysis engine, generating a dynamic security enhancement model, and mapping the dynamic security enhancement model to a hierarchical security control model; based on the hierarchical model, outputting edge node internal and external network safety passage configuration and a corresponding safety passage ledger through a scenarized configuration generation algorithm; according to the method, adaptive generation, dynamic optimization and accurate execution of the security policy are realized, and the security, the automation level and the operation and maintenance efficiency of internal and external network passing in the edge computing environment are effectively improved.

Various embodiments include a system. The system comprises processing circuitry. The processing circuitry obtains an Application Programming Interface (API) call that is associated with a Large Language Model (LLM). The processing circuitry generates a feature vector that numerically represents data included in the API call associated with the LLM. The processing circuitry provides the feature vector to a security LLM trained to detect security threats to the LLM. The processing circuitry obtains an output from the security LLM that indicates a security threat to the LLM. The processing circuitry determines a security policy based on the security threat. The processing circuitry provides the security policy to a security proxy that screens the API call.

The invention relates to the technical field of construction safety assessment, and discloses a construction safety assessment method based on multi-model fusion. The method comprises the following steps: acquiring a multi-source safety monitoring data set of a construction site, wherein the multi-source safety monitoring data set covers image sequence data, sensor time sequence data and operation log text data; performing parallel feature extraction processing on the multi-source data to generate an image feature vector, a sensor feature vector and a text feature vector; calling a multi-model fusion framework to carry out cross-modal fusion processing on the three feature vectors to obtain a fusion security feature set; carrying out security risk assessment analysis based on the fused security feature set, and generating a security risk prediction value and a high-risk region identifier; and finally, generating a security policy adjustment instruction according to the risk prediction value and the high-risk area identifier, and feeding back the security policy adjustment instruction to the field control system to trigger real-time intervention operation. According to the method, a high-risk area can be recognized in time, intervention is triggered, and intelligent support is provided for safety management of a construction site.

The present technology relates to a computer-implemented method for enhancing enterprise-wide security when using Artificial intelligence (AI) models. Embodiments involve a JavaScript injection process facilitated by a proxy server. This process does not require manual installation as it is automatically injected during operation. The JavaScript injection process operates by intercepting unsecured AI input and output data provided by users interacting with AI websites. The input and output data are sent to a security Application Programming Interface (API) which applies an enterprise security policy to the data in real-time, thereby transforming unsecured input and output into secure data. Embodiments provide a robust framework for safe interaction with Artificial intelligence models while mitigating the risks associated with the transmission of sensitive information over the internet.

Techniques for providing explicit proxy solutions for 5G Service Access Service Edge (SASE) with service provider network attach are disclosed. In some embodiments, a system, a process, and / or a computer program product for providing explicit proxy solutions for 5G SASE with service provider network attach includes receiving data plane traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network; enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and / or per user; and forwarding the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and blocking or dropping the data plane traffic from the SASE cloud network if not allowed by the security policy.

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

The invention belongs to the technical field of network security, and relates to a terminal security access control method and device, computer equipment and a storage medium, the method comprises the following steps: deploying an infrastructure for terminal security access, the infrastructure comprising a client, a security system and a server component; the method comprises the following steps: performing initial registration on terminal equipment, and realizing unique binding of a terminal identity and loading of a basic security policy by acquiring an equipment fingerprint, issuing a certificate and configuring a policy; the user identity and the equipment credibility are verified in real time through a multi-factor dynamic authentication mechanism; through signature verification and encrypted transmission, application and network communication authentication is carried out, and application legality, communication channel security and operation environment credibility are ensured; and after the authentication is passed, trusted connection is established, fine-grained authorization is implemented, and security isolation of a service layer is realized through dynamic token and API management and control. The problems that in existing terminal access control, the authentication dimension is single, the authorization granularity is rough, and dynamic management and control are lacked are effectively solved.

The invention discloses a sandbox type trusted data space construction method and equipment based on a trusted verification architecture, belongs to the technical field of data security circulation and trusted computing, and aims to overcome the defects that a traditional sandbox behavior is unknowable and untrusted and a strategy is rigid. The method comprises the following steps of: starting a sandbox in a hardware trusted execution environment and generating a task unique context identifier; intercepting system call by a monitoring agent; generating a chained operation certificate containing preorder certificate hash; compiling an advanced security policy into a deterministic finite automaton executable policy set; and the auditing unit is used for generating a decision instruction in an illegal scale, storing the chain anchor point to the non-tampering system, forcibly executing decision and generating a Merkel tree evidence. The equipment correspondingly comprises a sandbox management module, a behavior monitoring module, a strategy compiling module, a verification judgment module and an auditing execution module. The full-flow transparent tracing of the operation in the sandbox is realized, the strategy dynamic adaptation is supported, and the problem that a traditional sandbox monitoring log is easy to counterfeit and difficult to verify is solved.

The invention provides a fusion type secure storage system, electronic equipment, a data management method and a computer readable storage medium. The system comprises a hardware security layer, an encryption processing layer, a verification error correction layer, a data stream processing layer and an intelligent management layer which are in communication connection, the hardware security layer provides a physical trusted root for the system and executes a security policy; the encryption processing layer is used for carrying out encryption processing on data based on the security service provided by the physical trusted root; the verification and error correction layer is used for carrying out integrity verification and self-adaptive error correction coding on the encrypted data; the data stream processing layer is used for executing a near data calculation task on the data subjected to verification and error correction; and the intelligent management layer collects real-time state data from the hardware security layer, the encryption processing layer, the check error correction layer and the data stream processing layer, and performs dynamic strategy configuration and global optimization decision, thereby improving the active calculation, dynamic adaptation and intelligent optimization capabilities of the system.

A system and method for cybersecurity policy management in a computing environment is presented. The method includes receiving a selection of a first cybersecurity policy of a digital security platform of a computing environment; applying the first cybersecurity policy to generate a first measurement; generating a second cybersecurity policy based on the first cybersecurity policy and a result of the first measurement; applying the second cybersecurity policy to generate a second measurement; generating a third cybersecurity policy based on a result of the second measurement and the second cybersecurity policy; and applying the third cybersecurity policy on the computing environment.

The invention relates to the technical field of network security awareness, in particular to a security awareness method and system for a GPU cluster, and the method comprises the steps: collecting multi-source security situation data, and providing basic information for subsequent security analysis; by constructing and updating a cluster security situation map in real time, information timeliness is updated and ensured in real time, and powerful support is provided for risk assessment; a dynamic risk assessment model is utilized to calculate vertex and edge scores, high-risk vertexes and key risk conduction paths are identified, and a basis is provided for resource isolation and scheduling; the targeted instruction is generated according to the security risk score and the preset security policy library, different security risks are effectively handled, and safe and stable operation of the cluster is guaranteed; by converting the instruction into a specific control command and distributing and executing the specific control command, effective implementation of security measures is ensured, and the cluster security protection capability is improved; by setting a finite-state machine monitoring instruction execution state, a recovery mechanism is automatically triggered, and continuous and safe operation of the cluster is guaranteed.

The invention provides a network security assessment method and system based on threat intelligence, and the method comprises the steps: obtaining a threat intelligence data set and a to-be-assessed network data set, and carrying out the feature association extraction processing, thereby obtaining a target security feature set; the target security feature set covers threat and component association matching, threat and behavior influence conduction and network component protection capability features, calling a pre-training security assessment model to carry out risk situation analysis on the target security feature set, and generating a network security assessment result including a potential threat triggering probability and a threat influence propagation path, and determining a to-be-evaluated network risk level and key risk point distribution information according to the network security evaluation result, generating a network security evaluation report containing a risk positioning identifier, and outputting the network security evaluation report to the network management terminal to support security policy adjustment operation, so that the network security condition can be comprehensively and accurately evaluated, and the user experience is improved. And the pertinence and effectiveness of safety protection are improved.