2042 results about "Security policy" patented technology

The invention relates to the technical field of data security management, in particular to a self-adaptive data security management and risk early warning system based on intelligent analysis under a cloud platform. Comprising a multi-dimensional data acquisition module; an intelligent analysis module; a self-adaptive strategy generation module; a risk early warning module; and a user behavior portrait construction module. In the design, the security policy can be dynamically adjusted along with the risk situation of the cloud platform, the problem that a static policy cannot adapt to real-time change is solved, and dynamic mapping of risk characteristics-policy parameters is realized; according to the design, the one-sidedness of single-dimension analysis is broken through, multi-modal feature association modeling of user behaviors is achieved, an abnormal behavior triggering threshold value is accurately recognized, and the integrity and accuracy of risk feature analysis are improved; the security policy can be continuously optimized through historical event data, so that protection efficiency attenuation caused by long-term static operation is avoided, and an autonomous lifting link of data driving, algorithm optimization and policy evolution is realized.

The invention relates to the technical field of path planning, and discloses a path planning and control method and system for a container port automatic driving vehicle. The method comprises the following steps: acquiring environment data through a multi-source sensor, and obtaining a harbor district digital twinborn model through space-time registration fusion; a three-layer progressive planner is used for optimizing and generating a main and standby path scheme based on the model; predicting a dynamic target trajectory by using a time sequence attention network to obtain situation assessment; processing the evaluation data through a distributed predictive control algorithm to generate a control instruction; and monitoring a motion state through adaptive security constraints to form a security policy, and continuously optimizing by using deep reinforcement learning. According to the method, safe and reliable operation of the automatic driving vehicle is realized in a complex and changeable harbor district environment, and particularly, accurate path planning and control decisions can be made in the face of dynamic obstacles.

The invention relates to the technical field of network security situation generation, in particular to a network security situation generation method based on multi-view monitoring. The method comprises the following steps of: constructing a multi-view data acquisition system, acquiring real-time information from a multi-dimensional data source, and comprehensively capturing potential threats by utilizing an intelligent sensing technology; cleaning, noise filtering and feature extraction are performed on the acquired data based on a dynamic threshold self-adaption multi-factor cleaning method, so that the accuracy and consistency of the data are ensured; a dynamic analysis algorithm based on deep learning is adopted, the incidence relation between the security events is mined, and the development trend of potential threats is predicted; constructing a joint learning model, and comprehensively evaluating the security state of the network environment; the security situation is dynamically displayed by using a visualization technology, and a security policy is quickly generated in combination with an automatic early warning and response mechanism to resist threats. According to the method, accurate evaluation and prediction of the network security situation are realized, and support is provided for security decision-making in a complex network environment.

The invention discloses a security risk autonomous sensing system and method based on a digital twin industrial control network. The method comprises the following steps: performing four-dimensional multi-modal modeling on an industrial control network, and constructing a twin model integrating entities, rules, services and behaviors; constructing a high-fidelity simulation network by utilizing a containerization technology based on the model; deploying a gateway at an actual network boundary, collecting traffic characteristics in real time and identifying suspicious behaviors; performing protocol restoration and behavior reconstruction on the suspicious traffic to generate a behavior sequence; performing anomaly recognition and attack classification on the behavior sequence through a deep learning model; evaluating a risk level; and matching and verifying a defense strategy according to an evaluation result, and automatically synchronizing the defense strategy to a master control network to realize a detection-response-protection closed loop. According to the invention, autonomous identification of suspicious behaviors in the industrial control network and intelligent decision-making of security policies are realized, and the method has the advantages of high simulation, low invasion, closed-loop controllability and the like.

The invention provides an enterprise employee behavior analysis and safety risk early warning monitoring method and system, and relates to the technical field of enterprise risk management, and the method comprises the steps: collecting employee terminal operation behavior data, building an activity thermal distribution diagram based on office area grid behavior association intensity, and training a behavior evaluation model. And inputting the behavior scoring matrix into a deep neural network to extract target behavior characteristics, calculating an abnormal behavior risk weight coefficient in combination with a department security policy, performing classification and analyzing a risk diffusion probability, and generating a risk situation index to determine an early warning level. Starting a response strategy according to the early warning level, blocking high-risk early warning in real time, tracking associated accounts, establishing a risk association map, identifying potential risk propagation nodes and performing active protection, finally generating an early warning report and feeding back effective protection rules to a behavior baseline model, and realizing continuous optimization of a risk early warning mechanism. And the accuracy and effectiveness of safety risk early warning in the enterprise are improved.

The invention discloses a substation network security defense system based on artificial intelligence. The system comprises a data collection module for collecting transformer substation network data; the anomaly detection module is used for identifying an abnormal mode and an intrusion behavior; the threat intelligence analysis module is used for identifying potential threat and vulnerability information; the intelligent security monitoring and response module is used for evaluating the network security state; the malicious code detection module is used for detecting, analyzing and isolating malicious software; the intelligent security prediction module is used for predicting a network security event and carrying out early warning prompt; the self-adaptive security policy module is used for automatically adjusting or updating an optimal security policy; the system updating and maintaining module is used for updating and maintaining system modules and functions; the user interface and alarm module is used for providing safety state display and alarm for a user; the data backup and recovery module is used for backing up and recovering key data; and a compliance auditing module which makes operation and configuration accord with security standards. According to the invention, hierarchical, intelligent and active protection of the transformer substation network is realized.

The invention belongs to the technical field of data security, and discloses a data management method based on a data resource security identification level, and the method achieves the automatic and intelligent decision making: achieves the data classification and the automatic identification of the security level through a machine learning and deep learning model, remarkably reduces the manual intervention, and improves the efficiency and accuracy. And dynamic real-time performance: in combination with a risk assessment model, the system can detect abnormal behaviors in real time and dynamically adjust a security policy in a data flow process, so as to ensure that the sensitive data is properly protected in different scenes. And security and compliance: a log auditing module ensures the traceability of all data operations, improves the response capability to potential risks through an anomaly detection algorithm, and provides effective compliance guarantee for data security governance. And the system can be compatible with various data sources, supports configuration and execution of various security policies, and is suitable for data security management requirements of different industries (such as finance and medical treatment).

The invention relates to a network information security protection method and system based on artificial intelligence dynamic defense. The method comprises the following steps: constructing a multi-level security policy library containing basic defense, scene defense and emergency response based on preprocessed network data features (including protocol features, behavior sequences and abnormal indexes); then, combining real-time threat intelligence and a network environment state, and utilizing a strategy combination optimization algorithm to generate a weight matrix reflecting strategy priorities and dependency relationships; dynamically extracting and fusing various defense strategies from a strategy library according to the weight matrix to form a customized defense scheme; and eliminating resource competition and logic contradiction between strategies through a conflict detection mechanism, and finally deploying a conflict-free optimization scheme to a target node. By adopting the method, collaborative deployment of multi-dimensional security policies can be realized, and the accuracy and real-time performance of security protection in a complex network environment are remarkably improved.

A federated mining method for multimodal data based on multiple security policies includes: a federated learning framework is used as a data mining model for distributed data mining; a multiple authentication mechanism is designed; a local edge node is selected to participate in a federated computation to obtain authenticated local edge node and aggregate a dataset; a multimodal data fusion and a multimodal data classification are performed on the dataset by a generalized multimodal data feature fusion model based on a multi-headed attention mechanism; and an adaptive perturbation mechanism based on cyclic correlation analysis and differential privacy is designed to add noise round by round and dynamically. A federated mining method for multimodal data is further provided.

The invention relates to the technical field of financial data security, and discloses an intelligent ERP financial system data security management and authentication method. The method comprises the following steps: acquiring an original transaction data stream in an ERP system, extracting key financial fields, and dividing the key financial fields into a sensitive data set and a common data set according to a preset rule; a dynamic encryption strategy framework is constructed based on sensitive data set attributes, the framework comprises multiple levels of encryption strength parameters, and the corresponding encryption strength can be automatically matched according to the authentication level of an access request. And monitoring a system data access behavior in real time, collecting feature data, inputting the feature data into the anomaly detection model, and triggering access blocking when an output anomaly access probability exceeds a threshold value. And generating a periodic integrity verification instruction according to the sensitive data updating frequency, performing integrity verification by using a hash chain technology, recording a result and marking a tampering risk level. And based on the association relationship between the tampering risk level and the abnormal access probability, generating an updated security policy and synchronizing the updated security policy to each data access node.

The invention provides a firewall attacked surface carding and security reinforcing method, which comprises the following steps of: protecting sensitive data in each link of data flow in an identified supply chain, deploying a data leakage prevention gateway on a data flow link, and adopting deep packet detection of content awareness to carry out security reinforcement on the data flow link. Visualized presentation and security auditing of data flow behaviors are realized, and abnormal data flow is blocked and alarmed; the method comprises the following steps: constructing a security policy configuration knowledge base, mapping service description into a security policy component, automatically generating a fine-grained security policy matched with service semantics by adopting a policy generation engine based on combination of rules and deep learning, and realizing cross-scene policy conflict detection and correction by virtue of reasoning of a constructed knowledge graph.

A method for managing edge devices includes: monitoring network traffic between an edge device (ED), an edge node (EN), and a cloud device (CD) to obtain a first dataset; monitoring an activity performed on the ED to obtain a second dataset; analyzing the first dataset to generate a network traffic analysis output (NTAO); analyzing the second dataset to generate an activities analysis output (AAO); performing a first tagging of the ED under as either a secured devices category or an unsecured devices category based on the NTAO, AAO, and a first identifier; performing a second tagging of the ED under a corresponding unsecured devices sub-category; upon tagging the ED and based on the AAO, making a determination that the activity is a malicious activity; and implementing a security policy to disrupt a user of the ED.

The invention discloses a cross-domain computing task processing method, a program product, equipment and a medium, and relates to the technical field of cloud computing. The method comprises the following steps: determining a computing node for executing a cross-domain computing task in a cross-domain collaborative scene, and generating an identity certificate bound with the computing node based on a hardware credible state of the node; collecting security policies of a plurality of management domains for conflict detection and decision, and generating a conflict-free session policy; scheduling the cross-domain computing task to a target computing node meeting a preset credible requirement, and issuing a revocable dynamic session token; and recording the operation information of the cross-domain calculation task in the whole life cycle as an audit event, and generating a chained audit log which is linked by the hash value and is digitally signed through a preset verifiable audit interface. By means of the technical scheme, it can be ensured that the whole life cycle of any computing task meets the closed-loop safety requirements of identity credibility, permission controllability, execution propriability and behavior traceability in the complex distributed computing environment.

The present disclosure provides a system for secure compute using artificial intelligence agents. The system includes a hardware execution environment with one or more computerized processors and electronic storage media. The processors are configured to establish a secure agent comprising a secure state management module, an encrypted state transition management module, a threshold cryptography implementation, and a digital signature verification module. The system also includes a plurality of atomic agents, each configured to perform a composite task and comprising a task-specific execution module, a state management interface, and a communication module. An orchestrator agent coordinates secure execution of the atomic agents and includes a task distribution module, a result aggregation module, a workflow management module, and a security policy enforcement module. The orchestrator agent integrates encrypted outputs from the atomic agents to perform composite tasks while maintaining data integrity and security through the secure state management module.

The invention relates to the technical field of management of the Internet of Things, and discloses a security control method and system for remote control of the Internet of Things, and the system comprises a security remote control platform, a zero-trust gateway, an authentication module, a security policy engine, edge proxy equipment and an encryption communication module. And the authentication module is used for performing identity authentication on the equipment and the user. The security policy engine dynamic access control table comprises access rule entries and associated signature information, and is issued to the edge proxy device through the zero-trust gateway. And the edge proxy device stores the dynamic access control table, verifies the signature information based on the platform public key, and performs matching and verification according to the access rule entry when receiving the control instruction. And the encryption communication module is used for performing encryption transmission on the access control table, the control instruction and the execution result. According to the invention, the whole process of remote control of the Internet of Things is dynamic, secure and credible, and the anti-attack capability and operation reliability of the system are effectively improved.

The invention relates to a graph-based network security event modeling method and system, and the method comprises the steps: obtaining topological data and security policy information of a network where network security equipment is located, and carrying out the hierarchical construction of a knowledge graph, and obtaining a multi-layer security graph; acquiring real-time monitoring data of the network security equipment, and performing graph adversarial learning association with the multilayer security graph to obtain a dynamic evolution graph sequence; obtaining alarm data of the network security device, and performing anomaly detection on the multilayer security map to obtain an anomaly propagation situation; performing security assessment construction on the dynamic evolution diagram sequence and the abnormal propagation situation to obtain an initial security assessment scheme; performing alarm identification and attack link prediction on the alarm data to obtain a link prediction result; and performing evaluation and prediction on the initial security evaluation scheme and the link prediction result to obtain a security situation evaluation strategy. According to the invention, the security condition of the current network can be evaluated more accurately.

The invention relates to the technical field of intelligent control, in particular to a dynamic encryption-based data link security management and control system and method.The dynamic encryption-based data link security management and control system comprises a dynamic encryption engine, a key management cluster, a link monitoring unit and a security policy execution array, the switching between the SM9 cryptographic algorithm and the quantum resistance NTRU algorithm is supported; the key management cluster realizes distributed key negotiation and storage through a block chain smart contract, and establishes a bidirectional authentication channel with the dynamic encryption engine; the link monitoring unit is integrated with a multi-dimensional flow probe, and continuously collects link delay jitter, data packet entropy characteristics and protocol compliance indexes; the security policy execution array is deployed at a boundary node of a data link, and is configured with a dynamic access control list and a hardware-level data purification module. Therefore, the problems of insufficient encryption algorithm resistance, significant key update delay, multi-dimensional threat sensing blind areas, dynamic strategy response delay and the like in the prior art are solved.

The present disclosure includes systems and methods for a security policy framework. Various embodiments include responsive to receiving a trigger, fetching one or more policies from a policy catalog service; compiling the one or more policies into a query, wherein the one or more policies can be compiled into a plurality of different query languages; executing the query over customer data, the customer data being located in one or more data sources; and persisting results of the query.

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

Systems and methods include discovering and classifying any of data discovered by inline cloud inspection, data stored across one or more cloud services, and data stored across one or more endpoints; continuously monitoring access to and usage of classified data, wherein the monitoring is performed in real-time and includes analyzing data access patterns, user behaviors, and application interactions; evaluating a security posture of the classified data by identifying misconfigurations, compliance violations, excessive permissions, and vulnerabilities; and enforcing one or more security policies based on the evaluated security posture.

The invention discloses a data security management method and system based on cloud computing, and relates to the technical field of data management, and the method comprises the following steps: S1, making a security policy; s2, performing security assessment on the cloud infrastructure; s3, performing identity authentication and access control; s4, data encryption and key management; s5, data classification and level-to-level management; s6, data leakage detection and defense; s7, performing auditing and compliance management; s8, abnormal behavior monitoring and threat response; and S9, an elastic backup and recovery mechanism. According to the data security governance method and system based on cloud computing, the elasticity and dynamic response capability of data security are remarkably improved by setting the distributed key management system and the intelligent monitoring model. The distributed key management system dispersedly stores the keys in different physical areas, so that the risk of single-point fault and attack is reduced; the AI-based intelligent behavior monitoring system analyzes user behaviors in real time, predicts abnormal operation and automatically responds.

The invention relates to the technical field of automatic deployment of cloud computing platforms, in particular to a self-adaptive deployment method and system oriented to a credential heterogeneous environment. Aiming at three technical bottlenecks of low multi-CPU architecture adaptation efficiency, frequent software dependence conflicts and complex security baseline configuration in a localization process, a heterogeneous computing resource intelligent scheduling engine and a dynamic security policy generation mechanism are innovatively provided. The method comprises the following steps: constructing a heterogeneous resource portrait through a hardware feature automatic identification technology, and realizing component installation sequence optimization based on a DAG dependency relationship analysis algorithm and Kahn topological sorting; and creating an adaptive network security policy, and sensing the firewall state of the target system in real time through a probe. Compared with a traditional deployment mode, the method supports cross-architecture compatibility, solves the problem of dependency conflicts, improves deployment efficiency, and guarantees consistency and safety of the system.

The invention discloses a network / security equipment security policy generation and evaluation method and system based on a large language model, and the method comprises the steps: carrying out the fine adjustment of a base model through employing a threat research and judgment data set and a policy generation data set, and obtaining a threat research and judgment LLM and a policy generation LLM; a threat research and judgment LLM performs threat research and judgment on the received abnormal log output by the log acquisition module, and outputs a threat information tetrad; the policy generation LLM generates an equipment security policy by calling a knowledge base Agent according to a threat information quadruple output by the threat research and judgment LLM; and the policy generation LLM call evaluation Agent evaluates the equipment security policy from three aspects of policy correctness evaluation, policy validity evaluation and policy suitability evaluation. According to the invention, the effectiveness and reliability of the equipment security policy are improved.

The invention relates to an industrial control system security policy adaptive configuration method and device and a readable storage medium. According to the method, a control instruction stream, a process variable sampling value and link layer message metadata are synchronously collected, an association hypergraph fusing network semantics, control semantics and physical semantics is constructed to represent a system state, and a sampling period is divided into a plurality of time slots with fixed lengths. In each time slot, self-supervised learning is utilized to extract a topology embedded vector group, and a system operation rule is represented. A robustness envelope interval is generated by calculating a statistical distance between a current time slot and a historical baseline, and is used for driving a reinforcement learning model to generate a security policy parameter set. And executing corresponding access control, traffic shaping and integrity verification operations in the next time slot, generating receipt vector feedback model update according to an execution result, outputting a micro-policy patch with a hash signature and a timestamp, and sending the micro-policy patch to the edge security gateway to realize deployment, thereby realizing closed-loop adaptive optimization of the security policy in the dynamic environment.

Systems, methods, and devices to detect unauthorized third-party connections within a network infrastructure, such as by analyzing network traffic data using fuzzy matching and machine learning techniques. One aspect includes receiving network traffic data comprising records of communication events involving network identifiers, determining communication relationships between network entities identified by the network identifiers, accessing entity identifiers associated with known third-party systems, and determining associations between the network identifiers and the entity identifiers using a fuzzy matching process. Other aspects include identifying communication relationships involving the third-party systems based on the associations and detecting unregistered or unknown third-party connections within the network infrastructure. Further aspects include normalizing identifiers, computing string similarity metrics, assigning confidence scores, incorporating external data sources, building network association patterns, comparing current patterns to baseline patterns to detect anomalies, and updating security policies or firewall rules in response to detected anomalies. Additional aspects are provided.

Disclosed is a cloud-based security system implemented in a forward proxy that provides generative artificial intelligence (GenAI) traffic inspection to protect against security and privacy concerns related to GenAI use for protected endpoints. The security system intercepts requests and determines whether those requests are directed to a GenAI application. The security system includes a GenAI request classifier trained to classify prompts submitted to GenAI applications as one of benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses from GenAI applications as one of normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies on both the requests and responses that block the traffic, trigger alerts to administrators, and the like to enforce security and privacy protection on bidirectional traffic.

The invention relates to the technical field of safety management and risk prediction, in particular to an intelligent safety management and risk prediction method and system based on cloud computing. The method comprises the following steps: dynamically accessing multi-source heterogeneous data through a cloud platform, and forming unified event representation through time alignment and credibility labeling; constructing a hierarchical mixed probability safety twin model, updating dynamic parameters by adopting credibility weighted online variational Bayesian, and outputting a state interface by combining structural adaptation, cross-object graph regularization and physical constraint projection; mapping the twinborn state into a causal feature, constructing an intervening causal graph, generating causal embedding by using a credibility weighted attention network, simulating an intervention operation in an embedding space, and quantifying a risk probability; and generating a multi-candidate security policy, evaluating and sorting through a multi-objective utility function, executing an optimal policy, collecting feedback data, and updating the model and the policy. According to the method, credibility regulation and control, probability twinning and causal intervention are fused, and real-time intelligent decision making of an industrial safety scene is supported.

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

The invention relates to the technical field of edge device security policy deployment, in particular to an edge device-oriented lightweight AI security policy adaptive deployment method. The method comprises the following steps: collecting operation state information of edge equipment, and constructing a current multi-dimensional environment vector and a sliding window feature vector; constructing a strategy candidate library, constructing a strategy adaptability scoring function based on the current multi-dimensional environment vector and a real-time perceived network threat event, and scoring and sorting all candidate strategy items to obtain a strategy execution candidate set; and performing scheduling optimization on the strategy execution candidate set by adopting a multi-objective optimization algorithm, and selecting a strategy combination with the highest deployment score as a deployment result. According to the method, a multi-dimensional strategy adaptability scoring function is constructed, candidate strategy items are screened according to current network threat events and system resource conditions, a strategy screening mechanism from fixed template type configuration to resource awareness and attack scene linkage is converted, and the pertinence and accuracy of strategy deployment are improved.

The invention discloses a network space security situation awareness detection analysis system and method, and the system comprises a heterogeneous network flow feature deep extraction unit which obtains a flow feature vector through a distributed probe array and an adaptive sampling strategy; the edge computing gateway multi-dimensional threat feature mapping unit realizes feature space mapping through a multi-dimensional feature mapping matrix; the dynamic weight multi-head attention feature fusion unit fuses features by using an optimized multi-head attention mechanism; the time-space sequence security situation evolution modeling unit constructs an evolution model in combination with the time sequence and the fusion features; the security threat risk quantitative evaluation unit carries out risk quantification; and the heterogeneous security policy collaborative response unit generates a response instruction. According to the method, flow collection, feature mapping, fusion, modeling, quantification and response operation are sequentially executed based on all units of the system. According to the method, efficient perception and accurate response of the network space security situation are realized through a multi-unit cooperation and innovation model.