107 results about "Security software" patented technology

Systems and methods for prioritizing various security findings to allow a security platform to focus on a proper subset of (e.g., the most important) one or more software application stacks of an enterprise are described. In one embodiment, a method includes generating a profile for an enterprise that indicates one or more software application stacks and a network architecture for the one or more software application stacks, determining one or more vulnerability features of the one or more software application stacks, generating one or more exploitability scores by a first machine learning model based at least in part on the one or more vulnerability features, determining a proper subset of the one or more software application stacks based at least in part on the one or more exploitability scores, determining one or more vulnerabilities of the proper subset of the one or more software application stacks and one or more vulnerabilities of the network architecture, providing the one or more vulnerabilities of the proper subset of the one or more software application stacks, the one or more vulnerabilities of the network architecture, and the profile as input to a second machine learning model, generating an inference by the second machine learning model that indicates one or more attack paths for an attacker in the proper subset of the one or more software application stacks and the network architecture, and transmitting the inference to a storage location or a security software application.

A method for restoring a data volume, comprising: receiving a request to restore the data volume; identifying a risk map that is associated with the data volume, the risk map including a plurality of entries, each entry mapping a different respective one of a plurality of snapshot identifiers to a respective risk assessment score for a snapshot corresponding to the snapshot identifier, the respective risk assessment score being generated by security software, the respective risk assessment score representing a level of threat or potential harm posed by one or more files in the data volume; identifying a risk policy that corresponds to the data volume; retrieving the risk assessment score threshold from the risk policy; performing a search of the risk map to identify a snapshot whose respective risk assessment score satisfies the risk assessment score threshold; and using the identified snapshot to restore the data volume.

The invention provides a computer network security software debugging method and system, and the method comprises the steps: setting a plurality of test nodes of a source program in target network security software, and positioning a key test node based on the execution state of each test node; constructing a target search domain when the source program is tested through the program context information of the key test node; determining a plurality of abnormal program slices in the source program based on the static control flow diagram and the dynamic control flow diagram of the program code in the target search domain; determining the test overhead of each program slice according to the test coverage information of each program slice and the path complexity when the source program executes the test data; determining the constraint level of each program slice according to all the test overhead and the membership relationship among the program slices; and debugging each program slice through the constraint level of each program slice. According to the scheme, on the basis of the constraint level of each program slice, the problem code line can be accurately pointed in the network security software debugging process.

The invention provides a method and a system for identifying and processing abnormal startup and shutdown of measurement and control equipment of a satellite service system. The method comprises the following steps of: S1, de-noising telemetry information received by a preprocessed measurement and control responder by using a filtering model; s2, dynamically adjusting the weight ratio of the signal strength, the error rate and the response time to evaluate the on-orbit performance of the measurement and control responder; and S3, if the measurement and control responder is in a normal working state and receives a host or standby shutdown instruction of the responder, firstly judging the state of the whole satellite, then judging the code block telemetering information, and if no problem exists, judging the instruction as an abnormal behavior, and shielding the instruction by the security software. According to the method, the new measurement value can be responded in real time through continuously updating the state estimation by adopting the Erman filtering, and the adaptability of the system to the dynamic change is ensured; the system characteristics are judged through linear fitting, and the Kalman gain is calculated, so that the weighting between the predicted value and the measured value is more accurate.

The invention belongs to the field of network security, and relates to a method and a device for constructing a network security operating system, electronic equipment and a storage medium, and the method comprises the following steps: constructing an autonomously controllable improved microkernel infrastructure; based on the microkernel infrastructure, constructing a full-stack layered security control computing architecture base; constructing intelligent agent components, and deploying a multi-intelligent agent collaborative protection component system; integrating trusted computing and an integrity measurement verification system; performing dynamic adaptation and execution of multiple security policies; and a standardized safety evaluation and adaptive optimization closed loop is established. A trusted computing base is cut from a design source, so that the probability of occurrence of high-risk vulnerabilities is reduced; the real-time defense that the threat is changed and the strategy is changed is realized, and the blind area of the static strategy in resisting the unknown threat is made up; the malicious codes can be blocked before running, and the post passive situation that traditional security software only depends on a feature library for searching and killing is broken; and the contradiction between security capability solidification and threat dynamic evolution is fundamentally solved.

An intelligent elevator electronic unit having a central processor which both implements a motor control including time-critical motor control signals and performs basic functions of elevator operation, such as responding to external calls, specifying a travel curve or evaluating a safety circuit of the elevator system in which the elevator electronic unit is used to control an elevator motor. The elevator electronic unit also includes the power output stage required for operating the elevator motor and can also include one or more additional processors, with which the functionality of the elevator electronic unit is expandable in a modular manner. With this architecture, it is possible in particular to safely perform software updates of the central processor and / or an additional processor, to perform a downstream security check of such a software update or, for example, to autonomously optimize the operation of the elevator system with the aid of the central processor.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

A method for authorizing a secure access from a local device to a remote server computer is disclosed. At the local device having a unique identifier (UID), processor, and memory, a security software obtains a personal identification number (PIN) of a user, and the UID of the local device. Authenticity of the PIN and the UID is verified without communication over a network, using a credential code generated using the PIN, the UID and the security software. Upon verifying the authenticity of the PIN and the UID, access credentials to the remote server computer are retrieved, and the secure access to the remote server computer is authorized using the retrieved access credentials. The remote server computer has a copy of the security software, the PIN, the UID and the credential code.

The invention provides a method and a system for periodically maintaining and upgrading satellite security software. The method comprises the following steps of: S1, configuring a satellite-borne simulation system; s2, a satellite state assembly receives and responds to a remote control instruction injected on the ground, simulates the satellite working state and simulates the satellite temperature change; s3, the access authentication component checks the remote control instruction accessed to the satellite-borne simulation system, and verifies the remote control data packet through random key authentication and cyclic redundancy check; s4, setting test time, regularly testing the security software, summarizing test results, and updating the test results to a database so as to evaluate whether the security software works normally or not; and S5, upgrading the security software, notifying the ground through telemetry information after the upgrading is successful, testing the upgraded security software, and finally mapping the upgraded software into a real environment. According to the method, the security software cannot be interrupted during upgrading, and the security of the satellite software during upgrading can be ensured.

A cloud-based industrial safety system executes safety applications and interfaces with industrial assets on the plant floor using software encoded processing (SEP). The use of SEP ensures safety reliable execution of safety applications and data communication software by redundantly executing native code, thereby implementing a level of software-based fault detection that is independent of the hardware on which the safety application operates. This allows the cloud-based industrial safety applications to achieve at least SIL3 safety ratings for safety services even though the safety applications are executed using standard COTS hardware that is commonplace in the server market. The use of SEP to reliably execute safety software on the cloud can make possible a wide variety of safety applications that would be difficult to implement using purely localized industrial safety systems.

A system and method are provided for real-time detection of code integrity violations by combining behavioral stylometry, biometric fingerprinting, and environmental threat analysis. Baseline data of a user's coding style such as indentation, variable naming, and keystroke patterns are stored and compared to live input to calculate deviation scores. Typing behaviors like dwell time, rhythm, and simulated pressure form a biometric fingerprint, while environmental scans detect suspicious network activity, browser extensions, or virtual machine use. A combined risk score is generated, and automated interventions are triggered when it exceeds a threshold, enabling early detection of unauthorized access, AI-generated code, or compromised environments for secure software development.

Systems and methods are disclosed for performing access control method by running a security software service as a localhost web service on an endpoint device; communicating with a system web server which manages licensing of the system and authentication of the endpoint device; creating a secure digital capsule that is controlled and can only be accessed by the system web server which authenticated the user and authorized the endpoint device; and placing on a distributed ledger messages and data files stored in the system in the secure digital capsules to detect and prevent alteration or manipulation of data.

A request may be received to use a software on a first project. A first set of values may be extracted for a set of features of the first project. A classifier may be used to classify the first project based on the first set of values. It may be determined whether to grant the request to use the software on the first project based on an output of the classifier.

The present invention provides a method and system for identifying and processing abnormal power-on and power-off of a TT&C device in a satellite service system, including: S1: Denoising the telemetry information received by the preprocessed TT&C transponder using a filtering model; S2: Dynamically adjusting the weight ratios of signal strength, bit error rate, and response time to evaluate the on-orbit performance of the TT&C transponder; S3: If the TT&C transponder is in a normal working state and receives a power-off instruction from the main or standby transponder host, first judge the overall satellite state, and then judge the block telemetry information. If there are no problems, then judge this instruction as an abnormal behavior, and the security software will block it. The present invention uses Kalman filtering to continuously update the state estimate, can respond to new measurement values in real time, and ensure the adaptability of the system to dynamic changes; judges the system characteristics through linear fitting and calculates the Kalman gain, making the weighting between the predicted value and the measured value more accurate.

The present invention discloses a data asset management system, method, device, storage medium and product, the system includes: a data asset storage layer, a data asset management application layer and a security software layer; the data asset storage layer is used to store data assets in a confidential state, and extract the first target data corresponding to the data access request in response to the data access request, perform confidential calculation on the first target data, and obtain the return data for the data access request; the data asset management application layer is used to classify and grade data assets, register and confirm ownership, evaluate quality and value assessment; the security software layer is used to perform security detection on the data access request and the first target data. The data asset management system disclosed by the present invention realizes the confidential storage and calculation of logarithmic assets through the data asset storage layer, realizes the security protection of data assets through the security software layer, and realizes the management and evaluation of data assets through the data asset management application layer.

A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system. The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components.

Techniques for cryptographic computing isolation are described. A processor includes circuitry to be coupled to memory configured to store one or more instructions. The circuitry is to execute the one or more instructions to instantiate a first process based on an application. To instantiate the first process is to include creating a context table to be used by the first process, identifying a software component to be invoked during the first process, encrypting the software component using a first cryptographic key, and creating a first entry in the context table. The first entry is to include first context information identifying the encrypted software component and second context information representing the first cryptographic key. In more specific embodiments, third context information representing a first load address of the encrypted software component is stored in the first entry of the context table.

1. Name of the product in this design: Graphical User Interface for a Trusted Security Management System for Computing Boards in Electronic Devices. 2. Purpose of this design: An electronic device. 3. The key design feature of this product lies in the graphical user interface on the screen. 4. The picture or photo that best illustrates the key design points: Design 1 front view. 5. Design 1 is designated as the basic design. 6. Purpose of the graphical user interface: This design is used to configure the trusted security management policy of the computing board hardware and display the status log of policy protection execution. 7. Human-computer interaction method of graphical user interface: After the program runs, the main view of Design 1 appears; click the "Whitelist" button in the middle of the main view of Design 1 to enter the whitelist interface of the computing board dynamic and static measurement security software, i.e., the interface change state diagram 1 of Design 1; click the "Remote Proof" button on the left side of the interface change state diagram 1 to enter the remote proof execution status log interface of the computing board, i.e., the interface change state diagram 2 of Design 1; click the "Critical Process" button on the left side of the interface change state diagram 2 of Design 1 to enter the critical process protection policy configuration interface of the computing board, i.e., the interface change state diagram 3 of Design 1; click the "Log" button in the interface change state diagram 3 of Design 1 to enter the critical process protection status log display interface of the computing board, i.e., the interface change state diagram 4 of Design 1; click the "Critical Directory" button on the left side of the interface change state diagram 4 of Design 1 to enter the critical directory protection policy configuration interface of the computing board, i.e., the interface change state diagram 5 of Design 1. After the program runs, the main view of Design 2 will appear. Click the "Board Middleware" button on the left side of the main view of Design 2 to enter the middleware management interface of the calculation board software, which is the interface change status diagram of Design 2.

The invention relates to a short message processing method, a short message processing device, a communication terminal, a mobile communication system and a computer readable storage medium. The method comprises the following steps: displaying a target short message and a first link carried by the target short message; when a user clicks the first link of the target short message to initiate access, accessing a verification server according to a preset second link, and transmitting the first link to the verification server for authenticity verification; the verification server is configured to perform authenticity verification on the first link in response to a verification request initiated based on the second link; obtaining a verification result returned after the verification server performs authenticity verification on the first link, and executing a processing operation on the first link according to the verification result; according to the technical scheme, safety software does not need to be installed on the terminal equipment, a user can click the link in the short message trustingly, and the risk that telecommunication fraud is carried out through a false link of the short message is thoroughly avoided.

To enable a risk to a target system to be evaluated due to vulnerability of security countermeasure software.SOLUTION: An information processing system 1 comprises a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, and an output unit 18E. The first identification unit 18B identifies a menace type which can be addressed by installed software, the installed software being security countermeasure software that has been installed in a target system 30, among the security countermeasure software to which vulnerability has been reported. The first calculation unit 18C calculates a first risk value when addressing menace of the identified menace type by the installed software. The second calculation unit 18D calculates a second risk value when not addressing the menace of the identified menace type by the installed software. The output unit 18E outputs damage possibility information including risk value change information showing a change of the second risk value with respect to the first risk value.SELECTED DRAWING: Figure 2

The application provides a computer network security software debugging method and system. A plurality of test nodes of a source program in target network security software are set, a key test node is located based on an execution state at each test node, and a target search domain when the source program is tested is constructed by program context information of the key test node. A plurality of program slices with abnormalities in the source program are determined based on a static control flow graph and a dynamic control flow graph of program code in the target search domain. Test overhead of each program slice is determined according to test coverage information of each program slice and path complexity when the source program is tested. Constraint levels of each program slice are determined according to all test overhead and membership between each program slice. Each program slice is debugged through the constraint level of each program slice. The above scheme can accurately point to a problem code line in a network security software debugging process based on constraint levels of each program slice.

During development, a whitelist is automatically created that includes entries for all programs that will run on the target device. Security software is included in the installation package. After the installation package is installed, the operating system runs the system security software and the system security software intercepts attempts to run any program and only allows programs to run that match an entry in the whitelist. In some embodiments, an entitlement file is created (manually, automatically, or a combination of both) and is included in the installation package. In such embodiments, after initialization, the system security software intercepts attempts to access resources of the target device by programs and only allows access to resources that are identified in the entitlement file for that program.

The invention provides a malicious code detection method and system based on semantic analysis, and the method comprises the steps: determining a space where a suspicious code is located based on a monitoring behavior record of security software in a terminal, extracting a target code in the space, and reducing a subsequent malicious code detection interval range; based on the semantic feature extraction model and the text semantic classification model, generating a word sequence containing semantic information corresponding to the target code, and correcting the word sequence; analyzing the corrected word sequence based on a deep text classification model to obtain global text semantics of the target code so as to calibrate malicious code snippets in the target code, and performing code change operation on the space based on distribution characteristics of the malicious code snippets to obtain the target code. And meanwhile, global recognition is performed on the codes by utilizing a semantic feature extraction model and a text semantic classification model, efficient and accurate analysis of code semantics is considered, semantic information of the codes is comprehensively extracted, malicious code components are recognized and positioned in massive codes, and the working accuracy and reliability of security software are improved.

The embodiments herein provide a method and a system for security risk identification and controlling release management of software application. The method provides security risk identification in a software application as well as integrated tools to direct the efforts of developers to build and maintain secure software. The method provides a unique approach of defining a plurality of Service Level Agreement (SLA) to control a release build for a software application by checking vulnerabilities. Furthermore, the method is flexible enough to adapt in most complicated enterprises and different Software Development Life Cycle (SDLC) processes.

The invention provides a portable AVC automatic joint debugging test device and method, and belongs to the technical field of power equipment. The device comprises a communication module, a data acquisition module, a user interface module, an application program module, a communication protocol stack module, a security software module and a data processing library module. The method comprises the following steps: generating a task request, sending the task request to a command theme subscribed by each AVC substation, obtaining real-time data collected by each AVC substation, decrypting and verifying to obtain plaintext data, inputting a dynamic and static curve real-time discrimination model constructed based on a deep reinforcement learning network, outputting a dynamic and static curve discrimination result, and outputting the dynamic and static curve discrimination result. And inputting a PID parameter cost function constructed by a model prediction control algorithm, solving optimized PID parameters of each substation, and issuing the optimized PID parameters to each AVC substation to recollect data until the comprehensive performance grade of each AVC substation is qualified. According to the invention, the blank of the AVC substation joint debugging test device is filled, and the judgment accuracy of the multi-AVC substation joint debugging test result is improved.

Before deployment, artifacts and / or binaries are generated by the process of compilation from source code files are double signed with signatures. Immediately before deployment, a copy of the artifact

The invention provides a motor function safety monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of motors. The method comprises the following steps: executing a first-class interrupt processing flow corresponding to a current first-class interrupt task in a time interval from entering the current first-class interrupt task to entering the next first-class interrupt task of the current time, and executing a second-class interrupt task in response to a trigger command for the second-class interrupt task: activating a safety monitoring task, executing a security monitoring processing flow in the security monitoring task; according to the method, the second-class interruption task is triggered in a software triggering mode, and the safety monitoring task is activated in the second-class interruption task processing, so that the problem that the first-class interruption task is limited by the time of a fixed period is avoided, and the increasing requirement of the complexity of motor function safety software is met.

The present invention relates to a method for managing software on computer terminals (computers, mobile phones, tablets) used by a community within an entity with security policies. Each terminal incorporates a data collection module that monitors user interactions with various applications in real time. The process includes recording usage references, identifying the applications used, and collecting associated data. This data is analyzed to identify applications in real time and detect anomalies compared to normal usage. In the event of abnormal behavior or to optimize software usage, personalized notifications are generated in real time. These notifications can be sent directly to the terminals via email or integrated into the user interface.This process aims for centralized, proactive, and automated governance to strengthen the compliance, security, and efficiency of applications used within an organization. See Figure 1 for an abstract.

The invention discloses a high-security software scheduling method based on a functional module, and relates to the field of civil aircraft airborne software, and the method comprises the following steps: constructing a three-level scheduling model comprising a sequence, a sequence and scheduling, and realizing fine management of the functional module through a sequence-sequence-scheduling hierarchical structure; a phase-based deterministic scheduling algorithm is adopted to ensure that a functional module is strictly executed in a specified period and phase; and designing high-security characteristics, including static resource verification and fault tolerance, modular execution atomization and determinacy of an execution process. The airborne software scheduling method has the advantages that efficient and flexible task scheduling, static configuration verification and fault tolerance and modular atomization execution are realized by constructing a three-level scheduling model, adopting a phase-based deterministic scheduling algorithm and designing a high-safety characteristic, and the safety, reliability and maintainability of airborne software scheduling are remarkably improved.

Methods, systems, and apparatuses for securely delivering software artifacts. A first computing device may be configured to encrypt one or more software artifacts into an encrypted data file and encrypt a key and a policy file associated with the encrypted data file and send the encrypted data file, key, and policy file to a second computing device. The policy file may comprise policy information for authenticating access to the encrypted data file. The second computing device may use the key and the policy information to access and authenticate a software application of the second computing device. The software application may be used to decrypt the data file and access the one or more software artifacts.