83 results about "Security software" patented technology

Systems and methods for prioritizing various security findings to allow a security platform to focus on a proper subset of (e.g., the most important) one or more software application stacks of an enterprise are described. In one embodiment, a method includes generating a profile for an enterprise that indicates one or more software application stacks and a network architecture for the one or more software application stacks, determining one or more vulnerability features of the one or more software application stacks, generating one or more exploitability scores by a first machine learning model based at least in part on the one or more vulnerability features, determining a proper subset of the one or more software application stacks based at least in part on the one or more exploitability scores, determining one or more vulnerabilities of the proper subset of the one or more software application stacks and one or more vulnerabilities of the network architecture, providing the one or more vulnerabilities of the proper subset of the one or more software application stacks, the one or more vulnerabilities of the network architecture, and the profile as input to a second machine learning model, generating an inference by the second machine learning model that indicates one or more attack paths for an attacker in the proper subset of the one or more software application stacks and the network architecture, and transmitting the inference to a storage location or a security software application.

A method for restoring a data volume, comprising: receiving a request to restore the data volume; identifying a risk map that is associated with the data volume, the risk map including a plurality of entries, each entry mapping a different respective one of a plurality of snapshot identifiers to a respective risk assessment score for a snapshot corresponding to the snapshot identifier, the respective risk assessment score being generated by security software, the respective risk assessment score representing a level of threat or potential harm posed by one or more files in the data volume; identifying a risk policy that corresponds to the data volume; retrieving the risk assessment score threshold from the risk policy; performing a search of the risk map to identify a snapshot whose respective risk assessment score satisfies the risk assessment score threshold; and using the identified snapshot to restore the data volume.

The invention provides a computer network security software debugging method and system, and the method comprises the steps: setting a plurality of test nodes of a source program in target network security software, and positioning a key test node based on the execution state of each test node; constructing a target search domain when the source program is tested through the program context information of the key test node; determining a plurality of abnormal program slices in the source program based on the static control flow diagram and the dynamic control flow diagram of the program code in the target search domain; determining the test overhead of each program slice according to the test coverage information of each program slice and the path complexity when the source program executes the test data; determining the constraint level of each program slice according to all the test overhead and the membership relationship among the program slices; and debugging each program slice through the constraint level of each program slice. According to the scheme, on the basis of the constraint level of each program slice, the problem code line can be accurately pointed in the network security software debugging process.

The invention provides a method and a system for identifying and processing abnormal startup and shutdown of measurement and control equipment of a satellite service system. The method comprises the following steps of: S1, de-noising telemetry information received by a preprocessed measurement and control responder by using a filtering model; s2, dynamically adjusting the weight ratio of the signal strength, the error rate and the response time to evaluate the on-orbit performance of the measurement and control responder; and S3, if the measurement and control responder is in a normal working state and receives a host or standby shutdown instruction of the responder, firstly judging the state of the whole satellite, then judging the code block telemetering information, and if no problem exists, judging the instruction as an abnormal behavior, and shielding the instruction by the security software. According to the method, the new measurement value can be responded in real time through continuously updating the state estimation by adopting the Erman filtering, and the adaptability of the system to the dynamic change is ensured; the system characteristics are judged through linear fitting, and the Kalman gain is calculated, so that the weighting between the predicted value and the measured value is more accurate.

The invention belongs to the field of network security, and relates to a method and a device for constructing a network security operating system, electronic equipment and a storage medium, and the method comprises the following steps: constructing an autonomously controllable improved microkernel infrastructure; based on the microkernel infrastructure, constructing a full-stack layered security control computing architecture base; constructing intelligent agent components, and deploying a multi-intelligent agent collaborative protection component system; integrating trusted computing and an integrity measurement verification system; performing dynamic adaptation and execution of multiple security policies; and a standardized safety evaluation and adaptive optimization closed loop is established. A trusted computing base is cut from a design source, so that the probability of occurrence of high-risk vulnerabilities is reduced; the real-time defense that the threat is changed and the strategy is changed is realized, and the blind area of the static strategy in resisting the unknown threat is made up; the malicious codes can be blocked before running, and the post passive situation that traditional security software only depends on a feature library for searching and killing is broken; and the contradiction between security capability solidification and threat dynamic evolution is fundamentally solved.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention provides a method and a system for periodically maintaining and upgrading satellite security software. The method comprises the following steps of: S1, configuring a satellite-borne simulation system; s2, a satellite state assembly receives and responds to a remote control instruction injected on the ground, simulates the satellite working state and simulates the satellite temperature change; s3, the access authentication component checks the remote control instruction accessed to the satellite-borne simulation system, and verifies the remote control data packet through random key authentication and cyclic redundancy check; s4, setting test time, regularly testing the security software, summarizing test results, and updating the test results to a database so as to evaluate whether the security software works normally or not; and S5, upgrading the security software, notifying the ground through telemetry information after the upgrading is successful, testing the upgraded security software, and finally mapping the upgraded software into a real environment. According to the method, the security software cannot be interrupted during upgrading, and the security of the satellite software during upgrading can be ensured.

A cloud-based industrial safety system executes safety applications and interfaces with industrial assets on the plant floor using software encoded processing (SEP). The use of SEP ensures safety reliable execution of safety applications and data communication software by redundantly executing native code, thereby implementing a level of software-based fault detection that is independent of the hardware on which the safety application operates. This allows the cloud-based industrial safety applications to achieve at least SIL3 safety ratings for safety services even though the safety applications are executed using standard COTS hardware that is commonplace in the server market. The use of SEP to reliably execute safety software on the cloud can make possible a wide variety of safety applications that would be difficult to implement using purely localized industrial safety systems.

A system and method are provided for real-time detection of code integrity violations by combining behavioral stylometry, biometric fingerprinting, and environmental threat analysis. Baseline data of a user's coding style such as indentation, variable naming, and keystroke patterns are stored and compared to live input to calculate deviation scores. Typing behaviors like dwell time, rhythm, and simulated pressure form a biometric fingerprint, while environmental scans detect suspicious network activity, browser extensions, or virtual machine use. A combined risk score is generated, and automated interventions are triggered when it exceeds a threshold, enabling early detection of unauthorized access, AI-generated code, or compromised environments for secure software development.

The present invention provides a method and system for identifying and processing abnormal power-on and power-off of a TT&C device in a satellite service system, including: S1: Denoising the telemetry information received by the preprocessed TT&C transponder using a filtering model; S2: Dynamically adjusting the weight ratios of signal strength, bit error rate, and response time to evaluate the on-orbit performance of the TT&C transponder; S3: If the TT&C transponder is in a normal working state and receives a power-off instruction from the main or standby transponder host, first judge the overall satellite state, and then judge the block telemetry information. If there are no problems, then judge this instruction as an abnormal behavior, and the security software will block it. The present invention uses Kalman filtering to continuously update the state estimate, can respond to new measurement values in real time, and ensure the adaptability of the system to dynamic changes; judges the system characteristics through linear fitting and calculates the Kalman gain, making the weighting between the predicted value and the measured value more accurate.

Techniques for cryptographic computing isolation are described. A processor includes circuitry to be coupled to memory configured to store one or more instructions. The circuitry is to execute the one or more instructions to instantiate a first process based on an application. To instantiate the first process is to include creating a context table to be used by the first process, identifying a software component to be invoked during the first process, encrypting the software component using a first cryptographic key, and creating a first entry in the context table. The first entry is to include first context information identifying the encrypted software component and second context information representing the first cryptographic key. In more specific embodiments, third context information representing a first load address of the encrypted software component is stored in the first entry of the context table.

1. Name of the product in this design: Graphical User Interface for a Trusted Security Management System for Computing Boards in Electronic Devices. 2. Purpose of this design: An electronic device. 3. The key design feature of this product lies in the graphical user interface on the screen. 4. The picture or photo that best illustrates the key design points: Design 1 front view. 5. Design 1 is designated as the basic design. 6. Purpose of the graphical user interface: This design is used to configure the trusted security management policy of the computing board hardware and display the status log of policy protection execution. 7. Human-computer interaction method of graphical user interface: After the program runs, the main view of Design 1 appears; click the "Whitelist" button in the middle of the main view of Design 1 to enter the whitelist interface of the computing board dynamic and static measurement security software, i.e., the interface change state diagram 1 of Design 1; click the "Remote Proof" button on the left side of the interface change state diagram 1 to enter the remote proof execution status log interface of the computing board, i.e., the interface change state diagram 2 of Design 1; click the "Critical Process" button on the left side of the interface change state diagram 2 of Design 1 to enter the critical process protection policy configuration interface of the computing board, i.e., the interface change state diagram 3 of Design 1; click the "Log" button in the interface change state diagram 3 of Design 1 to enter the critical process protection status log display interface of the computing board, i.e., the interface change state diagram 4 of Design 1; click the "Critical Directory" button on the left side of the interface change state diagram 4 of Design 1 to enter the critical directory protection policy configuration interface of the computing board, i.e., the interface change state diagram 5 of Design 1. After the program runs, the main view of Design 2 will appear. Click the "Board Middleware" button on the left side of the main view of Design 2 to enter the middleware management interface of the calculation board software, which is the interface change status diagram of Design 2.

To enable a risk to a target system to be evaluated due to vulnerability of security countermeasure software.SOLUTION: An information processing system 1 comprises a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, and an output unit 18E. The first identification unit 18B identifies a menace type which can be addressed by installed software, the installed software being security countermeasure software that has been installed in a target system 30, among the security countermeasure software to which vulnerability has been reported. The first calculation unit 18C calculates a first risk value when addressing menace of the identified menace type by the installed software. The second calculation unit 18D calculates a second risk value when not addressing the menace of the identified menace type by the installed software. The output unit 18E outputs damage possibility information including risk value change information showing a change of the second risk value with respect to the first risk value.SELECTED DRAWING: Figure 2

The application provides a computer network security software debugging method and system. A plurality of test nodes of a source program in target network security software are set, a key test node is located based on an execution state at each test node, and a target search domain when the source program is tested is constructed by program context information of the key test node. A plurality of program slices with abnormalities in the source program are determined based on a static control flow graph and a dynamic control flow graph of program code in the target search domain. Test overhead of each program slice is determined according to test coverage information of each program slice and path complexity when the source program is tested. Constraint levels of each program slice are determined according to all test overhead and membership between each program slice. Each program slice is debugged through the constraint level of each program slice. The above scheme can accurately point to a problem code line in a network security software debugging process based on constraint levels of each program slice.

During development, a whitelist is automatically created that includes entries for all programs that will run on the target device. Security software is included in the installation package. After the installation package is installed, the operating system runs the system security software and the system security software intercepts attempts to run any program and only allows programs to run that match an entry in the whitelist. In some embodiments, an entitlement file is created (manually, automatically, or a combination of both) and is included in the installation package. In such embodiments, after initialization, the system security software intercepts attempts to access resources of the target device by programs and only allows access to resources that are identified in the entitlement file for that program.

The invention provides a malicious code detection method and system based on semantic analysis, and the method comprises the steps: determining a space where a suspicious code is located based on a monitoring behavior record of security software in a terminal, extracting a target code in the space, and reducing a subsequent malicious code detection interval range; based on the semantic feature extraction model and the text semantic classification model, generating a word sequence containing semantic information corresponding to the target code, and correcting the word sequence; analyzing the corrected word sequence based on a deep text classification model to obtain global text semantics of the target code so as to calibrate malicious code snippets in the target code, and performing code change operation on the space based on distribution characteristics of the malicious code snippets to obtain the target code. And meanwhile, global recognition is performed on the codes by utilizing a semantic feature extraction model and a text semantic classification model, efficient and accurate analysis of code semantics is considered, semantic information of the codes is comprehensively extracted, malicious code components are recognized and positioned in massive codes, and the working accuracy and reliability of security software are improved.

The embodiments herein provide a method and a system for security risk identification and controlling release management of software application. The method provides security risk identification in a software application as well as integrated tools to direct the efforts of developers to build and maintain secure software. The method provides a unique approach of defining a plurality of Service Level Agreement (SLA) to control a release build for a software application by checking vulnerabilities. Furthermore, the method is flexible enough to adapt in most complicated enterprises and different Software Development Life Cycle (SDLC) processes.

The invention provides a portable AVC automatic joint debugging test device and method, and belongs to the technical field of power equipment. The device comprises a communication module, a data acquisition module, a user interface module, an application program module, a communication protocol stack module, a security software module and a data processing library module. The method comprises the following steps: generating a task request, sending the task request to a command theme subscribed by each AVC substation, obtaining real-time data collected by each AVC substation, decrypting and verifying to obtain plaintext data, inputting a dynamic and static curve real-time discrimination model constructed based on a deep reinforcement learning network, outputting a dynamic and static curve discrimination result, and outputting the dynamic and static curve discrimination result. And inputting a PID parameter cost function constructed by a model prediction control algorithm, solving optimized PID parameters of each substation, and issuing the optimized PID parameters to each AVC substation to recollect data until the comprehensive performance grade of each AVC substation is qualified. According to the invention, the blank of the AVC substation joint debugging test device is filled, and the judgment accuracy of the multi-AVC substation joint debugging test result is improved.

The invention provides a motor function safety monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of motors. The method comprises the following steps: executing a first-class interrupt processing flow corresponding to a current first-class interrupt task in a time interval from entering the current first-class interrupt task to entering the next first-class interrupt task of the current time, and executing a second-class interrupt task in response to a trigger command for the second-class interrupt task: activating a safety monitoring task, executing a security monitoring processing flow in the security monitoring task; according to the method, the second-class interruption task is triggered in a software triggering mode, and the safety monitoring task is activated in the second-class interruption task processing, so that the problem that the first-class interruption task is limited by the time of a fixed period is avoided, and the increasing requirement of the complexity of motor function safety software is met.

The present invention relates to a method for managing software on computer terminals (computers, mobile phones, tablets) used by a community within an entity with security policies. Each terminal incorporates a data collection module that monitors user interactions with various applications in real time. The process includes recording usage references, identifying the applications used, and collecting associated data. This data is analyzed to identify applications in real time and detect anomalies compared to normal usage. In the event of abnormal behavior or to optimize software usage, personalized notifications are generated in real time. These notifications can be sent directly to the terminals via email or integrated into the user interface.This process aims for centralized, proactive, and automated governance to strengthen the compliance, security, and efficiency of applications used within an organization. See Figure 1 for an abstract.

The invention discloses a high-security software scheduling method based on a functional module, and relates to the field of civil aircraft airborne software, and the method comprises the following steps: constructing a three-level scheduling model comprising a sequence, a sequence and scheduling, and realizing fine management of the functional module through a sequence-sequence-scheduling hierarchical structure; a phase-based deterministic scheduling algorithm is adopted to ensure that a functional module is strictly executed in a specified period and phase; and designing high-security characteristics, including static resource verification and fault tolerance, modular execution atomization and determinacy of an execution process. The airborne software scheduling method has the advantages that efficient and flexible task scheduling, static configuration verification and fault tolerance and modular atomization execution are realized by constructing a three-level scheduling model, adopting a phase-based deterministic scheduling algorithm and designing a high-safety characteristic, and the safety, reliability and maintainability of airborne software scheduling are remarkably improved.

Methods, systems, and apparatuses for securely delivering software artifacts. A first computing device may be configured to encrypt one or more software artifacts into an encrypted data file and encrypt a key and a policy file associated with the encrypted data file and send the encrypted data file, key, and policy file to a second computing device. The policy file may comprise policy information for authenticating access to the encrypted data file. The second computing device may use the key and the policy information to access and authenticate a software application of the second computing device. The software application may be used to decrypt the data file and access the one or more software artifacts.

The embodiments relate to improved security in computing devices. In some aspects, the techniques described herein relate to a device including: a secure storage area, the secure storage area including a first public key written during manufacturing of the device; a controller configured to: receive data, the data including a payload, digital certificate, and digital signature, validate the digital certificate using the first public key, extract a second public key from the digital certificate; validate the digital signature using the second public key; and process the payload.

The present invention provides a method for obtaining the type of an executable file under Linux, which relates to the technical field of Linux system applications. The method includes: obtaining the basic attribute information of a target file and preprocessing the file; reading the content of the file in binary mode and matching the characteristic binary value string of the file with a preset characteristic value; selectively performing file name matching, binary file content matching, and text content matching according to the characteristic value matching result; and finally, selectively performing file name suffix matching according to the text content matching result. By comprehensively judging the type of the executable file from multiple dimensions such as the basic attribute information of the file, the characteristic value of the binary content of the file, the characteristic value of the readable string content of the file, and the characteristic value of the file name suffix, the type to which the executable file under Linux belongs can be accurately obtained, which further helps the effective implementation of functions such as the running blocking control of the executable file by the system security software.

The present application discloses a kernel architecture based on the PKS system, including: the user area in the dual-architecture processor is used to call the operating system security module LSM to provide functions for security software to hook the sub to uniformly manage software hooking, and to allocate operating resources for the hooked security software; the security area in the dual-architecture processor is used to call the TEE module to perform security verification and signature on the code loaded into the kernel when a resource access request is obtained, and if the verification and signature pass, the code loaded into the kernel is run; among them, the permission of the security area is higher than that of the user area; the UEFI module is used to perform trusted measurement on the UEFI firmware and the operating system through interaction with the TEE module to achieve trusted boot. The kernel architecture of the present application can obtain the computing space state in real time for protection, avoiding the few security space functions and weak performance caused by the dual-architecture with external security.

The invention relates to a method to entrust requested data at a relying party, said requested data coming from an unsecure software component in a user equipment of a user, said user equipment having a secure component storing data hash of said data and having a pseudonym. The secure component produces a cryptogram being a concatenation of several ciphertexts successively obtained by chaining executions of a trust cryptography function using a secure component's secret key, said function being applied to successive plaintexts comprising at least the secure component's pseudonym and data hash of the data corresponding to data's references requested by the relying party which then receives and deciphers the requested data that has been enciphered by the software component using the last ciphertext concatenated in at least said cryptogram and an applicative cryptography algorithm. The cryptogram is sent to a trust service for de-concatenation and chaining executions of a trust cryptography function correlated to the trust cryptography function of the secure component to extract the secure component's pseudonym and the data hash of the data corresponding to the given data's reference in successive de-ciphered plaintexts. The method entrusts received deciphered data only if the extracted pseudonym corresponds to the received pseudonym, and if the data hash corresponding to the given data's reference extracted by the trust service corresponds to the data hash corresponding to the given data's reference calculated by the relying party.

A method for secure software supply chain delivery includes storing a vendor secret on a computing device while the computing device is at a manufacturer and querying, by a vendor cloud provisioner, the manufacturer for a serial number and a computing device secret. The method includes binding the computing device secret and the serial number and correlating a customer and provisioning instructions of the customer with the serial number of the computing device. The method includes receiving, from the computing device located where the computing device is to be provisioned, a request for the provisioning instructions, exchanging credentials between the computing device and the vendor cloud provisioner using the computing device secret and the vendor secret, and transmitting the provisioning instructions to the computing device in response a successful exchange of credentials between the computing device and the vendor cloud provisioner and / or receiving the serial number from the computing device.

A system and method for software image management. A method includes generating a plurality of software packages including a plurality of units of code, wherein each software package is generated using a respective unit of code of the plurality of units of code, wherein the plurality of software packages includes a security package, wherein the respective unit of code for the security package configures a processing circuitry to perform at least one cybersecurity function when executed by the processing circuitry; and building a software image based on the plurality of software packages by executing a set of instructions of a file, wherein the set of instructions causes the plurality of software packages to be combined in order to build the software image when executed.

The present application relates to a device access method, a network request access method, a device access device, a network request access device, a computer device, a computer-readable storage medium, and a computer program product, and relates to the field of information security technology. By receiving the hardware feature code of the target device requesting network access and security software information, a random key is generated. If it is determined based on the hardware feature code that the target device belongs to an organizational asset, a random number is generated, and then the control terminal encrypts the received random number according to the random key to obtain first encrypted data. The authentication server encrypts the locally generated random number with the received random key to obtain second encrypted data. If the second encrypted data is the same as the first encrypted data, the security score is determined based on the security software information and the hardware feature code, and the network access of the target device is controlled according to the security score. The use of this method can improve the reliability of controlling the access of external devices to the internal network of the enterprise.