189 results about "Spoofing attack" patented technology

The invention relates to the technical field of face detection, and particularly discloses a face recognition system based on a face mask detection model, which is used for solving the problems of face recognition accuracy reduction and counterfeiting risk caused by mask shielding, counterfeiting attack and multi-source environment interference in high-security sensitive scenes such as a banking business window and the like. The system comprises a data acquisition and enhancement module, a feature extraction and multi-task neural network discrimination module, a counterfeit attack detection and risk blocking module, and a system deployment and model adaptive training module. According to the invention, through integration of multi-channel high-resolution visible light and infrared imaging, forgery attack sample enhancement based on the generative adversarial network, adaptive difficult sample sampling and multi-task deep discrimination network collaborative optimization, efficient recognition and real-time risk blocking of real and forgery mask faces are realized; and the security and robustness of a face recognition system in scenes such as banks are improved.

The invention discloses an MES (Manufacturing Execution System) login authentication method based on a face recognition technology, which relates to the technical field of industrial information security, and comprises the following steps of: constructing an authentication data acquiring a face image of an authorized user of an MES, extracting a reference face feature template after preprocessing, and constructing the authentication database; performing associated storage on the reference feature template, user identity information, preset operation authority and affiliated production station information to form an authentication database; according to the method, spoofing attacks are prevented through multi-mode living body detection, and the problem that a traditional password / key is easy to leak and borrow is solved in combination with uniqueness of human face biological characteristics; a person-post-terminal binding mechanism further limits permission abuse, and internal operation risks are reduced; the non-contact authentication does not need to memorize a password or carry a physical key, and is suitable for a working scene that a workshop operator wears gloves and holds tools; and the recognition passing rate in a complex industrial environment is improved through dynamic threshold optimization.

The invention discloses a multi-modal attack identification method fusing BMama and difference to guide trans-attention, which comprises the following steps: simulating a false data injection attack, a denial of service attack, an address resolution protocol spoofing attack and a domain name system spoofing attack, collecting physical layer sensor data and network layer flow data, and preprocessing multi-modal data; bMama is constructed to perform dynamic time modeling on multi-modal data, a graph neural network is combined to adversariate a variational auto-encoder, features of a power grid system topology and a communication topology structure are fused, and robustness of potential representation is enhanced through adversarial training; the method comprises the following steps of: guiding feature complementary fusion by using modal difference through a difference guide iteration cross-attention fusion mechanism, improving the capability of distinguishing complex attacks, finally carrying out attack detection and classification on fused modals, and executing end-to-end optimization according to a weighted combination of loss of each part. The method can effectively detect and classify the multi-modal attack in the smart power grid, and enhances the safety and reliability of a complex system.

The invention provides a deception detection method and device for ship navigation and PNT trusted terminal equipment. The method comprises the following steps: acquiring shore-based trusted service data, the credibility of a navigation system, global navigation satellite GNSS data and multi-class navigation sensor data; determining a first deception probability in a preset time period according to the multi-class navigation sensor data and a preset data threshold value of the multi-class navigation sensor; according to the multi-class navigation sensor data, the GNSS data, the shore-based trusted service data and the credibility, performing fusion positioning through Kalman filtering to obtain trusted fusion positioning; determining a second deception probability within a preset time period according to the trusted fusion positioning and the GNSS data; determining a target deception probability according to the first deception probability, the second deception probability and the credibility; and outputting the target deception probability. Through the method, the ship navigation spoofing attack can be effectively detected, the spoofing probability is output, and the navigation safety is improved.

The invention discloses a novel encryption-decryption scheme, and aims to detect and defend linear spoofing attacks on a cyber-physical system (CPS). With the wide application of CPS in key infrastructures such as industrial automation, smart power grids and automobile systems, it is particularly important to ensure the safety and integrity of CPS. Linear spoofing attacks are malicious behaviors, normal operation of the linear spoofing attacks is interfered by controlling input or output of a system, and a traditional security mechanism is often difficult to effectively cope with the type of attacks. According to the invention, an encryption algorithm is designed to protect data transmission of the CPS, and the encryption algorithm is combined to recover original data and identify potential attack signs at the same time. According to the scheme, the combination of the cryptography technology and the signal processing method is utilized, the data stream can be monitored in real time, and the possible linear attack is identified by analyzing the change of the data before and after encryption. In addition, according to the scheme, calculation efficiency and implementation feasibility are considered, and it is ensured that necessary safety guarantee is provided on the premise that system performance is not affected. Experimental results show that the proposed encryption-decryption scheme can effectively detect linear spoofing attacks in the cyber-physical system, and has relatively low false alarm rate and missing report rate. In addition, the scheme shows good adaptability and robustness in practical application, and provides a new thought and technical support for the security protection of the CPS in the future.

The embodiment of the invention provides a coupling network asynchronous dynamic intermittent safety control method and system, and the method comprises the steps: obtaining multiple attack signals comprising an injection attack signal and a replacement attack signal after building a dynamic model of a following network, a target network and a state error variable; and setting an intermittent controller according to the dynamic network model and the multiple attack signals, and setting a dynamic mechanism based on an exponential function to convert a state error variable into an interval control function. Wherein the interval control function is used for realizing security mean square synchronization control between the following network model and the target network model. According to the method, the asynchronous anti-attack intermittent dynamic cooperative control strategy oriented to the complex coupled network can be constructed based on an average intermittent control rate and dynamic event trigger threshold coupling method by utilizing a node self-adaptive dual spoofing attack probability model, and the problems of difficulty in multi-attack modeling and insufficient control strategy collaboration can be relieved.

A method for detecting spoofing attacks on a UAV includes receiving signals from the UAV that is an edge device of a decentralized network, transmitting the signals to a fog node of the decentralized network, and detecting the spoofing attacks by detecting slow shifting patterns and running a trained attack detection model at the fog node for the signals. The decentralized network is based on an edge-fog-cloud computing paradigm.

The invention provides an unmanned aerial vehicle GPS spoofing attack detection method and device based on comparative learning and Mama, and relates to the technical field of unmanned aerial vehicle navigation safety monitoring. The method comprises the following steps: acquiring navigation data of a GPS (Global Positioning System) of an unmanned aerial vehicle, preprocessing the navigation data to generate a plurality of track subsequences with fixed window lengths, obtaining initial time domain data, and performing frequency domain conversion processing on the navigation data to obtain initial frequency domain data; inputting the initial time domain data and the initial frequency domain data into a trained double-branch Mama model for feature extraction, and outputting time domain features and frequency domain features; calculating a spoofing score according to the time domain feature and the frequency domain feature, and determining a spoofing attack behavior detection result according to the spoofing score; wherein two branches in the double-branch Mama model share a weight; the spoofing attack detection model is obtained based on comparative learning strategy training. According to the method, the modeling efficiency and the detection accuracy of the long-sequence navigation data can be considered while the dependence on manual labels is reduced.

The invention discloses a self-adaptive finite time fuzzy safety control method for a flexible joint mechanical arm, which comprises the following steps that a flexible joint mechanical arm state space model influenced by spoofing attack is established, and a control signal comprises an unknown time-varying parameter and an unknown bounded attack function; introducing a Nussbaum function meeting a preset limit integral property; designing a control method based on a finite time stability principle, and ensuring that a system state converges to a bounded residual set within finite time; a fuzzy logic system is adopted to approach an unknown nonlinear function in the mechanical arm model; defining an error variable through coordinate transformation, and constructing a parameter which exponentially decays along with time; constructing a Lyapunov function containing the exponential decay parameter, and designing a virtual control function, a controller and a parameter adaptive law based on the function; and the Nussbaum function is constructed to be used for processing the unknown time-varying parameters. According to the invention, the influence of spoofing attacks on state signals can be reduced.

The invention relates to the technical field of household equipment intrusion detection, in particular to a mimicry intrusion detection method and system for household equipment, and the method comprises the steps: S0, starting credible verification and initialization; the method comprises the following steps: S1, carrying out multi-modal feature fusion processing; s2, disturbance type joint detection; s3, graded elastic response is carried out; s4, updating the self-adaptive model; s5, identifying a semantic exception instruction; and S6, neural morphology calculation is accelerated. According to the method, damage attack path dependence is detected through dynamic disturbance, multi-modal features are fused through a modal alignment mechanism, low-power-consumption acceleration is achieved through neuromorphic hardware, semantic anomaly instruction recognition and brain-like feedback offline optimization are combined, and the core problem that high-precision detection and high robustness cannot be considered at the same time in the prior art is solved; and particularly, real-time attacks and semantic spoofing attacks of unknown vulnerabilities are effectively resisted.

The invention relates to the technical field of information security, in particular to a sensitive information detection technology and system based on multi-mode and steganography detection.The sensitive information detection technology and system based on multi-mode and steganography detection.The method comprises the steps that firstly, through a format tampering prevention module, file header information and binary data analysis are utilized, the real type of a file is verified, and format camouflage attacks are prevented; the sensitive data detection module adopts DistilBERT and LSTM structures to preprocess a text, extract text embedding, mine text features through a bidirectional LSTM and Attention mechanism, and finally accurately judge whether the text contains sensitive information or not; the joint content and file steganography detection module fuses a convolutional neural network and multi-modal learning, adopts corresponding models for different data types to carry out steganography information detection, integrates results through a multi-modal neural network, and applies multi-modal feedback and a cross-modal reasoning mechanism to improve the detection accuracy; according to the method, the accuracy, comprehensiveness and system adaptability of sensitive information detection are effectively enhanced.

Endpoints in a network execute a sensor module that intercepts responses from a directory service to a source on the endpoint. The sensor module determines if the source is sanctioned, such as by referencing a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.

The invention provides a pinned pulse safety synchronization control method and system of a multi-coupling time-delay network, and the method comprises the technical schemes: building a coupling time-delay dynamic network model, constructing a mathematical description of a random spoofing attack, designing a pinned pulse safety controller, and deducing a Lyapunov stability discriminant. Through defining an error system of a following network and a target network, under a pinned pulse safety control framework, based on a pulse system theory, system stability is analyzed, an attack probability is described in combination with a Bernoulli random variable, a pinned pulse control node selection strategy is finally designed, and safety synchronous control is successfully realized. The mechanism can effectively extract time delay information with a stabilization effect in a continuous system, and fuses the time delay information into the design of an anti-attack containment pulse safety controller, so that the synchronization safety of the system is remarkably improved, the resource allocation efficiency is optimized, and the attack influence is weakened by utilizing inherent time delay.

Endpoints in a network execute a sensor module that intercepts commands. The sensor module compares a source of commands to a sanctioned list of applications received from a management server. If the source does not match a sanctioned application and the command is a write or delete command, the command is ignored and a simulated acknowledgment is sent. If the command is a read command, deception data is returned instead. In some embodiments, certain data is protected such that commands will be ignored or modified to refer to deception data where the source is not a sanctioned application. The source may be verified to be a sanctioned application by evaluating a certificate, hash, or path of the source. Responses from an active directory server may be intercepted and modified to reference a decoy server when not addressed to a sanctioned application.

The invention discloses a performance control method of a limited nonlinear information physical system, which belongs to the technical field of intrusion tolerance control of information physical systems, and comprises the following steps of: establishing a control-oriented dynamic model of the limited nonlinear information physical system with external disturbance under spoofing attack; mathematical characterization is carried out on bounded multiplicative and additive spoofing attacks; a Lyapunov function based on a preset performance control method is constructed, and a system stability determination method based on a Nusb inequality is given; and coordinate change is introduced to meet full-state constraint, and a fixed time controller is designed by using a backstepping method, so that preset performance control of the limited nonlinear information physical system under spoofing attack and external disturbance is realized. The invention develops a fixed time intrusion tolerance controller based on a preset performance method, which can ensure the stable operation of a limited nonlinear information physical system under a spoofing attack with a small tracking error.

The invention discloses a multi-agent sliding mode safety control method based on dynamic event triggering under hybrid network attack, and the control method comprises the following steps: building a multi-agent system model comprising spoofing attack and DoS attack; in order to cope with hybrid network attacks, an integral sliding mode surface function is constructed, an online estimation method is provided, and an unknown network attack mode can be estimated in real time in the absence of prior information; a novel self-adaptive sliding mode controller is developed, and the accessibility of a preset sliding mode surface is ensured; by introducing an auxiliary variable, a dynamic and static event triggering mechanism in the framework is considered, so that the use of communication resources is minimized; a Lyapunov stability theory and a finite time method are utilized to analyze the convergence of the multi-agent system under the control strategy. According to the control method provided by the invention, the influence of spoofing attack and DoS attack on the system can be eliminated, so that the state of the multi-agent system is consistent within finite time.

The invention relates to the technical field of deception jamming detection, and particularly discloses an integrated learning high-sensitivity dynamic GNSS deception detection method, which comprises the following steps: acquiring an output signal of a multi-correlator array, and calculating to obtain an in-phase channel multi-correlator SQM index and an orthogonal channel multi-correlator SQM index; carrying out processing by adopting indirect Kalman filtering to obtain a smoothed in-phase channel multi-correlator SQM index, a smoothed orthogonal channel multi-correlator SQM index and a steady state estimation error variance; constructing alternative deception detection indexes; selecting one of the alternative deception detection indexes as a deception detection index through a plurality of machine learning models; and judging whether the spoofing attack occurs or not according to a comparison result of the spoofing attack and a corresponding threshold value. According to the method, dynamic detection index selection is realized through integrated learning so as to cope with different spoofing attack conditions, and the spoofing attack detection efficiency can be remarkably improved.

The invention discloses a T-S fuzzy model-based two-stage anti-attack coupling memristive neural network finite time bipartite synchronization control method. The method comprises the steps of establishing a memristive neural network model and a symbol topological structure; converting the memristive neural network model into a fuzzy coupling memristive neural network model, defining a synchronous error state variable, and establishing an error system of the memristive neural network; converting the error system into a form based on differential inclusion; a two-stage finite time synchronous controller is designed, in the first stage, when the state of an error system meets the condition, a pulse controller based on a hybrid trigger mechanism is designed to resist spoofing attacks; and in the second stage, a controller combining finite time control and fixed time control mechanisms is designed to resist DoS attacks. According to the invention, a two-stage controller is designed, and the controller integrates pulse safety control, feedback control and a finite time and control mechanism, and can simultaneously resist spoofing attacks with energy constraints and DoS attacks with random outbreak features.

The present invention improves determination accuracy of a spoofing attack on biometric authentication.　An information processing device (10) determines the brightness of image data (13) from a plurality of pixel values included in the image data (13). The information processing device (10) generates, from the image data (13), frequency component data (14) indicating a frequency component of a frequency section corresponding to the brightness so as to indicate a frequency component of a frequency section (16a) when the brightness is at a level (15a), and to indicate a frequency component of a frequency section (16b) including the frequency higher than that of the frequency section (16a) when the brightness is at a level (15b) that is higher than the level (15a). The information processing device (10) inputs the image data (13) and the frequency component data (14) into a machine learning model (17), thereby determining whether the image data (13) indicates a spoofing attack on biometric authentication.

Traditional speaker verification systems are vulnerable to voice spoofing attacks, such as voice-replay attack, voice-cloning attack, and cloned-replay attack. To overcome these vulnerabilities, a secure automatic speaker verification system based on a novel sign modified acoustic local ternary pattern (sm-ALTP) features and asymmetric bagging-based classifier-ensemble with enhanced attack vector is presented. The proposed audio representation approach clusters the high and low frequency components in audio frames by normally distributing them against a convex function. Afterwards, the neighborhood statistics are applied to capture the user specific vocal tract information.

The invention provides a high-order multi-agent event triggering predefined time consensus control method under a spoofing attack, which comprises the following steps: modeling the spoofing attack as an unknown bounded nonlinear disturbance signal, and non-linearly coupling the nonlinear disturbance signal with a system state through a time-varying coefficient; through a distributed predefined time state observer, the real state of the agent masked by the attack is estimated in real time through neighborhood information interaction, and an attack signal is separated; dynamically adjusting control parameters through an adaptive law based on observer output and post-attack state difference so as to compensate state deviation caused by the attack; each agent is provided with a local control law, the input of the local control law is an observer estimation state of the agent and a neighbor, an acceleration item is introduced into the control law, and a preset convergence time upper bound is realized through preset parameters; parameters of the control law are updated based on local adjacency information of a Laplacian matrix, and distributed consensus tracking is completed only depending on states of adjacent agents.

The embodiment of the present application provides a method and system for asynchronous dynamic intermittent safety control of a coupled network. The method can obtain multiple attack signals including injection attack signals and replacement attack signals after establishing a dynamic model of a follower network, a target network, and a state error variable, and set an intermittent controller according to the dynamic network model and the multiple attack signals, and then set a dynamic mechanism based on an exponential function to convert the state error variable into an interval control function. The interval control function is used to achieve safe mean square synchronization control between the follower network model and the target network model. The method can utilize a node-adaptive double deception attack probability model, based on the average intermittent control rate and the dynamic event trigger threshold coupling method, to construct an asynchronous anti-attack intermittent dynamic collaborative control strategy for complex coupled networks, which can alleviate the difficulties in modeling multiple attacks and the lack of coordination of control strategies.

The invention provides a factor graph optimization train positioning method for resisting satellite navigation spoofing attacks. The method comprises the following steps: determining a factor graph model with deception mitigation capability and related parameters; when the information frame of the speed and distance measuring sensor is received, calculating the pre-integration position of the speed and distance measuring sensor; determining a nearest orbit slice in the orbit information, sensing a deception event and identifying a deception satellite in the visual satellites; constructing a self-adaptive pseudo-range factor of a real / deception satellite, a pre-integration factor of a speed and distance measuring sensor and a combined optimization factor graph, and solving a positioning solution of the train; and calculating a pseudo-range residual error according to the positioning solution, compensating the residual error of the deception satellite, updating a residual error pool, fitting residual error distribution of each visual satellite in the residual error pool, calculating an adaptive weight, and continuing iteration to obtain an optimal positioning solution of the train. According to the method, deception attack detection, identification and mitigation are realized based on a factor graph optimization framework, the real operation state of the train before attack is recovered, and the deception defense capability is enhanced.

In various examples, techniques are described for detecting whether spoofing attacks are occurring using multiple sensors. Systems and methods are disclosed that include at least a first sensor having a first pose to capture a first perspective view of a user and a second sensor having a second pose to capture a second perspective view of the user. The first sensor and / or the second sensor may include an image sensor, a depth sensor, and / or the like. The systems and methods include a neural network that is configured to analyze first sensor data generated by the first sensor and second sensor data generated by the second sensor to determine whether a spoofing attack is occurring. The systems and methods may also perform one or more processes, such as facial recognition, based on whether the spoofing attack is occurring.

The invention relates to the technical field of Internet of Vehicles information security, and discloses an Internet of Vehicles-oriented Beidou signal spoofing detection and mitigation intelligent system and method, and the system comprises a multi-dimensional data sensing and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module. The method comprises the following steps: firstly, extracting a physical layer signal feature and a network flow stability feature and generating a multi-dimensional feature vector; secondly, performing feature compression and preliminary screening by using an auto-encoder, analyzing a time sequence evolution rule through a long-short-term memory network, and outputting a judgment probability; and finally, executing hierarchical defense according to the judgment probability, responding to local threats by dynamically adjusting a measurement noise covariance matrix or a hard isolation strategy, evaluating network node reputation based on a path damage index, and adding abnormal nodes into a dynamic blacklist. Through the multi-dimensional feature fusion and deep learning cascade architecture, the spoofing attack detection accuracy is improved, and the diffusion of false information in the Internet of Vehicles is effectively blocked.

The application provides a multi-agent system mean square consensus control method under hybrid attack, relates to the technical field of intelligent control, and comprises the following steps: establishing a multi-agent system model, designing a controller, on the basis, constructing an error system between a follower agent and a leader, and establishing a mean square consensus condition of the multi-agent system under a deception attack and a DOS attack, so that the multi-agent system is controlled to realize leader-following mean square consensus. The application improves the control strategy by comprehensively considering the possible deception attack and DOS attack during the working period of the multi-agent system, so that the leader-follower mean square bounded consensus is realized, and the control efficiency and control precision are improved.

A method for detecting GPS spoofing attacks includes providing a trained deep learning (DL) model based on neural networks, feeding GPS signals into the trained DL model, using asymmetric Shapley values (ASVs) to calculate feature contributions, using the ASVs to assign a non-uniform distribution over an ordering of features, obtaining causal structures among the features, applying the ASVs to causal Shapley additive explanation to obtain Shapley attributions, incorporating the Shapley attributions and the causal structures, and detecting GPS spoofing attacks by running the trained DL model and using the causal structures, non-uniform distribution, feature contributions, and Shapley attributions.

The invention discloses a safety control method of a high-order chain type multi-agent system under spoofing attack, and belongs to the technical field of safety control of multi-agent systems. The method comprises the following steps: establishing a dynamic model of a high-order chain type multi-agent system; constructing an extreme attack scene in which all communication links are subjected to bounded spoofing attacks; based on a backstepping control method, a distributed fixed time security control protocol is designed for a system, and the protocol counteracts attack influence by designing a virtual control strategy and a Lyapunov function; a Lyapunov stability theory is utilized to prove that under the action of the protocol, a system tracking error can be converged to zero within fixed time, so that safe and consistent tracking is realized. The defect that the prior art mainly aims at a linear system or only can realize asymptotic convergence is overcome, the method is particularly suitable for scenes such as non-complete constraint wheeled mobile robots, and the robustness and the rapid recovery capability of the system under extreme spoofing attacks are effectively improved.

The invention relates to the technical field of array antenna signal integrity detection, and discloses an array antenna signal integrity deception detection method and system, and the method comprises the steps: obtaining a receiving signal in an array antenna, and analyzing the quality parameter of the receiving signal; according to the quality parameter, identifying a receiving unit with inherent signal bias in the array antenna, and marking the receiving unit with inherent signal bias as a special processing unit; for a special processing unit, establishing and continuously updating a defect feature model representing inherent signal bias of the special processing unit under the condition of no deception signal; inherent signal bias is eliminated from the real-time received signals of the special processing unit based on a defect feature model, and signals after bias elimination are obtained; detecting whether an abnormal phase or frequency drift exists in the signal after the offset is eliminated; and when the detected abnormal phase or frequency drift exceeds a preset spoofing judgment threshold, determining that a spoofing attack exists. The problem that spoofing attacks are difficult to recognize is effectively solved.

Endpoints in a network execute a sensor module that intercepts commands to obtain information regarding a remote network resource. The sensor module compares a source of commands to a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.