232 results about "Spoofing attack" patented technology

The invention relates to a network attack threat trapping method, device and equipment. Preprocessing and prompt engineering processing can be sequentially carried out on a Web intrusion request; judging whether the processed Web intrusion request is an attack request or not by utilizing a detection model, and if yes, generating an attack type result; constructing an attack knowledge base corresponding to different network attack types according to existing website resources and related data; according to an attack type result and attack content of the Web intrusion request, similar data are retrieved from the attack knowledge base; and splicing the attack content and the similar data, and inputting the spliced attack content and similar data into a first large language model to obtain a simulation response aiming at the attack content. According to the technical scheme, the type of the attack request can be accurately identified by using the detection model, and the detection capability is improved. And the obtained simulation response can perform more complex and flexible interaction with an attacker, so that attack behaviors can be better cheated and trapped.

The invention discloses a multi-agent spatio-temporal dynamic system intrusion tolerance and fault tolerance cooperative security consistency control method. The method comprises the following steps: constructing mathematical models of a leader and a follower of a multi-agent spatio-temporal dynamic system based on a partial differential equation; constructing a mathematical model of actuator faults and spoofing attacks; defining a consistency condition to obtain an error system; constructing a proper Lyapunov functional, and obtaining a system stability criterion by using a Lyapunov stability theory; and the error of the multi-agent space-time dynamic system tends to zero by using the state feedback controller, so that the system realizes safety consistency control. The invention comprehensively considers that a multi-agent space-time dynamic system is easy to have actuator faults in a complex environment and is easy to suffer from network attacks in network communication, introduces an intrusion tolerance and fault tolerance cooperative security consistency control method, improves the robustness of the system, and improves the reliability of the system. And the multi-agent space-time dynamic system can achieve a safety consistency control target.

The invention relates to the technical field of face detection, and particularly discloses a face recognition system based on a face mask detection model, which is used for solving the problems of face recognition accuracy reduction and counterfeiting risk caused by mask shielding, counterfeiting attack and multi-source environment interference in high-security sensitive scenes such as a banking business window and the like. The system comprises a data acquisition and enhancement module, a feature extraction and multi-task neural network discrimination module, a counterfeit attack detection and risk blocking module, and a system deployment and model adaptive training module. According to the invention, through integration of multi-channel high-resolution visible light and infrared imaging, forgery attack sample enhancement based on the generative adversarial network, adaptive difficult sample sampling and multi-task deep discrimination network collaborative optimization, efficient recognition and real-time risk blocking of real and forgery mask faces are realized; and the security and robustness of a face recognition system in scenes such as banks are improved.

A global navigation satellite system (GNSS) spoofing detection and classification technique is provided. An optimization problem is formulated at the baseband correlator domain by using an optimization algorithm such as the Least Absolute Shrinkage and Selection Operator (LASSO) algorithm, for example. A model of correlator tap outputs of the intended received signal is created to form a dictionary of pre-computed waveform functions (e.g., triangle-like-shaped functions). Sparse signal processing can be leveraged to choose a decomposition of pre-computed waveform functions from the dictionary. The optimal solution of this minimization problem can discriminate the presence of a potential spoofing attack peak by observing the decomposition of two different code-phase values (authentic and spoofed) in a sparse vector output. A threshold can be used to mitigate false alarms. Furthermore, a variation of the minimization problem can be provided that enhances the dictionary to a higher resolution.

The invention discloses an MES (Manufacturing Execution System) login authentication method based on a face recognition technology, which relates to the technical field of industrial information security, and comprises the following steps of: constructing an authentication data acquiring a face image of an authorized user of an MES, extracting a reference face feature template after preprocessing, and constructing the authentication database; performing associated storage on the reference feature template, user identity information, preset operation authority and affiliated production station information to form an authentication database; according to the method, spoofing attacks are prevented through multi-mode living body detection, and the problem that a traditional password / key is easy to leak and borrow is solved in combination with uniqueness of human face biological characteristics; a person-post-terminal binding mechanism further limits permission abuse, and internal operation risks are reduced; the non-contact authentication does not need to memorize a password or carry a physical key, and is suitable for a working scene that a workshop operator wears gloves and holds tools; and the recognition passing rate in a complex industrial environment is improved through dynamic threshold optimization.

The invention discloses a multi-modal attack identification method fusing BMama and difference to guide trans-attention, which comprises the following steps: simulating a false data injection attack, a denial of service attack, an address resolution protocol spoofing attack and a domain name system spoofing attack, collecting physical layer sensor data and network layer flow data, and preprocessing multi-modal data; bMama is constructed to perform dynamic time modeling on multi-modal data, a graph neural network is combined to adversariate a variational auto-encoder, features of a power grid system topology and a communication topology structure are fused, and robustness of potential representation is enhanced through adversarial training; the method comprises the following steps of: guiding feature complementary fusion by using modal difference through a difference guide iteration cross-attention fusion mechanism, improving the capability of distinguishing complex attacks, finally carrying out attack detection and classification on fused modals, and executing end-to-end optimization according to a weighted combination of loss of each part. The method can effectively detect and classify the multi-modal attack in the smart power grid, and enhances the safety and reliability of a complex system.

Methods and systems for authenticating a user device to an application device are disclosed. The user device may request access to a (computer-implemented) service provided by the application device. Access to the service may include access to sensitive data; therefore, to prevent unauthorized access to the sensitive data, the user device may be authenticated to the application device before the service is provided. To do so, the application device may perform a first factor authentication using in-band hardware resources of the user device; however, the in-band hardware resources may be vulnerable to attacks by malicious parties. Thus, in addition, a second factor authentication of the user device may be performed out-of-band (e.g., using a management controller of the user device) in order to bypass potentially compromised in-band hardware resources. The additional out-of-band authentication may reduce the likelihood of the malicious parties gaining access to the sensitive data via spoofing attacks.

The invention provides a GNSS deception jamming detection method and system, and relates to the technical field of GNSS. GNSS signals of a plurality of satellites are collected, and self-correlation power information of each channel is obtained through a tracking loop; acquiring lead, instant and lag correlator outputs of each channel from the self-correlation power information of each channel, and constructing a tracking loop self-correlation power detection quantity of a single satellite; performing moving average filtering processing on the tracking loop autocorrelation detection quantity to generate a TLAP-MA detection quantity; combining the TLAP-MA detection quantities of the plurality of satellites to construct a multi-satellite combined matrix, and performing dynamic classification judgment based on a preset judgment threshold; and according to the dynamic classification judgment result, multi-path interference and spoofing attack are distinguished, and a detection result is output. The technical effect of effectively detecting and distinguishing GNSS deception jamming and multipath jamming is achieved.

The invention discloses an automatic driving vehicle GNSS spoofing attack detection device based on reinforcement learning, which relates to the technical field of machine learning and satellite navigation and comprises a data processing module, a driving distance calculation module, a driving distance prediction module, a reinforcement learning module and a spoofing attack detection module. A directional attack data set is constructed by using a real driving data set of an automatic driving vehicle, a deep neural network is trained by using the attack data set and unattacked sensor data, a vehicle driving distance is predicted, so that a difference value between a predicted distance and a calculated distance is obtained, and a deep reinforcement learning model is trained by using the data set to obtain a deep reinforcement learning model. The invention further discloses an automatic driving vehicle GNSS spoofing attack detection method based on reinforcement learning, and the automatic driving vehicle GNSS spoofing attack detection method based on reinforcement learning can achieve accurate attack detection.

The invention discloses a method and a system for designing network control by utilizing a genetic algorithm and self-adaptive event triggering. The method comprises the following steps of: establishing a state space model and an observer model of a networked system and a mathematical model of transmission data which is possibly subjected to spoofing attack in a network in the system; designing a Lyapunov function, and designing a controller constraint condition matrix theta capable of realizing robust stability performance of the system; performing decoupling processing on the theta matrix, and converting the theta matrix into an LMI form; the designed controller conditions are solved in computer software, controller parameters meeting the system performance are calculated, and control of the control system under the event trigger control strategy is achieved; a designed controller is combined with a genetic algorithm, genetic algorithm parameters are set according to an obtained initial solution, a gamma minimum value is obtained according to optimized parameters needed by the system, a self-adaptive event trigger control strategy is adopted, more flexible and more reliable safety control can be achieved, and the method is suitable for various different types of control systems and application scenes.

The invention provides a deception detection method and device for ship navigation and PNT trusted terminal equipment. The method comprises the following steps: acquiring shore-based trusted service data, the credibility of a navigation system, global navigation satellite GNSS data and multi-class navigation sensor data; determining a first deception probability in a preset time period according to the multi-class navigation sensor data and a preset data threshold value of the multi-class navigation sensor; according to the multi-class navigation sensor data, the GNSS data, the shore-based trusted service data and the credibility, performing fusion positioning through Kalman filtering to obtain trusted fusion positioning; determining a second deception probability within a preset time period according to the trusted fusion positioning and the GNSS data; determining a target deception probability according to the first deception probability, the second deception probability and the credibility; and outputting the target deception probability. Through the method, the ship navigation spoofing attack can be effectively detected, the spoofing probability is output, and the navigation safety is improved.

The invention discloses a ship anti-spoofing attack control method based on a self-feedback expansion state observer. The ship anti-spoofing attack control method comprises the steps that a guidance virtual ship and a dynamic virtual ship are set to construct an L2-DVS guidance strategy; constructing a spoofing attack additional signal model of the unmanned ship, and obtaining a ship position signal under the spoofing attack according to the kinematic model of the target unmanned ship; acquiring a longitudinal velocity virtual control law of the target unmanned ship and a spoofing attack compensation law of a yaw angle according to the constructed error model so as to obtain a yaw velocity virtual control law / adaptive law; and constructing a state memory type event triggering mechanism, obtaining a controller / adaptive law of a rudder angle / rotating speed of the target unmanned ship in combination with a self-feedback compensation reduced order expansion state observer, and realizing anti-spoofing attack control of the target unmanned ship according to the yaw velocity virtual control law / adaptive law and the controller / adaptive law of the rudder angle / rotating speed. The problems that the research of the application in the current network attack environment is not complete enough, the unmanned ship is disturbed all the time in the marine environment, the actuator continuously responds to the disturbance, and the excessive wear of the steering engine is greatly increased are solved.

The invention discloses a novel encryption-decryption scheme, and aims to detect and defend linear spoofing attacks on a cyber-physical system (CPS). With the wide application of CPS in key infrastructures such as industrial automation, smart power grids and automobile systems, it is particularly important to ensure the safety and integrity of CPS. Linear spoofing attacks are malicious behaviors, normal operation of the linear spoofing attacks is interfered by controlling input or output of a system, and a traditional security mechanism is often difficult to effectively cope with the type of attacks. According to the invention, an encryption algorithm is designed to protect data transmission of the CPS, and the encryption algorithm is combined to recover original data and identify potential attack signs at the same time. According to the scheme, the combination of the cryptography technology and the signal processing method is utilized, the data stream can be monitored in real time, and the possible linear attack is identified by analyzing the change of the data before and after encryption. In addition, according to the scheme, calculation efficiency and implementation feasibility are considered, and it is ensured that necessary safety guarantee is provided on the premise that system performance is not affected. Experimental results show that the proposed encryption-decryption scheme can effectively detect linear spoofing attacks in the cyber-physical system, and has relatively low false alarm rate and missing report rate. In addition, the scheme shows good adaptability and robustness in practical application, and provides a new thought and technical support for the security protection of the CPS in the future.

The invention discloses an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism, and the method comprises the following steps: 1, carrying out the screening and cleaning of a collected ADS-B signal sequence, and reserving continuous flight data with time sequence features for network training; 2, segmenting the continuous flight data into a plurality of time windows according to channels, and extracting frequency domain features from the time windows by using cosine discrete transform; step 3, combining the time window with the frequency domain feature and the time window with the time feature, and inputting the obtained time window with the frequency domain feature and the time domain feature into a self-attention mechanism to obtain an instance level feature; 4, performing normalization on the instance level features by using anti-instance regularization; 5, measuring the deviation between the normalized features and the normal mode features learned in the training stage; and step 6, summarizing the measured deviations, calculating an overall abnormal score of each signal segment, and then classifying the signals by using the abnormal scores.

The invention discloses an H-infinity intermittent sampling load frequency safety control method for a multi-region power system under spoofing attack, and belongs to the technical field of power system safety control. According to the method, the intermittent control signal is only used in the working interval, the control cost is effectively saved, the limited network bandwidth can be saved through sampling control, and the influence of spoofing attacks on the multi-area power system is effectively resisted through safety control. Firstly, according to the characteristics of intermittent control and sampling control, the influence of spoofing attack is considered at the same time, and a multi-region power system intermittent sampling load frequency safety control dynamic model under the spoofing attack is established. Secondly, a switching Lyapunov functional is provided, meanwhile, under the framework of an LMI, sufficient conditions for existence of an intermittent sampling load frequency safety controller are given, and the conditions guarantee that the index of a multi-area power system is stable and meet the H infinity performance; and finally, verifying the effectiveness of the H-infinity intermittent sampling load frequency safety controller through three-region power system simulation under spoofing attack.

The embodiment of the invention provides a coupling network asynchronous dynamic intermittent safety control method and system, and the method comprises the steps: obtaining multiple attack signals comprising an injection attack signal and a replacement attack signal after building a dynamic model of a following network, a target network and a state error variable; and setting an intermittent controller according to the dynamic network model and the multiple attack signals, and setting a dynamic mechanism based on an exponential function to convert a state error variable into an interval control function. Wherein the interval control function is used for realizing security mean square synchronization control between the following network model and the target network model. According to the method, the asynchronous anti-attack intermittent dynamic cooperative control strategy oriented to the complex coupled network can be constructed based on an average intermittent control rate and dynamic event trigger threshold coupling method by utilizing a node self-adaptive dual spoofing attack probability model, and the problems of difficulty in multi-attack modeling and insufficient control strategy collaboration can be relieved.

Certain aspects of the present disclosure provide techniques for enhancing vehicle operations safety using coordinating vehicle platooning or enhancing platooning safety against location spoofing attacks. In one example, a source user equipment (UE) detects a potential spoofing event associated with location information being altered in an unauthorized manner, the source UE may transmit a request to a platoon control system (PCS) to join a vehicle platoon. In another example, a first UE associated with a lead vehicle in an existing platoon may detect a potential spoofing event associated with location information being altered in an unauthorized manner. The lead vehicle may transmit to a second UE of another vehicle in the platoon an indication of the detection and a request to exchange the respective roles in the platoon. The PCS may also monitor the conditions of the first and the second UEs, and arrange for the platoon reorganization.

A method for detecting spoofing attacks on a UAV includes receiving signals from the UAV that is an edge device of a decentralized network, transmitting the signals to a fog node of the decentralized network, and detecting the spoofing attacks by detecting slow shifting patterns and running a trained attack detection model at the fog node for the signals. The decentralized network is based on an edge-fog-cloud computing paradigm.

The invention provides an unmanned aerial vehicle GPS spoofing attack detection method and device based on comparative learning and Mama, and relates to the technical field of unmanned aerial vehicle navigation safety monitoring. The method comprises the following steps: acquiring navigation data of a GPS (Global Positioning System) of an unmanned aerial vehicle, preprocessing the navigation data to generate a plurality of track subsequences with fixed window lengths, obtaining initial time domain data, and performing frequency domain conversion processing on the navigation data to obtain initial frequency domain data; inputting the initial time domain data and the initial frequency domain data into a trained double-branch Mama model for feature extraction, and outputting time domain features and frequency domain features; calculating a spoofing score according to the time domain feature and the frequency domain feature, and determining a spoofing attack behavior detection result according to the spoofing score; wherein two branches in the double-branch Mama model share a weight; the spoofing attack detection model is obtained based on comparative learning strategy training. According to the method, the modeling efficiency and the detection accuracy of the long-sequence navigation data can be considered while the dependence on manual labels is reduced.

The invention discloses a self-adaptive finite time fuzzy safety control method for a flexible joint mechanical arm, which comprises the following steps that a flexible joint mechanical arm state space model influenced by spoofing attack is established, and a control signal comprises an unknown time-varying parameter and an unknown bounded attack function; introducing a Nussbaum function meeting a preset limit integral property; designing a control method based on a finite time stability principle, and ensuring that a system state converges to a bounded residual set within finite time; a fuzzy logic system is adopted to approach an unknown nonlinear function in the mechanical arm model; defining an error variable through coordinate transformation, and constructing a parameter which exponentially decays along with time; constructing a Lyapunov function containing the exponential decay parameter, and designing a virtual control function, a controller and a parameter adaptive law based on the function; and the Nussbaum function is constructed to be used for processing the unknown time-varying parameters. According to the invention, the influence of spoofing attacks on state signals can be reduced.

The invention relates to the technical field of household equipment intrusion detection, in particular to a mimicry intrusion detection method and system for household equipment, and the method comprises the steps: S0, starting credible verification and initialization; the method comprises the following steps: S1, carrying out multi-modal feature fusion processing; s2, disturbance type joint detection; s3, graded elastic response is carried out; s4, updating the self-adaptive model; s5, identifying a semantic exception instruction; and S6, neural morphology calculation is accelerated. According to the method, damage attack path dependence is detected through dynamic disturbance, multi-modal features are fused through a modal alignment mechanism, low-power-consumption acceleration is achieved through neuromorphic hardware, semantic anomaly instruction recognition and brain-like feedback offline optimization are combined, and the core problem that high-precision detection and high robustness cannot be considered at the same time in the prior art is solved; and particularly, real-time attacks and semantic spoofing attacks of unknown vulnerabilities are effectively resisted.

The invention relates to the technical field of information security, in particular to a sensitive information detection technology and system based on multi-mode and steganography detection.The sensitive information detection technology and system based on multi-mode and steganography detection.The method comprises the steps that firstly, through a format tampering prevention module, file header information and binary data analysis are utilized, the real type of a file is verified, and format camouflage attacks are prevented; the sensitive data detection module adopts DistilBERT and LSTM structures to preprocess a text, extract text embedding, mine text features through a bidirectional LSTM and Attention mechanism, and finally accurately judge whether the text contains sensitive information or not; the joint content and file steganography detection module fuses a convolutional neural network and multi-modal learning, adopts corresponding models for different data types to carry out steganography information detection, integrates results through a multi-modal neural network, and applies multi-modal feedback and a cross-modal reasoning mechanism to improve the detection accuracy; according to the method, the accuracy, comprehensiveness and system adaptability of sensitive information detection are effectively enhanced.

Endpoints in a network execute a sensor module that intercepts responses from a directory service to a source on the endpoint. The sensor module determines if the source is sanctioned, such as by referencing a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.

The invention provides a pinned pulse safety synchronization control method and system of a multi-coupling time-delay network, and the method comprises the technical schemes: building a coupling time-delay dynamic network model, constructing a mathematical description of a random spoofing attack, designing a pinned pulse safety controller, and deducing a Lyapunov stability discriminant. Through defining an error system of a following network and a target network, under a pinned pulse safety control framework, based on a pulse system theory, system stability is analyzed, an attack probability is described in combination with a Bernoulli random variable, a pinned pulse control node selection strategy is finally designed, and safety synchronous control is successfully realized. The mechanism can effectively extract time delay information with a stabilization effect in a continuous system, and fuses the time delay information into the design of an anti-attack containment pulse safety controller, so that the synchronization safety of the system is remarkably improved, the resource allocation efficiency is optimized, and the attack influence is weakened by utilizing inherent time delay.

Endpoints in a network execute a sensor module that intercepts commands. The sensor module compares a source of commands to a sanctioned list of applications received from a management server. If the source does not match a sanctioned application and the command is a write or delete command, the command is ignored and a simulated acknowledgment is sent. If the command is a read command, deception data is returned instead. In some embodiments, certain data is protected such that commands will be ignored or modified to refer to deception data where the source is not a sanctioned application. The source may be verified to be a sanctioned application by evaluating a certificate, hash, or path of the source. Responses from an active directory server may be intercepted and modified to reference a decoy server when not addressed to a sanctioned application.

The invention discloses a performance control method of a limited nonlinear information physical system, which belongs to the technical field of intrusion tolerance control of information physical systems, and comprises the following steps of: establishing a control-oriented dynamic model of the limited nonlinear information physical system with external disturbance under spoofing attack; mathematical characterization is carried out on bounded multiplicative and additive spoofing attacks; a Lyapunov function based on a preset performance control method is constructed, and a system stability determination method based on a Nusb inequality is given; and coordinate change is introduced to meet full-state constraint, and a fixed time controller is designed by using a backstepping method, so that preset performance control of the limited nonlinear information physical system under spoofing attack and external disturbance is realized. The invention develops a fixed time intrusion tolerance controller based on a preset performance method, which can ensure the stable operation of a limited nonlinear information physical system under a spoofing attack with a small tracking error.

The invention discloses a multi-agent sliding mode safety control method based on dynamic event triggering under hybrid network attack, and the control method comprises the following steps: building a multi-agent system model comprising spoofing attack and DoS attack; in order to cope with hybrid network attacks, an integral sliding mode surface function is constructed, an online estimation method is provided, and an unknown network attack mode can be estimated in real time in the absence of prior information; a novel self-adaptive sliding mode controller is developed, and the accessibility of a preset sliding mode surface is ensured; by introducing an auxiliary variable, a dynamic and static event triggering mechanism in the framework is considered, so that the use of communication resources is minimized; a Lyapunov stability theory and a finite time method are utilized to analyze the convergence of the multi-agent system under the control strategy. According to the control method provided by the invention, the influence of spoofing attack and DoS attack on the system can be eliminated, so that the state of the multi-agent system is consistent within finite time.

The invention relates to the technical field of deception jamming detection, and particularly discloses an integrated learning high-sensitivity dynamic GNSS deception detection method, which comprises the following steps: acquiring an output signal of a multi-correlator array, and calculating to obtain an in-phase channel multi-correlator SQM index and an orthogonal channel multi-correlator SQM index; carrying out processing by adopting indirect Kalman filtering to obtain a smoothed in-phase channel multi-correlator SQM index, a smoothed orthogonal channel multi-correlator SQM index and a steady state estimation error variance; constructing alternative deception detection indexes; selecting one of the alternative deception detection indexes as a deception detection index through a plurality of machine learning models; and judging whether the spoofing attack occurs or not according to a comparison result of the spoofing attack and a corresponding threshold value. According to the method, dynamic detection index selection is realized through integrated learning so as to cope with different spoofing attack conditions, and the spoofing attack detection efficiency can be remarkably improved.

The invention discloses a T-S fuzzy model-based two-stage anti-attack coupling memristive neural network finite time bipartite synchronization control method. The method comprises the steps of establishing a memristive neural network model and a symbol topological structure; converting the memristive neural network model into a fuzzy coupling memristive neural network model, defining a synchronous error state variable, and establishing an error system of the memristive neural network; converting the error system into a form based on differential inclusion; a two-stage finite time synchronous controller is designed, in the first stage, when the state of an error system meets the condition, a pulse controller based on a hybrid trigger mechanism is designed to resist spoofing attacks; and in the second stage, a controller combining finite time control and fixed time control mechanisms is designed to resist DoS attacks. According to the invention, a two-stage controller is designed, and the controller integrates pulse safety control, feedback control and a finite time and control mechanism, and can simultaneously resist spoofing attacks with energy constraints and DoS attacks with random outbreak features.

The present invention improves determination accuracy of a spoofing attack on biometric authentication.　An information processing device (10) determines the brightness of image data (13) from a plurality of pixel values included in the image data (13). The information processing device (10) generates, from the image data (13), frequency component data (14) indicating a frequency component of a frequency section corresponding to the brightness so as to indicate a frequency component of a frequency section (16a) when the brightness is at a level (15a), and to indicate a frequency component of a frequency section (16b) including the frequency higher than that of the frequency section (16a) when the brightness is at a level (15b) that is higher than the level (15a). The information processing device (10) inputs the image data (13) and the frequency component data (14) into a machine learning model (17), thereby determining whether the image data (13) indicates a spoofing attack on biometric authentication.