73 results about "Suspicious behaviour" patented technology

The invention discloses a security risk autonomous sensing system and method based on a digital twin industrial control network. The method comprises the following steps: performing four-dimensional multi-modal modeling on an industrial control network, and constructing a twin model integrating entities, rules, services and behaviors; constructing a high-fidelity simulation network by utilizing a containerization technology based on the model; deploying a gateway at an actual network boundary, collecting traffic characteristics in real time and identifying suspicious behaviors; performing protocol restoration and behavior reconstruction on the suspicious traffic to generate a behavior sequence; performing anomaly recognition and attack classification on the behavior sequence through a deep learning model; evaluating a risk level; and matching and verifying a defense strategy according to an evaluation result, and automatically synchronizing the defense strategy to a master control network to realize a detection-response-protection closed loop. According to the invention, autonomous identification of suspicious behaviors in the industrial control network and intelligent decision-making of security policies are realized, and the method has the advantages of high simulation, low invasion, closed-loop controllability and the like.

The invention relates to the technical field of intelligent monitoring, and more specifically discloses an intelligent security and protection monitoring system and method based on computer vision, and the method comprises the steps: obtaining a monitoring video and sound signals of a to-be-detected region, extracting a region monitoring feature map and a region sound correlation feature map, and fusing the two features to obtain a classification feature vector of the to-be-detected region; and a classification result is obtained through a classifier and is used for representing whether a suspicious behavior exists or not.

A system (100) or method (500) for preventing or mitigating malicious processes in a computing environment having one or more processors (204) and memory (202) operatively coupled to the one or more processors can include computer instructions which when executed causes the one or more processors to perform certain operations. The operations can include intercepting (502) all file system input and output paths using a kernel driver (103), analyzing (504) for suspect behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in a kernel of an operating system for the computing environment, flagging (512) the data for any suspect behaviors, and preventing (514) further processing upon detection of the suspect behaviors.

The invention discloses an asset vulnerability detection method and device, electronic equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: actively sending a multi-protocol detection packet to scan a target network segment, and obtaining a first asset set; passively monitoring network traffic to extract asset feature information, and obtaining a second asset set to generate an asset list; port scanning tasks of all assets are dispatched to a plurality of scanning nodes in a distributed and parallel mode, dynamic port scanning is carried out according to a descending order of a plurality of key elements in combination with a port scanning optimization model based on risk prediction, and a full-amount port risk map is constructed; the static layer is matched with known vulnerabilities; the dynamic layer identifies suspicious behaviors deviating from a normal behavior baseline through an anomaly detection algorithm, and obtains an asset vulnerability detection result in combination with a cross validation method; according to the invention, the detection requirements of asset full coverage and early threat discovery in a complex network environment are met.

The invention discloses a computer information security processing method and system based on big data, and the method comprises the following steps: S1, collecting data generated in a computer operation process, and carrying out the data cleaning and standardization processing; s2, a deep learning-based threat feature extraction model automatically learns and extracts potential attack modes and behavior features through training data; s3, implementing continuous monitoring of user and system behaviors, and identifying suspicious behaviors of abnormal login and data access; s4, establishing a dynamic risk assessment model, and updating the risk assessment model according to the newly occurring threat case; and S5, generating and executing corresponding defensive measures, and automatically repairing vulnerabilities and triggering an alarm notification by isolating infected equipment and blocking malicious traffic. According to the method, the protection capability of computer information security is enhanced, the coping efficiency of security events is also improved, and a powerful guarantee is provided for information security in a big data environment.

The invention provides a database anti-ransomware method and device based on user SQL (Structured Query Language) feature behavior analysis, and relates to the technical field of database security. The method comprises the following steps: constructing an SQL data set by utilizing a multi-source data aggregation algorithm, a real-time and historical combination algorithm and a data cleaning and checking algorithm; extracting SQL statement structure features according to BERT and a semantic matching method; according to the features, training a user SQL behavior model based on a Transform; in the real-time monitoring stage, a monitoring engine captures a new SQL operation in real time, rapidly extracts features and inputs the features into the trained behavior model for evaluation. Once the deviation between the operation and a normal behavior model exceeds a preset threshold value and suspicious behavior modes such as data encryption, large-scale data deletion or abnormal high-authority operation similar to ransomware are presented, an alarm mechanism is triggered immediately, and a preset protection strategy is executed automatically, so that data loss and business influence are reduced to the greatest extent.

A method and apparatus for the identification of suspect behaviour in a retail environment, the method comprising: detecting a person in a frame of said stream of video data; extracting a set of activities of the identified person from the stream of video data; assigning a numeric value to each extracted activity in the set of extracted activities, said numeric value representative of a threat level of the activity; accumulating said numeric values to provide a behaviour score; and identifying a behaviour as being suspect when the behaviour score reaches a target threshold value associated with the behaviour.

Aspects of the disclosure relate to a method, apparatus and system for supporting suspicious behavior reporting. For example, implementations provide techniques for aggregating data related to suspicious behaviors in wireless communications and for propagating data to different entities in a wireless system. By utilizing the techniques, device and information security in wireless communications can be enhanced.

The embodiment of the invention relates to the field of robots, in particular to an anti-following method, a robot and a computer readable storage medium, and the method comprises the steps: obtaining a task instruction, executing a task according to the task instruction, obtaining environment information around the robot, determining whether there is a pedestrian according to the environment information, and if there is a pedestrian in the environment information, executing the task according to the task instruction; if yes, the identity of the pedestrian is determined through the biological characteristics and activity behaviors of the pedestrian, whether a suspicious behavior exists or not is determined according to the identity of the pedestrian, and if it is detected that the suspicious behavior exists, response operation is executed according to the suspicious behavior. When the robot executes the task, the environment around the robot can be detected, whether suspicious behaviors exist around or not is determined, and the corresponding operation is executed when the suspicious behaviors exist, so that the following behaviors can be effectively reduced, the situation that the robot enters an unauthorized area is reduced, the safety can be improved, and the privacy of guests can be protected; and the satisfaction and credibility of the guests are improved.

To prevent crimes and troubles in smartphone calls and communication services before they occur.SOLUTION: A system for providing a real-time talk monitoring service includes means for monitoring smartphone calls and communication services, means for detecting inappropriate utterance and suspicious behavior which may lead to crimes and troubles, and means for temporarily stopping a talk and notifying the stopped talk.SELECTED DRAWING: Figure 1

An artificial intelligence (AI)-driven system and a method for orchestrating and automating a talent acquisition process are disclosed. The AI-driven system comprises a job description generating subsystem, a resume screening subsystem, an interview link generating subsystem, an anomaly detection subsystem, a report generating subsystem, and an autonomous decision-making subsystem. The job description generating subsystem generates precise job descriptions by analyzing hiring needs of organizations The resume screening subsystem evaluates one or more resumes against pre-defined criteria in the job descriptions. The interview link generating subsystem schedules interviews by generating interview links. The anomaly detection subsystem monitors suspicious behaviors of one or more candidates during the interview. The report generating subsystem generates a comprehensive final report that consolidates all aspects of an interview process. The autonomous decision-making subsystem makes decisions at each phase of the talent acquisition process using a cognitive architecture and automatically progresses to subsequent phases.

The invention discloses a short message fraud early warning method and system based on abnormal behavior detection, and relates to the field of short message fraud early warning, and the method comprises the steps: obtaining user terminal equipment behavior data and financial transaction request behavior data, and constructing a continuous behavior sequence after a user short message is received; constructing a dynamic baseline based on user historical behavior data, calculating a deviation degree between single behavior data and the dynamic baseline, and generating a suspicious behavior set; performing cross-platform behavior tracking to obtain cross-platform behavior data; inputting the deviation degree corresponding to the suspicious behavior, the sequence context information of the occurrence time point of the suspicious behavior and the cross-platform behavior data into an AI fusion analysis model, outputting a fraud risk confidence coefficient, and calculating a fluctuation ratio; and performing fraud behavior identification based on the fraud risk confidence and the fluctuation ratio, and triggering real-time early warning when fraud is confirmed. According to the invention, high-precision and self-adaptive real-time detection and early warning of short message fraud behaviors are realized.

This invention provides a method and apparatus for detecting lateral movement behavior in encrypted traffic, relating to the field of network security technology. The method includes: first, using an eBPF probe mounted at a critical location in the network protocol stack to capture network traffic data about to be encrypted; second, filtering communication traffic related to lateral movement attacks and matching the relevant communication traffic against predefined lateral movement rules. If a match is found between the traffic and the lateral movement attack rules, it is determined that the target host exhibits lateral movement behavior. Otherwise, a dynamically adjusted behavior model is used to further analyze traffic anomalies, and a security alert is triggered when suspicious behavior is detected. This invention can utilize eBPF combined with known attack characteristics and a behavior analysis model to identify encrypted lateral movement attack behavior, improving the accuracy of identification.

The application provides a computer network monitoring system and method. First, a network security risk graph integrating logical dependencies and vulnerability attributes is constructed, and potential attack chains are deduced and their dynamic risks are evaluated based on the network security risk graph; then, data request sequences of key nodes on the potential attack chains are monitored to identify suspicious behaviors based on dynamic behavior portraits. Then, the identified suspicious behaviors are combined with the dynamic risks of the corresponding attack chains to determine the attack stages of attack activities; finally, based on the determined attack stages, enhanced monitoring is started on related network links and decoy nodes are deployed, and hierarchical alarms are triggered according to attack interaction features captured by the decoy. The above scheme can realize dynamic evaluation and hierarchical response of potential attack chains based on a network security risk graph.

The present application belongs to the technical field of software engineering, and specifically relates to an NPM malicious software package detection method based on behavior analysis and matching of a graph model. The method comprises the following steps: constructing a program suspicious behavior graph by using a static analysis technique; collecting NPM malicious software packages as a data set from multiple information sources; in an offline stage, constructing a program suspicious behavior graph for existing malicious software packages, and obtaining a malicious behavior graph by manual clipping; in a deployment stage, inputting an NPM software package to be detected, first analyzing an installation script contained in a configuration file, and identifying whether malicious behavior exists, then performing obfuscation detection on code files, and for a software package not containing obfuscated code, generating a program suspicious behavior graph in three stages of installation, import and running, and matching the program suspicious behavior graph with a known malicious behavior graph generated in the offline stage to realize detection of malicious behavior. The method can help detect NPM malicious software packages and reduce the harm caused by malicious code.

The invention provides a Webshell detection method and system and electronic equipment. The method comprises the following steps: acquiring a behavior data set; for each URL, determining whether the URL is a suspicious URL with suspicious behaviors or not according to whether the behavior attribute data of the URL under the plurality of dimensions meets a corresponding threshold condition or not; extracting behavior characteristics of each suspicious URL from the behavior data set; according to the behavior characteristics of the plurality of suspicious URLs, screening risk URLs conforming to Webshell characteristics from the plurality of suspicious URLs; and generating a Webshell detection result according to whether the risk URL meets a preset association matching condition or not. In the mode, the potential Webshell can be identified by extracting and analyzing the URL behavior data, so that the efficiency and the accuracy of Webshell detection are improved.

A system and method for automated software vulnerability detection and patching using sandboxed analysis. The system receives executable machine code files and identifies target device types for execution. A sandbox environment emulates device functionality and executes code while monitoring for suspicious behavior including memory scanning, unauthorized system access, and irregular network activity. Machine learning algorithms analyze execution patterns to detect security vulnerabilities and exploits. Upon identifying threats, the system automatically generates protective patches such as address space layout randomization and data execution prevention measures. These patches are deployed to real devices to prevent exploitation. The system uses reinforcement learning to improve patch effectiveness over time. This automated approach enables proactive cybersecurity protection by responding to emerging threats before malicious exploitation occurs.

In an embodiment, the invention provides a theft-monitoring system having one or more cameras, a data store, and a computer processor coupled to the data store and in communication through a network via a web interface with a video reviewer's computing device. The data store includes records that each include collected footage from the cameras and screen or metadata recordings. The processor is programmed, upon receiving an indication of entry of potential purchaser, to track suspicious behavior of the potential purchaser and store data representing screen, video and metadata associated therewith in the data store. The processor determines if the suspicious behavior warrants evaluation, collects relevant data based on the data stored in said data store and, in response to a determination of suspicious activity, transmits the relevant data over a network for review by an operator.

This invention discloses an intelligent security system based on a high-sensitivity pressure sensor, comprising a sensing module, a signal processing module, a data transmission module, a control module, an alarm module, and a power supply module. These modules are electrically connected sequentially, and the power supply module provides operating voltage to the other modules. The system employs high-sensitivity and multi-fusion technologies to achieve rapid and efficient security system construction. It utilizes a high-sensitivity pressure sensor as the sensing device to quickly detect suspicious behavior and issue real-time alarms; it uses artificial intelligence video analysis technology to judge suspicious objects; and its signal processing employs domestically produced chips, a remote terminal with a database, and a system fusion platform to ensure information security, high-performance processing of alarm information, and to provide alarm signals to other security and fire protection systems for system linkage.

In an embodiment, the invention provides a theft-monitoring system having one or more cameras, a data store, and a computer processor coupled to the data store and in communication through a network via a web interface with a video reviewer's computing device. The data store includes records that each include collected footage from the cameras and screen or metadata recordings. The processor is programmed, upon receiving an indication of entry of potential purchaser, to track suspicious behavior of the potential purchaser and store data representing screen, video and metadata associated therewith in the data store. The processor determines if the suspicious behavior warrants evaluation, collects relevant data based on the data stored in said data store and, in response to a determination of suspicious activity, transmits the relevant data over a network for review by an operator.

To prevent sexual crime from occurring and provide support for identifying a perpetrator after occurrence of the incident.SOLUTION: Provided is a system comprising: means for making a generative AI learn behavior patterns of sexual crime, and determining, using surveillance camera footage, whether or not the perpetrator is "him"; means for issuing a security warning in advance to be cautious; and means for keeping evidence of suspicious behavior after occurrence of the incident.SELECTED DRAWING: Figure 1

This enables efficient detection and appropriate suppression of suspected shoplifting incidents. [Solution] The POS system 100 includes a sensor 106 that observes predetermined events related to customers in a store, a processor 104 that performs a process of applying the observation results obtained from the sensor 106 to an algorithm 112 for detecting suspicious behavior to detect suspicious behavior by the customer, and a process of notifying at least one of the store staff or the customer of the detection result or a predetermined notification content corresponding to the result.

The present invention discloses a system to assist investigations for storage and targeted search of metadata and video collected by dashcams. The invention efficiently guides video evidence search using stored route metadata versus complete footage, tackling the challenges of distributed footage across vehicles. The system enhances investigations by unlocking previously inaccessible visual evidence in a targeted manner while optimizing storage and bandwidth. Vehicles equipped with cameras send real-time route metadata and / or video to the system. This data may include coordinates, timestamps, license plates detected, facial features, street names, addresses, suspicious behavior data, and other details related to the route. Investigators may input search parameters related to location, timing, vehicles, objects, persons, etc. Computer vision algorithms analyze stored metadata to identify matching routes and footage. Investigators may access the video from central storage or, if only metadata about the route was submitted, request relevant footage from the respective driver.

A system (100) or method (500) for preventing or mitigating malicious processes in a computing environment having one or more processors (204) and memory (202) operatively coupled to the one or more processors can include computer instructions which when executed causes the one or more processors to perform certain operations. The operations can include intercepting (502) all file system input and output paths using a kernel driver (103), analyzing (504) for suspect behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in a kernel of an operating system for the computing environment, flagging (512) the data for any suspect behaviors, and preventing (514) further processing upon detection of the suspect behaviors.

The embodiment of the invention provides a network attack processing method, system and device, a storage medium and a program product. In the process of performing security protection on the target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior can be obtained, an interception rule corresponding to the suspicious behavior is obtained according to the behavior data, and the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training the behavior data sample of the process corresponding to the historical network attack behavior, so that the attack analysis model can better master the knowledge of the network attack field. When the behavior data of the process with the suspicious behavior is analyzed, the attack analysis model can identify and judge the behavior of the process more accurately, so that an interception rule with higher confrontation is generated. Therefore, the potential security threats corresponding to the suspicious behaviors can be quickly and accurately processed, the risk of missing potential attacks is reduced, and the defense capability is improved.

This information processing device is provided with a suspicious person detection unit and a notification control unit. The suspicious person detection unit detects, using an analysis result of sensor information from a sensor monitoring a predetermined range from a residential site, a person, other than a specific non-suspicious person, who is performing a suspicious action on a vehicle parked in a parking lot in the predetermined range. The notification control unit causes a notification unit to issue a notification when a suspicious person is detected.

The invention discloses an abnormal behavior detection method, terminal equipment and a storage medium. The method comprises the following steps: acquiring a video stream of a target scene in a current time period; tracking the motion trail of each target in the video stream; for each target, determining that the target is a suspicious target under the condition of determining that the target has suspicious behaviors in the current time period according to the movement track of the target; according to the motion trail of the suspicious target and the video stream, identifying the behavior intention of the suspicious target in the current time period to obtain a behavior intention identification result; and determining whether the suspicious target has an abnormal behavior or not according to the behavior intention recognition result. According to the scheme, the normal interaction behavior and the malicious heuristic behavior of the target can be effectively distinguished, and the accuracy of abnormal behavior detection is remarkably improved.

An artificial intelligence (AI)-driven system and a method for orchestrating and automating a talent acquisition process are disclosed. The AI-driven system comprises a job description generating subsystem, a resume screening subsystem, an interview link generating subsystem, an anomaly detection subsystem, a report generating subsystem, and an autonomous decision-making subsystem. The job description generating subsystem generates precise job descriptions by analyzing hiring needs of organizations. The resume screening subsystem evaluates one or more resumes against pre-defined criteria in the job descriptions. The interview link generating subsystem schedules interviews by generating interview links. The anomaly detection subsystem monitors suspicious behaviors of one or more candidates during the interview. The report generating subsystem generates a comprehensive final report that consolidates all aspects of an interview process. The autonomous decision-making subsystem makes decisions at each phase of the talent acquisition process using a cognitive architecture and automatically progresses to subsequent phases.

The invention relates to a financial account abnormity identification method and device, equipment, a medium and a program product. The method comprises the following steps: acquiring multi-source data of a newly added abnormal account; identifying a suspicious behavior pattern from the multi-source data, and generating a candidate identification rule based on the suspicious behavior pattern; performing similarity comparison on the candidate recognition rule and each recognition rule to obtain a similarity index; if each similarity index is smaller than a similarity threshold value, testing the candidate recognition rule based on the historical account behavior set to obtain a preset test index; if the preset test index meets the condition, adding the candidate identification rule into a current identification rule base; and in response to the received target financial account behavior data, performing anomaly identification on the target financial account behavior data based on the latest identification rule library of the rule engine. By adopting the method, the new recognition rule can be automatically and efficiently learned from the abnormal data, the problems that the recognition rule depends on manual summarization, updating lags and the like are avoided, and the anomaly recognition timeliness and the intelligence level are improved.

The invention relates to the technical field of target tracking, and discloses a video anti-theft early warning method based on target tracking and related equipment, and the method comprises the steps: carrying out the imaging enhancement of an original video frame collected by a wireless intelligent doorbell in a low-light environment, and obtaining a low-light enhanced video sequence; performing time sequence consistency constraint depth estimation based on the low light enhancement video sequence to obtain a target depth distribution map and constructing a dynamic target tracking map; performing double-layer boundary constraint analysis based on the dynamic target tracking graph to obtain a target tracking trajectory; and calculating a comprehensive suspicious behavior score based on the target tracking trajectory and generating a doorbell alarm signal. The method can effectively capture an interaction mode and long-time behavior characteristics between targets, directly embed physical constraints into a target tracking process, realize accurate distinguishing of normal visitors and potential threats, and effectively reduce a false alarm rate.