5392 results about "Threat" patented technology

A system and method for an AI-controlled sensor network for threat mapping and characterization. The system deploys a network of honeypots and sensors across various geographic locations and network segments, collecting and aggregating data on network traffic and potential threats. An AI orchestrator analyzes this data using advanced machine learning models, generating dynamic honeypot profiles and a comprehensive threat landscape. The system can adapt in real-time to emerging threats, optimize resource allocation, and provide actionable intelligence. By correlating data across multiple points, the system offers enhanced threat detection capabilities and proactive cybersecurity measures, surpassing traditional security information and event management (SIEM) tools.

The invention provides a network attack link tracking and threat situation reasoning method based on a knowledge graph, and relates to the technical field of network security, and the method comprises the steps: collecting and processing original data; extracting features and constructing a network attack knowledge graph; performing representation learning by adopting a graph neural network; identifying a time sequence dependency relationship; generating and analyzing candidate attack links; constructing a dynamic Bayesian network model; performing parameter learning by adopting a variational reasoning algorithm; future attack targets and means are predicted. According to the method, the network attack link can be effectively tracked, the future threat situation is accurately predicted, and the network security defense capability is improved.

The present disclosure generally relates to a two-stage system for detecting malicious nodes in Wireless Sensor Networks (WSNs), enhancing network security and resilience. The system employs a distributed approach, leveraging Cluster Heads (CHs) and a central server for efficient and accurate detection. Initially, sensor nodes are monitored for comprehensive node and network metrics, statistically ranked by significance in identifying malicious behavior. CHs perform a resource-aware first-stage detection based on their resource weight, filtering potential threats locally. Results are then aggregated at a server for a second-stage analysis using a hybrid Machine Learning (ML) and Deep Learning (DL) approach. This advanced analysis, combined with statistically relevant metrics, significantly improves detection accuracy. By integrating resource-conscious CH operation with powerful server-side ML / DL, this system offers a scalable, energy-efficient, and highly effective solution for securing WSNs against malicious node attacks, surpassing traditional detection methods in both speed and precision.

The invention relates to the field of security surveying and mapping, in particular to a network security space surveying and mapping method, system and device based on multi-source data fusion, and the method comprises the steps: obtaining network security data in real time, and constructing a dynamic network topological graph; calculating a time-varying vulnerability score based on the topological graph and a historical attack log, and predicting an attack path and a propagation probability through a Bayesian network; performing cross-domain fusion on equipment, service and user behavior characteristics by adopting a federated learning framework to generate a dynamic asset portrait; generating a risk thermodynamic diagram in combination with spatial autocorrelation analysis and a multi-index fusion algorithm; a defense strategy effect is simulated based on an attack graph reconstruction engine, a Pareto optimal strategy combination is generated through an NSGA-II algorithm, and closed-loop verification and dynamic parameter correction are realized by utilizing honeypot deployment and flow traction. Therefore, the problems of topology update lag, single risk assessment dimension, cross-domain threat association fracture, defense strategy static stiffness, non-closed loop of a verification system and the like in the traditional technology are solved.

The invention provides a cross-domain network security policy automatic generation and protection policy collaboration method and system, and relates to the technical field of network security, and the method comprises the steps: collecting multi-domain security event data; constructing a security threat map; generating a cross-domain security risk score by using a deep learning algorithm; determining an inter-domain access control rule set and an intra-domain protection strategy according to the score; forming a cross-domain collaborative protection strategy; deploying a strategy on the multi-domain security device; establishing an inter-domain information sharing channel; monitoring the strategy effect; optimizing the strategy by using a reinforcement learning algorithm; and updating to each domain security device. According to the method, the effectiveness of cross-domain network security protection is improved.

The invention discloses an archive data security integration management system, which relates to the technical field of knowledge maps and comprises an archive data acquisition module, a knowledge intelligent analysis module, a knowledge map dynamic construction module, a security situation evaluation module and a security communication center module. The data acquisition module structurally acquires metadata and operation behaviors, the intelligent analysis module dynamically governs data quality, the map construction module constructs a three-dimensional security model, the situation evaluation module quantifies security influence and generates a strategy, and the communication center module realizes dynamic identity authentication and bandwidth allocation. Through the knowledge graph technology, comprehensive integration and safety management of the archive data are achieved, the data quality and utilization efficiency are improved, dynamic evaluation and coping with safety threats are achieved, and the safety and integrity of the archive data are ensured. Meanwhile, through dynamic identity authentication and bandwidth allocation, the safety and efficiency of cross-domain communication are improved.

The invention provides a network security penetration detection method and system based on artificial intelligence, and the method comprises the steps: firstly obtaining real-time network flow data containing multi-dimensional communication behavior records and protocol metadata of a target network system, and then extracting network behavior sequence features capable of describing communication behavior time relevance and a protocol interaction mode from the network flow data; inputting the network behavior sequence features into a pre-trained multi-modal threat prediction model, generating a potential attack vector prediction result containing an attack intention label, penetration path probability distribution and a threat level score, and dynamically verifying the potential attack vector prediction result based on a threat knowledge base, and finally, generating a self-adaptive defense strategy according to the penetration threat detection result, triggering defense interface deployment of a target network system, updating attack mode characteristics and a defense rule set of a threat knowledge base, and realizing intelligent and efficient network security penetration detection and defense.

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

An example operation may include one or more of monitoring communications that occur with user devices over a shared computer network, detecting a security threat from the monitored communications, generating a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on a description of the security threat and a repository of source code, installing the source code for simulating the security threat on a system associated with the computer network, and executing the source code for simulating the security threat via the system.

The invention relates to the technical field of medical terminal data secure transmission and real-time management and control, in particular to a bank medical intelligent terminal data secure transmission and real-time management and control system and method. The behavior analysis module is used for calculating threat indexes through federated learning, the strategy module is used for dynamically switching algorithms and isolating anomalies, and the audit module is used for block chain verification and zero knowledge verification to generate a report. According to the method, dynamic encryption and fragmentation cutting are driven through sensitivity grading labels, the accuracy of data protection is improved, a time sequence attack path is blocked based on cooperation of fragmentation time sequence reference and an encryption transmission protocol, and dual guarantee of decentralized auditing and tampering positioning is realized by combining block chain hash identification and zero-knowledge proof verification, so that the security of data protection is improved. And full-link safe transmission and real-time management and control requirements of medical terminal data are met.

Described herein are systems and methods for identifying security vulnerabilities. The systems and methods herein can utilize security vulnerability information to identify potential security threats and can utilize this information to generate an attack using a machine learning model, such as a large language model. Generated attacks can be carried out to assess impact of a security vulnerability. An output can be provided that represents the assessed impact. In some implementations, the systems and methods herein generate patches or other mitigations for security vulnerabilities, which can be tested and deployed to address security vulnerabilities.

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

The invention discloses a network line intelligent operation and maintenance monitoring management system and method. The method comprises the steps that an intelligent network monitoring and optimizing system regularly collects network equipment information through a protocol, and a monitoring agent collects server and machine room environment data; processing data in real time by adopting distributed storage and a stream processing framework; predicting a network fault by adopting threshold monitoring and a machine learning model, and identifying a bottleneck and scheduling resources based on flow analysis; in combination with deep packet inspection and an AI algorithm, network traffic is monitored in real time, security threats are identified, and IPS system protection is deployed; a repair operation is automatically triggered through a self-healing strategy, and backup resources are started; the AI engine analyzes historical and real-time data, generates network topology and link state visual content, and automatically generates reports, optimization and decision support; according to the intelligent operation and maintenance monitoring management system and method for the network line, a fault tree analysis and decision support system is introduced, and a plurality of fault reasons are intelligently analyzed and repair measures are automatically executed.

The invention relates to the technical field of network security situation generation, in particular to a network security situation generation method based on multi-view monitoring. The method comprises the following steps of: constructing a multi-view data acquisition system, acquiring real-time information from a multi-dimensional data source, and comprehensively capturing potential threats by utilizing an intelligent sensing technology; cleaning, noise filtering and feature extraction are performed on the acquired data based on a dynamic threshold self-adaption multi-factor cleaning method, so that the accuracy and consistency of the data are ensured; a dynamic analysis algorithm based on deep learning is adopted, the incidence relation between the security events is mined, and the development trend of potential threats is predicted; constructing a joint learning model, and comprehensively evaluating the security state of the network environment; the security situation is dynamically displayed by using a visualization technology, and a security policy is quickly generated in combination with an automatic early warning and response mechanism to resist threats. According to the method, accurate evaluation and prediction of the network security situation are realized, and support is provided for security decision-making in a complex network environment.

Generating unified cybersecurity signals from multiple sources includes receiving a plurality of cybersecurity signals each determined based on monitoring a computing environment by a plurality of cybersecurity monitoring systems, including at least two disparate cybersecurity monitoring systems; managing a graph based on the plurality of cybersecurity signals where the graph includes nodes of entities in the computing environment and vertices representing relationships between the nodes, wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems; analyzing the graph to determine a representation of the computing environment; and managing the computing environment based on the analyzing the graph including determining one or more cybersecurity threats in the computing environment and associated severity.

The invention provides a network security protection method and system applied to regional digital and intelligent asset businesses, and the method comprises the steps: collecting asset data flows of a plurality of asset business nodes in a target region, carrying out the threat feature extraction of the asset data flows based on a preset threat knowledge graph, and obtaining a threat feature extraction result; generating a dynamic threat feature vector corresponding to the asset service node; inputting the dynamic threat feature vector into a pre-trained dynamic protection model, and outputting a real-time protection strategy adaptive to the asset service node through a multi-layer decision network in the dynamic protection model; performing strategy execution on the network flow of the asset service node based on the real-time protection strategy, generating a strategy execution result and feeding back the strategy execution result to the dynamic protection model; and performing adaptive optimization on decision parameters of the dynamic protection model according to a strategy execution result, and generating an updated dynamic protection model for a protection decision of a next round of asset business nodes.

The invention provides an industrial control network security advanced threat detection system fused with artificial intelligence. The system comprises a multi-source data acquisition module, an intelligent analysis engine, a threat detection module, a dynamic defense module and a self-evolution learning system which perform data interaction in sequence. The industrial control network security advanced threat detection system fused with artificial intelligence realizes collaborative decision-making among the modules through a dynamic knowledge graph. Through multi-source data fusion, dynamic knowledge graph and lightweight model design, the core problems of protocol analysis, threat association, defense collaboration and model adaptability in the industrial control network security field are solved, and a full-stack protection system covering'perception-analysis-decision-response-evolution 'is constructed. The deep analysis capability of an industrial protocol is improved, the dynamic threat association analysis is broken through, the agility of a defense strategy is enhanced, and the feasibility of continuous optimization of a model is improved, so that a systematic solution is provided for advanced threat defense in a complex industrial control environment.

The present application relates to the technical field of communications, and in particular to a network security threat processing method and apparatus, and an electronic device. The method comprises: on the basis of acquired local area network data, determining a network security attack type of a network attack event and an association relationship between entities in the network attack event; constructing a knowledge graph on the basis of the network security attack type, the association relationship between the entities in the network attack event and a configuration rule of an initial weight; using any node in the knowledge graph as an initial node, accessing each neighbor node of the initial node along adjacent edges of the initial node, and using a preset algorithm to calculate an initial weight of each neighbor node to obtain a degree-of-maliciousness weight of the initial node; and comparing the degree-of-maliciousness weight with a preset first threshold value, and deleting a node with a degree-of-maliciousness weight thereof being lower than the first threshold value in the knowledge graph, and also deleting the adjacent edges to obtain an updated knowledge graph. The solution can improve the network security threat processing efficiency.

The invention provides a flow analysis and threat detection method and device based on machine learning, and the method comprises the steps: collecting a real-time flow data package of a target network environment, carrying out the protocol analysis and session recombination, and generating a real-time flow feature data set containing multi-dimensional flow features; loading a pre-trained multi-level threat classification model, inputting the real-time traffic feature data set into a feature extraction layer of the model, carrying out normalized coding on traffic features of corresponding dimensions through feature coding channels, generating a real-time feature vector sequence, inputting the real-time feature vector sequence into a primary classifier of the model, and classifying the real-time traffic features according to the real-time feature vector sequence; and performing abnormal probability calculation and cluster division on the real-time feature vector sequence through a mixed detection unit, outputting a primary threat tag and an abnormal confidence coefficient corresponding to each real-time feature vector, inputting the primary threat tag and the abnormal confidence coefficient into an aggregation classifier, performing dynamic weighted aggregation, and generating a comprehensive threat score so as to judge whether a threat response strategy is triggered or not. According to the invention, the accuracy and timeliness of threat detection in a complex network environment can be improved.

The invention is an AI-driven blockchain platform for automated trade management, featuring smart contract customization, cross-chain interoperability, and quantum-resistant security. It tokenizes legal rights, obligations, and asset ownership as NFTs on the blockchain for transparency. The platform adapts contracts in real-time based on market data, compliance, and IoT-monitored trade conditions. It includes automated cryptocurrency payments with privacy controls, a decentralized dispute resolution system, and modules for modular automation and risk management. The platform supports dynamic compliance adjustments and ethical trade metrics, enhancing international trade operations through AI-driven matchmaking and behavioral analytics for partner vetting. By integrating advanced cryptographic techniques and IoT data, the platform ensures secure, efficient, and adaptable trade processes across multiple blockchain networks, optimizing workflows and safeguarding transactions against future technological threats.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention discloses a multi-level information security policy generation method based on a knowledge graph, and the method comprises the following steps: S1, collecting multi-modal data of a plurality of security data sources, and generating a standardized data set; s2, constructing and dynamically updating a multi-level knowledge graph based on the standardized data set; s3, based on the multi-level knowledge graph, a graph neural network is adopted to identify security threats and generate an evaluation report; s4, analyzing time-space characteristics of the security event, and predicting a threat evolution trend; s5, optimizing a protection strategy based on the graph attention network, and adjusting in combination with a real-time feedback mechanism; s6, simulating an attack scene by using a generative adversarial network, and optimizing a security protection strategy generation process; and S7, based on the optimized protection strategy, further adjusting and optimizing by adopting a meta-learning algorithm. Through combination of meta learning, the graph neural network and the generative adversarial network, an intelligent and dynamically adjusted network security protection strategy generation and optimization scheme is provided.

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

The invention discloses an intelligent operation and maintenance management and control system for an information communication network, and belongs to the technical field of communication. The system comprises the following modules: an intelligent sensing and data acquisition module which is responsible for real-time acquisition of multi-source network data, dynamic monitoring of cross-domain equipment states and conversion of heterogeneous data into a unified standard; the network intelligent analysis module integrates network performance prediction, fault risk assessment, abnormal behavior identification and security threat monitoring, and provides comprehensive network operation and maintenance insight; the intelligent resource scheduling module is used for realizing dynamic allocation of cross-domain network resources and ensuring efficient and safe utilization of the resources through multi-dimensional optimization and a real-time load balancing strategy; the intelligent decision support module is used for continuously optimizing an operation and maintenance strategy based on machine learning, analyzing a long-term operation trend and providing suggestions for management decisions; and the open integration and collaboration module provides integration of an open API interface and a third-party system, supports cross-domain collaboration management, and improves the flexibility and expansibility of the system.

The invention relates to the technical field of information security, in particular to a power distribution Internet of Things cloud side end collaborative interaction security protection system, which comprises a network flow monitoring module, an abnormal flow identification module, a security threat response module, a network attack early warning module, a behavior pattern analysis module and an access authority management module. According to the method, the network flow data is collected and analyzed in real time, the abnormal flow recognition speed and accuracy are enhanced, the security threat response speed and efficiency are improved, measures are taken in time at the early stage of a problem, the risks of data leakage and network attacks are reduced, and the timeliness of defense measures is improved by combining security threat response and network attack early warning; by analyzing the relevance between threat events, the complex multi-stage attack activity is effectively predicted and identified, the access data and the communication mode of the equipment are monitored in real time, and the access authority and the trust level are adjusted, so that the security protection is more targeted and flexible, and the management efficiency of the risk equipment is improved.

The invention relates to the technical field of network attacks, in particular to a network attack dynamic detection and security protection method and system based on artificial intelligence, and the method comprises the following steps: S1, data collection: collecting a multi-protocol communication data flow of network equipment, and generating a multi-dimensional feature vector; s2, constructing a cross-protocol behavior graph: generating a dynamically updated network behavior graph; s3, anomaly detection: identifying an abnormal behavior mode through the deep residual sequential network, and outputting threat evaluation parameters; s4, protection strategy generation: generating a dynamic protection instruction set through a reinforcement learning decision algorithm; and S5, protection execution: executing the dynamic protection instruction set to complete safety protection operation. According to the method, the multi-protocol fusion behavior graph is constructed, and an abnormal detection mechanism of graph nerve and differential modeling and a dynamic response strategy driven by reinforcement learning are introduced, so that high-precision identification and efficient protection of network attacks are realized.

A system and methods for implementing adversarial-robust compression and reconstruction using a vector quantized variational autoencoder (VQ-VAE) with secure latent space management. The system provides comprehensive protection against adversarial attacks through multi-channel threat detection, adaptive defensive parameters, and coordinated response mechanisms. Input data is continuously monitored for potential threats, and defensive parameters are dynamically adjusted based on detected threat levels. The system implements bounded constraints and hierarchical projections to maintain latent space security while preserving compression efficiency. Multi-stage reconstruction with progressive validation ensures reliable data recovery even under adversarial conditions. The system coordinates defensive responses across all compression and reconstruction processes, implementing various recovery mechanisms when security violations are detected. This approach enables robust compression and reconstruction of time-series data while maintaining protection against various forms of adversarial manipulation.

The invention relates to the technical field of network operation and maintenance supervision, in particular to a network operation and maintenance environment risk assessment method and system based on a mimicry security technology, and the method comprises the steps: carrying out the collection and preprocessing of network operation and maintenance environment data, and generating standardized security data; abnormal feature data and disturbance response data are extracted through real mimicry analysis and active challenge mimicry analysis, and associated threat feature data are generated through fusion; based on the associated threat feature data, constructing a heterogeneous twin model, performing state modeling, threat modeling and resource modeling, and generating risk assessment data; and generating an optimal response strategy through a multi-objective optimization algorithm, including flow control, node isolation and resource scheduling, and dynamically updating a risk state through a feedback regulation mechanism. Through dynamic threat identification and real-time optimization response, the risk assessment accuracy and the security defense level of the network operation and maintenance environment are improved, and the method has the advantages of being efficient, intelligent and dynamic.

Methods and systems for dynamic shielding in network security is disclosed. The method comprises analyzing real-time network traffic to detect a potential threat and assessing a severity level for each detected threat. Vulnerabilities of the devices in the network and the communications network to which each device is connected can be determined. A risk score can be generated for the threat based on the severity level of the threat and the vulnerabilities in the network. A response strategy can be implanted based on the risk score. The response strategy can include predefined actions for risk scores below a threshold, and maximum protective measures for risk scores above the threshold. The methods and systems can employ machine learning algorithms for threat detection and classification and utilize adaptive learning to refine future response strategies based on historical data of network interactions and system responses.