115 results about "Threat model" patented technology

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

The invention discloses a data safety protection method for a photovoltaic power station in an intelligent power grid environment, and relates to the technical field of intelligent water supply equipment inspection. The method comprises the following steps of: 1, identifying and evaluating a data security risk of a photovoltaic power station by utilizing an attack tree model and a threat model, and evaluating a risk level; and meanwhile, on the basis of a block chain technology, a unique digital identity label is generated for the photovoltaic power station equipment and a service scene thereof, and access control is implemented. According to the data security protection method for the photovoltaic power station in the intelligent power grid environment, a large amount of data can be efficiently processed, the security and integrity of the data in the transmission, storage and processing processes are ensured, information leakage or hostile attacks can be avoided, the data security of the photovoltaic power station is improved, and safe and stable operation of a power system is ensured.

The invention belongs to the technical field of network security early warning, and discloses a network security threat information early warning method and system based on big data, and the method comprises the steps: collecting and integrating internal data and external data related to network security based on the big data, carrying out the natural language processing and analysis of unstructured threat information, and constructing a threat entity association relationship through a knowledge graph; constructing an adaptive threat model based on network security threat information of big data and deep learning, and using a convolutional neural network CNN to identify an abnormal mode in encrypted traffic; establishing a user-device behavior baseline through a long short-term memory (LSTM) network; predicting a threat diffusion path in combination with a graph neural network GNN, developing a threat risk quantitative model, and calculating an information risk value by comprehensively considering an attack success rate, an asset value, an influence range value and a response delay; and performing risk prediction on the network security threat information based on the calculated information risk value in combination with calculation and analysis of the information risk attenuation factor.

This invention relates to a computer-implemented threat modeling system, designed to enhance cybersecurity processes. The system comprises a threat modeling engine linked with a user interface module, capable of processing electronic input data and generating digital representations of threat scenarios. It includes a database system for storing crucial data, such as user input, generated threat scenarios, and mitigation strategies, an artificial intelligence module that employs machine learning and natural language processing to autonomously generate threat scenarios, a collaboration module to facilitate interactive exchanges among users with capabilities for real-time communication and secure sharing of threat models. Additionally, it incorporates a methodology and framework selection module for applying various threat modeling methodologies and frameworks. An integration module enables interfacing with external systems for data import and export, enhancing the accuracy of threat modeling.

The invention relates to the technical field of the Internet of Things, and discloses a wireless sensor network environment monitoring system and a safety protection method based on the Internet of Things, and the system method comprises the steps: collecting sensing node environment data to generate a multi-dimensional feature matrix, and constructing a safety protection strategy set; setting threat parameter types, and establishing a security threat association model by using historical data; extracting real-time attack features and flow parameters, and generating a dynamic protection instruction set and an optimization scheme in combination with the model; and reconstructing a network node control mechanism to generate a target protection scheme, and dynamically and synchronously calibrating an instruction time sequence. The system comprises a node data acquisition module, a security policy generation module, a threat parameter analysis module, a threat modeling module, a risk assessment module, a protection mechanism reconstruction module and a time sequence synchronization module. Through multi-dimensional feature analysis, dynamic threat modeling, adaptive risk assessment and time sequence encryption synchronization, the security protection capability of the wireless sensor network in a complex environment is improved, and the method is suitable for security protection requirements in the field of Internet of Things environment monitoring.

The invention relates to the technical field of robot obstacle avoidance methods, in particular to an obstacle avoidance method of a robot. According to the method, a dynamic environment sensing system is constructed through multi-sensor fusion, and a dynamic feature description package and a static environment sketch are generated. The system generates a global navigation route by adopting an improved path planning algorithm, and constructs an obstacle space-time probability distribution map in combination with a multi-hypothesis prediction technology. According to the method, a two-channel intention analysis mechanism is introduced, the motion intention of a target is predicted by analyzing the kinematics characteristics and the biological behavior characteristics of the target, and a four-dimensional space-time threat model is established by fusing a space-time probability graph. And according to the threat level, a hierarchical obstacle avoidance strategy is dynamically generated, wherein the hierarchical obstacle avoidance strategy comprises various response modes such as path fine adjustment, speed cooperative adjustment and emergency channel avoidance. The environment cognition and behavior model is continuously updated through a closed-loop optimization mechanism, and finally safe and smooth autonomous navigation in the high-dynamic man-machine coexistence environment is achieved.

Methods, systems, and computer program products are provided for artificial intelligence assisted cybersecurity threat modeling tool that may include receiving data associated with a security architecture document for a specific software environment, converting the data associated with the security architecture document from a natural language format to a threat modeling data format, generating a plurality of vector embeddings based on the threat modeling data, identifying one or more potential cybersecurity threats based on the plurality of vector embeddings, and mapping the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

Aspects described herein may automatically generate threat models using large language model (LLM). A computing device may send, to LLM, one or more software modules associated with a computing system. The computing device may request the LLM to generate a threat model of the computing system. The computing device may receive, from the LLM, a first output based on the first prompt comprising first information for a first version of the threat model and a penetration test script for the computing system. The computing device may input, to the LLM, the result of the penetration test together with the LLM's previous output, to facilitate the LLM to generate a refined version of the threat model.

Disclosed are various approaches for multimodal large language model (LLM) based threat modeling. The multimodal LLM based threat modeling can include a system or method that can input, into a threat modeling multimodal LLM, prompting data that includes audio data, image data, and LLM instructions to generate application security data. The threat modeling multimodal LLM can generate and provide application security data that includes at least one of: threat data, weakness data, security control data, a security risk summarization, an application threat model, or any combination thereof.

The invention discloses a situation awareness and linkage disposal system based on dynamic threat modeling driving, and the system comprises a security data collection and standardization module which is used for collecting security data of a network, a host and an application layer, and carrying out the standardization processing; the dynamic threat modeling module is used for constructing a dynamic threat model; the threat agent modeling and simulation module is used for modeling each node in the threat attack graph into a threat agent; the parameter optimization module is used for globally optimizing parameters and strategy weights of the Monte Carlo tree search network by using a seagull algorithm; the linkage processing decision module is used for configuring a Monte Carlo tree search network based on the optimal parameter group; the safety equipment scheduling module is used for analyzing the optimal linkage disposal decision scheme; and the disposal effect evaluation and feedback module is used for performing multi-dimensional analysis on the disposal feedback data set. According to the invention, accurate situation awareness and linkage processing are provided for the user.

Various embodiments are provided for automated evaluation of machine learning models in a computing environment by one or more processors in a computing system. A level of robustness of a machine learning model against adversarial whitebox operations may be evaluated and determined by applying a data set used for testing the machine learning model, one or more adversarial operation objectives, an adversarial threat model, and a selected number of hyperparameters. Results from the adversarial operation may be analyzed and a modified machine learning model may be generated while performing the evaluating and determining.

The invention provides a client identity authentication security evaluation method and system combined with adversarial sample simulation, and relates to the technical field of information security. According to the invention, end-cloud integrated evaluation is carried out under a white-box and black-box threat model for multi-mode identification objects of human face, voiceprint, fingerprint and behavior characteristics. The method comprises the steps of establishing reference performance through legal samples, generating transferable adversarial input, performing secure injection on a communication layer, calculating a robustness index, performing adaptive optimization, performing differential evaluation on protection effectiveness under protection configuration starting and non-starting, and performing risk grading and reinforcement according to a result. And finally, outputting a reproducible security and compliance conclusion through differential privacy and federal evaluation.

Systems and methods for determining one or more security threats associated with code in a code file are described. The method includes analyzing the code file to identify one or more properties, of a plurality of properties associated with one or more resources included in the code file. For each property of the identified one or more properties, the method further includes identifying a value for the property defined in the code file, and determining whether a security threat is associated with the property based on the identified value for the property and information regarding security threats associated with one or more values of the plurality of properties.

The application discloses the network security early warning technical field, disclose a kind of network security threat information early warning method and system based on big data, comprising: based on big data collection and integration about network security internal data and external data, natural language processing analysis unstructured threat intelligence, threat entity association is built by knowledge graph;Based on big data of network security threat information and deep learning constructs adaptive threat model, uses convolutional neural network CNN to identify abnormal mode in encrypted traffic;Through long short-term memory network LSTM establishes user-device behavior baseline;In combination with graph neural network GNN, the threat diffusion path is predicted, a threat risk quantization model is developed, and the information risk value is calculated by comprehensively considering the attack success rate, asset value, influence range value and response delay;Based on the information risk value calculated, combined with information risk attenuation factor, risk prediction is carried out on network security threat information.

The invention relates to the technical field of network security, and discloses a plan generation and execution method and system for network security emergency response, and the method comprises the following steps: obtaining and preprocessing network security threat data, extracting key features, and constructing a threat model; based on the threat model, generating at least one emergency response plan through a preset algorithm; sorting the generated plans according to priorities, and selecting an optimal plan for execution; the network state is monitored in real time in the plan execution process, plan parameters are dynamically adjusted according to the feedback result, and the plan parameters are used for conducting result adjustment in the plan process. The system corresponds to the method. By the adoption of the method and device, the defects of a traditional method in threat identification and resource scheduling are effectively overcome, and a reliable solution is provided for modern network security protection.

The present disclosure of the various embodiments relates to using a large language model to assistant with the creation of secure code and / or the completion of threat modeling tasks in software development. In one example, a system comprises a computing device configure to identify a prompt that requests generating secure source code for source code with a security vulnerability. A security data source is queried for a security threat embedding. The security threat embedding is received from the security data source and an augmented prompt is generated. The augmented prompt is transmitted to the large language model. A secure source code is received from the large language model and imported into application source code in a software development environment.

Various example embodiments provide for threat modeling using machine learning models and context information, where a threat model is generated based on a threat model diagram for a target system being analyzed for threat risks / scenarios. For an individual threat model generated, a threat scenario (e.g., each individual threat scenario) described in the individual threat model can be processed (e.g., individually processed) by a plurality of machine learning models to determine a set of generic mitigation labels for the threat scenario, where each generic mitigation label corresponds to a generic mitigation strategy for mitigating the threat scenario. The set of generic mitigation labels for the threat scenario with context information can be processed by one or more large language models to generate a set of specific mitigation labels for the individual threat model, where each specific mitigation label corresponds to a specific mitigation strategy.

The invention relates to the technical field of threat analysis, in particular to a threat analysis and reduction method based on an industrial field environment, and the method comprises the following steps: S1, detecting asset equipment in a whole network range to obtain asset equipment information, and obtaining vulnerability scanning data according to the asset equipment information; s2, the AI model determines a network asset attack priority according to the asset equipment information, obtains asset risk data according to the network asset attack priority, and carries out threat analysis through a red team perspective to obtain threat attack coverage data; and S3, establishing a threat model according to the asset risk data and the threat attack coverage data, and outputting a security solution according to the threat model. By detecting the asset equipment and performing vulnerability scanning, the method has the advantages of accurate data and wide data source; through AI model analysis, the analysis surface and the analysis depth of related attacks are greatly enriched; and establishing a threat model and outputting a security solution to prevent omission of security reinforcement points due to incomplete consideration.

The invention relates to the technical field of identity security verification, and discloses a multi-identity security verification system based on big data. The system comprises a verification collection module, a feature construction module, a risk modeling module and a decision engine module, wherein the verification collection module obtains user multi-source biological features, behavior tracks and equipment environment data, and performs preprocessing to generate an initial feature set; the feature construction module extracts spatiotemporal behavior patterns and cross-device association features and fuses the spatiotemporal behavior patterns and the cross-device association features into a multi-dimensional The risk modeling module loads a pre-trained dynamic threat model, carries out real-time risk layering on the multi-dimensional feature matrix, and outputs a risk level identifier and an abnormal feature vector; and the decision engine module calls a corresponding verification strategy library, and generates a multi-factor verification instruction set in combination with the abnormal feature vector. The system realizes comprehensive verification of user identities through multi-source data integration, dynamic risk assessment and precise strategy matching, and adapts to various high-security demand scenes.

The invention discloses an enterprise information security defense strategy generation method based on an adaptive rule engine, and relates to the technical field of network and information security, and the method comprises the steps: carrying out the multi-dimensional feature vectorization processing of real-time security event data, and generating a threat feature vector set; based on the threat feature vector set, constructing a dynamic threat model, calculating a risk assessment score of each threat feature vector, and performing clustering analysis on the threat feature vectors to generate a threat scene classification result and a threat level identifier; inputting the threat scene classification result into an adaptive rule engine to generate an initial defense rule set, and correcting the rule priority of the initial defense rule set in real time through a rule weight dynamic adjustment mechanism to form an adaptive defense rule set; and generating a hierarchical enterprise information security defense strategy according to the self-adaptive defense rule set, and sending the hierarchical enterprise information security defense strategy to an enterprise network. According to the method, the dynamic adaptation capability of defense rules and the hierarchical accuracy of strategy deployment are ensured.

Systems and methods for implementing a threat model that classifies contextual events as threats.

Methods and systems for securing software architectures are disclosed. The software architectures may be secured through the implementation of threat models. The threat models may include design threat models that indicate vulnerabilities that software based on an architecture may exhibit, and build threat models that indicate vulnerabilities of implementation of the software based on the architecture may exhibit. The threat models may be used to select where and how to deploy software to limit exploitable vulnerabilities to be within acceptable levels.

In one aspect, a distributed security-testing infrastructure is used for attack-tree modeling for penetration testing. An API framework, fully distributed and scalable, is used to access the attack-tree modeling based on attack trees, or decision trees, to emulate attacker behavior and decisions taken during an attack. The API framework allows developers to implement the security tools into existing software to perform actions based on desired conditions as defined by the nodes of the attack tree. For example, APIs can be used along with if / else-type statements to create advanced threat models that react based on given conditions to test multiple paths through the attack tree. Nodes of the attack tree are configured to perform actions based on the output of previous attacks in other nodes. This flexible design allows for the easy modification of the threat modeling system to test new scenarios.

This invention relates to a computer-implemented threat modelling system, designed to enhance cybersecurity processes. The system comprises a threat modelling engine linked with a user interface modul

This invention provides a method for constructing a threat model based on sensitive information reverse inference using electricity price data, belonging to the field of smart grid analysis technology. This invention constructs a homogeneous linear equation model between electricity price and admittance matrix based on a DC power flow model and a local marginal price theory model. It extracts node and edge features from power data, inputs them into a dynamic routing encoder, outputs encoded feature sequences of nodes and edges, performs time-series modeling on the encoded features, outputs the grid admittance parameter sequence at each time step, and corrects and optimizes the parameter sequence. A differential privacy mechanism is used to perturb the electricity price data. Combined with the optimized parameter sequence, the sensitive information reverse inference threat model is constructed. This invention utilizes dynamic feature encoding and time-series modeling techniques, combined with a differential privacy strategy, to achieve effective reverse inference of grid admittance parameters based on publicly available data, and also completes privacy protection and risk assessment of electricity price data using the differential privacy strategy.

The invention relates to the technical field of data processing, in particular to a security threat model optimization system and method based on online self-learning, and the system comprises a data collection module which eliminates the electromagnetic interference of a power grid, dynamically adjusts the sampling frequency, and improves the data quality; the feature processing module extracts statistical features and topological features by adopting a dual-channel parallel architecture, and dynamically selects a dimension reduction strategy based on an anomaly detection confidence index to compress and calculate a load; the threat detection module is combined with an electric power knowledge graph to identify an attack mode and reversely trigger feature reconstruction; the model optimization module selects a Bayesian optimization, model distillation or federated learning local update strategy according to the data drift index and the resource state, and reduces the parameter adjustment amount; and the feedback enhancement module positions data defects through the misinformation knowledge graph and injects adversarial samples. According to the invention, each module significantly reduces resource consumption and response delay through the cooperation of data flow closed-loop linkage, feature compression, intelligent updating and data optimization.

The invention relates to a penetration test method and system for mobile applications of a swan monk system, and the method comprises the steps: obtaining a current version installation package, extracting static asset data, and capturing dynamic behavior data; constructing a threat model for the gap distributed architecture; generating a penetration test case set through the threat model, and deploying and executing the penetration test case set; inputting the heterogeneous security telemetry data into the risk identification model, and executing a preset corresponding processing strategy; generating a penetration test report based on the risk judgment information and the execution result of the processing strategy; in conclusion, according to the penetration testing method and system for the mobile application of the swan-mong system, the threat model for the swan-mong distributed architecture is constructed, and the dynamic stain tracking and fuzzy testing technology is integrated, so that the cross-equipment safety risk is systematically detected; the method has the effects of effectively identifying the cross-equipment security threats in the swan-gap distributed architecture and improving the comprehensiveness and accuracy of the penetration test.

A system for monitoring threat models. The system stores test data that include activity data performed by two or more external sources. The test data includes data from at least one previous threat. The test data is updated with additional test data from at least one of two or more external sources. The additional test data includes new data associated with at least one new threat. The system receives two or more external sources from two or more threat models and implements them in a virtual test environment, which utilizes the two or more threat models to detect at least one previous threat and at least one new threat. When at least one of the two or more threat models does not detect the at least one new threat, an action is performed to modify it.

This invention presents a heuristic recovery mechanism for malicious shortcut file parsing and threat detection. It employs a resilience-oriented parsing engine, utilizes a dynamic byte ordering mechanism to adapt to underlying data, leverages a sliding window algorithm to accurately locate variable-length field terminators to extract hidden strings, and employs a recursive parsing strategy to deeply traverse undocumented nested structures and extension blocks. Parsing anomalies are treated as threat features and archived during the parsing process, and an iterative extraction strategy with adaptive parameters ensures full data acquisition. Based on the comprehensive parsing results, a three-dimensional threat model encompassing deception, evasion, and execution is constructed, achieving a deep mapping of malicious shortcut files from binary structure to logical behavior. This invention not only significantly improves the parsing success rate of variant samples but also effectively extracts fingerprint features from automatically generated samples, providing key technical support for modern shortcut-based attack and defense countermeasures.

Systems and methods for implementing a threat model that classifies contextual events as threats. The method can include: accessing a threat model; identifying a set of contextual events, wherein each contextual event comprises a set of semantic primitives predicted from a plurality of sensor streams; and determining a threat level for each contextual event based on threat probabilities.