150 results about "Threat model" patented technology

A system and method for continuous automated threat modeling which is based on prompt engineering using large language models includes a threat modeling engine, a threat prompt generator, and a continuous automation module configured to retrieve a threat prompt from the threat prompt generator and to perform a security assessment of the threat prompt on a continuous, automatic basis. In addition, the system and method each include integration with a large language model for generating threat models and mitigations pertaining to those threat models.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

The invention discloses a data safety protection method for a photovoltaic power station in an intelligent power grid environment, and relates to the technical field of intelligent water supply equipment inspection. The method comprises the following steps of: 1, identifying and evaluating a data security risk of a photovoltaic power station by utilizing an attack tree model and a threat model, and evaluating a risk level; and meanwhile, on the basis of a block chain technology, a unique digital identity label is generated for the photovoltaic power station equipment and a service scene thereof, and access control is implemented. According to the data security protection method for the photovoltaic power station in the intelligent power grid environment, a large amount of data can be efficiently processed, the security and integrity of the data in the transmission, storage and processing processes are ensured, information leakage or hostile attacks can be avoided, the data security of the photovoltaic power station is improved, and safe and stable operation of a power system is ensured.

The invention belongs to the technical field of network security early warning, and discloses a network security threat information early warning method and system based on big data, and the method comprises the steps: collecting and integrating internal data and external data related to network security based on the big data, carrying out the natural language processing and analysis of unstructured threat information, and constructing a threat entity association relationship through a knowledge graph; constructing an adaptive threat model based on network security threat information of big data and deep learning, and using a convolutional neural network CNN to identify an abnormal mode in encrypted traffic; establishing a user-device behavior baseline through a long short-term memory (LSTM) network; predicting a threat diffusion path in combination with a graph neural network GNN, developing a threat risk quantitative model, and calculating an information risk value by comprehensively considering an attack success rate, an asset value, an influence range value and a response delay; and performing risk prediction on the network security threat information based on the calculated information risk value in combination with calculation and analysis of the information risk attenuation factor.

This invention relates to a computer-implemented threat modeling system, designed to enhance cybersecurity processes. The system comprises a threat modeling engine linked with a user interface module, capable of processing electronic input data and generating digital representations of threat scenarios. It includes a database system for storing crucial data, such as user input, generated threat scenarios, and mitigation strategies, an artificial intelligence module that employs machine learning and natural language processing to autonomously generate threat scenarios, a collaboration module to facilitate interactive exchanges among users with capabilities for real-time communication and secure sharing of threat models. Additionally, it incorporates a methodology and framework selection module for applying various threat modeling methodologies and frameworks. An integration module enables interfacing with external systems for data import and export, enhancing the accuracy of threat modeling.

Systems and methods that create, use, enhance, maintain, and otherwise optimize a threat model—generally used for risk evaluation and threat mitigation—comprising artificial intelligence inherent in an entity is described. Certain embodiments describe, in countering a threat event, a need for an artificial intelligence entity to cooperate with non-expert users to give the users abilities to act on the domain in the users' self-interest. In countering a threat event, certain other embodiments describe that no single actor, in a heterogeneous collection of actors with varying abilities, may act in isolation to efficiently and effectively counter the threat to the collection; a minimum inevitable loss for the threat event may be achieved by an active cooperation of the heterogeneous actors of type comprising at least one of: expert users, non-expert users, and artificial intelligence entities that are sufficiently trained and knowledgeable on the threat event.

The invention relates to the technical field of the Internet of Things, and discloses a wireless sensor network environment monitoring system and a safety protection method based on the Internet of Things, and the system method comprises the steps: collecting sensing node environment data to generate a multi-dimensional feature matrix, and constructing a safety protection strategy set; setting threat parameter types, and establishing a security threat association model by using historical data; extracting real-time attack features and flow parameters, and generating a dynamic protection instruction set and an optimization scheme in combination with the model; and reconstructing a network node control mechanism to generate a target protection scheme, and dynamically and synchronously calibrating an instruction time sequence. The system comprises a node data acquisition module, a security policy generation module, a threat parameter analysis module, a threat modeling module, a risk assessment module, a protection mechanism reconstruction module and a time sequence synchronization module. Through multi-dimensional feature analysis, dynamic threat modeling, adaptive risk assessment and time sequence encryption synchronization, the security protection capability of the wireless sensor network in a complex environment is improved, and the method is suitable for security protection requirements in the field of Internet of Things environment monitoring.

The invention relates to the technical field of robot obstacle avoidance methods, in particular to an obstacle avoidance method of a robot. According to the method, a dynamic environment sensing system is constructed through multi-sensor fusion, and a dynamic feature description package and a static environment sketch are generated. The system generates a global navigation route by adopting an improved path planning algorithm, and constructs an obstacle space-time probability distribution map in combination with a multi-hypothesis prediction technology. According to the method, a two-channel intention analysis mechanism is introduced, the motion intention of a target is predicted by analyzing the kinematics characteristics and the biological behavior characteristics of the target, and a four-dimensional space-time threat model is established by fusing a space-time probability graph. And according to the threat level, a hierarchical obstacle avoidance strategy is dynamically generated, wherein the hierarchical obstacle avoidance strategy comprises various response modes such as path fine adjustment, speed cooperative adjustment and emergency channel avoidance. The environment cognition and behavior model is continuously updated through a closed-loop optimization mechanism, and finally safe and smooth autonomous navigation in the high-dynamic man-machine coexistence environment is achieved.

The embodiment of the invention relates to the technical field of unmanned aerial vehicles, in particular to a method and a device for dynamically sensing a target threat area of an unmanned aerial vehicle. The embodiment of the invention provides a method for dynamically sensing a target threat area of an unmanned aerial vehicle. The method comprises the following steps: respectively establishing a terrain threat model, an artificial flight target threat model, a bird threat model and a sensor threat model; determining the weight of each threat model by using a Critic comprehensive objective weighting method and a dynamic weight change theory; and judging whether the area is safe or not according to all threat models and weights thereof. The embodiment of the invention provides a method and a device for dynamically sensing a target threat area of an unmanned aerial vehicle, electronic equipment and a storage medium, and can provide a more accurate method for dynamically sensing the target threat area of the unmanned aerial vehicle.

Methods, systems, and computer program products are provided for artificial intelligence assisted cybersecurity threat modeling tool that may include receiving data associated with a security architecture document for a specific software environment, converting the data associated with the security architecture document from a natural language format to a threat modeling data format, generating a plurality of vector embeddings based on the threat modeling data, identifying one or more potential cybersecurity threats based on the plurality of vector embeddings, and mapping the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

Aspects described herein may automatically generate threat models using large language model (LLM). A computing device may send, to LLM, one or more software modules associated with a computing system. The computing device may request the LLM to generate a threat model of the computing system. The computing device may receive, from the LLM, a first output based on the first prompt comprising first information for a first version of the threat model and a penetration test script for the computing system. The computing device may input, to the LLM, the result of the penetration test together with the LLM's previous output, to facilitate the LLM to generate a refined version of the threat model.

Disclosed are various approaches for multimodal large language model (LLM) based threat modeling. The multimodal LLM based threat modeling can include a system or method that can input, into a threat modeling multimodal LLM, prompting data that includes audio data, image data, and LLM instructions to generate application security data. The threat modeling multimodal LLM can generate and provide application security data that includes at least one of: threat data, weakness data, security control data, a security risk summarization, an application threat model, or any combination thereof.

The invention discloses a situation awareness and linkage disposal system based on dynamic threat modeling driving, and the system comprises a security data collection and standardization module which is used for collecting security data of a network, a host and an application layer, and carrying out the standardization processing; the dynamic threat modeling module is used for constructing a dynamic threat model; the threat agent modeling and simulation module is used for modeling each node in the threat attack graph into a threat agent; the parameter optimization module is used for globally optimizing parameters and strategy weights of the Monte Carlo tree search network by using a seagull algorithm; the linkage processing decision module is used for configuring a Monte Carlo tree search network based on the optimal parameter group; the safety equipment scheduling module is used for analyzing the optimal linkage disposal decision scheme; and the disposal effect evaluation and feedback module is used for performing multi-dimensional analysis on the disposal feedback data set. According to the invention, accurate situation awareness and linkage processing are provided for the user.

Various embodiments are provided for automated evaluation of machine learning models in a computing environment by one or more processors in a computing system. A level of robustness of a machine learning model against adversarial whitebox operations may be evaluated and determined by applying a data set used for testing the machine learning model, one or more adversarial operation objectives, an adversarial threat model, and a selected number of hyperparameters. Results from the adversarial operation may be analyzed and a modified machine learning model may be generated while performing the evaluating and determining.

The invention provides a client identity authentication security evaluation method and system combined with adversarial sample simulation, and relates to the technical field of information security. According to the invention, end-cloud integrated evaluation is carried out under a white-box and black-box threat model for multi-mode identification objects of human face, voiceprint, fingerprint and behavior characteristics. The method comprises the steps of establishing reference performance through legal samples, generating transferable adversarial input, performing secure injection on a communication layer, calculating a robustness index, performing adaptive optimization, performing differential evaluation on protection effectiveness under protection configuration starting and non-starting, and performing risk grading and reinforcement according to a result. And finally, outputting a reproducible security and compliance conclusion through differential privacy and federal evaluation.

Systems and methods for determining one or more security threats associated with code in a code file are described. The method includes analyzing the code file to identify one or more properties, of a plurality of properties associated with one or more resources included in the code file. For each property of the identified one or more properties, the method further includes identifying a value for the property defined in the code file, and determining whether a security threat is associated with the property based on the identified value for the property and information regarding security threats associated with one or more values of the plurality of properties.

The application discloses the network security early warning technical field, disclose a kind of network security threat information early warning method and system based on big data, comprising: based on big data collection and integration about network security internal data and external data, natural language processing analysis unstructured threat intelligence, threat entity association is built by knowledge graph;Based on big data of network security threat information and deep learning constructs adaptive threat model, uses convolutional neural network CNN to identify abnormal mode in encrypted traffic;Through long short-term memory network LSTM establishes user-device behavior baseline;In combination with graph neural network GNN, the threat diffusion path is predicted, a threat risk quantization model is developed, and the information risk value is calculated by comprehensively considering the attack success rate, asset value, influence range value and response delay;Based on the information risk value calculated, combined with information risk attenuation factor, risk prediction is carried out on network security threat information.

The invention relates to the technical field of network security, and discloses a plan generation and execution method and system for network security emergency response, and the method comprises the following steps: obtaining and preprocessing network security threat data, extracting key features, and constructing a threat model; based on the threat model, generating at least one emergency response plan through a preset algorithm; sorting the generated plans according to priorities, and selecting an optimal plan for execution; the network state is monitored in real time in the plan execution process, plan parameters are dynamically adjusted according to the feedback result, and the plan parameters are used for conducting result adjustment in the plan process. The system corresponds to the method. By the adoption of the method and device, the defects of a traditional method in threat identification and resource scheduling are effectively overcome, and a reliable solution is provided for modern network security protection.

The present disclosure of the various embodiments relates to using a large language model to assistant with the creation of secure code and / or the completion of threat modeling tasks in software development. In one example, a system comprises a computing device configure to identify a prompt that requests generating secure source code for source code with a security vulnerability. A security data source is queried for a security threat embedding. The security threat embedding is received from the security data source and an augmented prompt is generated. The augmented prompt is transmitted to the large language model. A secure source code is received from the large language model and imported into application source code in a software development environment.

Various example embodiments provide for threat modeling using machine learning models and context information, where a threat model is generated based on a threat model diagram for a target system being analyzed for threat risks / scenarios. For an individual threat model generated, a threat scenario (e.g., each individual threat scenario) described in the individual threat model can be processed (e.g., individually processed) by a plurality of machine learning models to determine a set of generic mitigation labels for the threat scenario, where each generic mitigation label corresponds to a generic mitigation strategy for mitigating the threat scenario. The set of generic mitigation labels for the threat scenario with context information can be processed by one or more large language models to generate a set of specific mitigation labels for the individual threat model, where each specific mitigation label corresponds to a specific mitigation strategy.

A low bandwidth homomorphic encryption (HE) key generation method, a homomorphic encryption (HE) system, and a computer program product. One embodiment of the method comprises generating, at a principal instance of an organization unit, a principal HE key set; generating a department HE key set for each of a plurality of departments in the organization unit; transmitting a principal public key, a principal evaluation key, and a plurality of principal rotation keys to a data processor; transmitting at least one department public key, and department key switching keys to the data processor; and transmitting an encrypted data file to be processed at least in part using a department rotation key generated at the data processor.

The invention relates to the field of security event tracking, in particular to a security event real-time tracking and tracing method and system based on artificial intelligence, and the system comprises a port switching module, a flow tracking module, a disk pointer module, a memory stack module and an attack clustering module, the port switching module is used for structuring a server database and outputting a threat model; the flow tracking module is used for tracking access flow, the disk pointer module is used for packaging temporary data packets, the memory stack module is used for storing the temporary data packets and pointers in a stack form, and the attack clustering module is used for clustering abnormal pointer clusters and identifying homologous attack flow. Meanwhile, repeated generation of security logs is reduced, the working efficiency of the security event protection system is improved, the efficiency and accuracy of real-time tracking and tracing of security events are improved, and the network security protection and emergency response capability is enhanced.

The invention relates to the technical field of threat analysis, in particular to a threat analysis and reduction method based on an industrial field environment, and the method comprises the following steps: S1, detecting asset equipment in a whole network range to obtain asset equipment information, and obtaining vulnerability scanning data according to the asset equipment information; s2, the AI model determines a network asset attack priority according to the asset equipment information, obtains asset risk data according to the network asset attack priority, and carries out threat analysis through a red team perspective to obtain threat attack coverage data; and S3, establishing a threat model according to the asset risk data and the threat attack coverage data, and outputting a security solution according to the threat model. By detecting the asset equipment and performing vulnerability scanning, the method has the advantages of accurate data and wide data source; through AI model analysis, the analysis surface and the analysis depth of related attacks are greatly enriched; and establishing a threat model and outputting a security solution to prevent omission of security reinforcement points due to incomplete consideration.

The invention relates to the technical field of identity security verification, and discloses a multi-identity security verification system based on big data. The system comprises a verification collection module, a feature construction module, a risk modeling module and a decision engine module, wherein the verification collection module obtains user multi-source biological features, behavior tracks and equipment environment data, and performs preprocessing to generate an initial feature set; the feature construction module extracts spatiotemporal behavior patterns and cross-device association features and fuses the spatiotemporal behavior patterns and the cross-device association features into a multi-dimensional The risk modeling module loads a pre-trained dynamic threat model, carries out real-time risk layering on the multi-dimensional feature matrix, and outputs a risk level identifier and an abnormal feature vector; and the decision engine module calls a corresponding verification strategy library, and generates a multi-factor verification instruction set in combination with the abnormal feature vector. The system realizes comprehensive verification of user identities through multi-source data integration, dynamic risk assessment and precise strategy matching, and adapts to various high-security demand scenes.

The invention discloses an enterprise information security defense strategy generation method based on an adaptive rule engine, and relates to the technical field of network and information security, and the method comprises the steps: carrying out the multi-dimensional feature vectorization processing of real-time security event data, and generating a threat feature vector set; based on the threat feature vector set, constructing a dynamic threat model, calculating a risk assessment score of each threat feature vector, and performing clustering analysis on the threat feature vectors to generate a threat scene classification result and a threat level identifier; inputting the threat scene classification result into an adaptive rule engine to generate an initial defense rule set, and correcting the rule priority of the initial defense rule set in real time through a rule weight dynamic adjustment mechanism to form an adaptive defense rule set; and generating a hierarchical enterprise information security defense strategy according to the self-adaptive defense rule set, and sending the hierarchical enterprise information security defense strategy to an enterprise network. According to the method, the dynamic adaptation capability of defense rules and the hierarchical accuracy of strategy deployment are ensured.

In some embodiments, a processor can receive an input string associated with a potentially malicious artifact and convert each character in the input string into a vector of values to define a character matrix. The processor can apply a convolution matrix to a first window of the character matrix to define a first subscore, apply the convolution matrix to a second window of the character matrix to define a second subscore and combine the first subscore and the second subscore to define a score for the convolution matrix. The processor can provide the score for the convolution matrix as an input to a machine learning threat model, identify the potentially malicious artifact as malicious based on an output of the machine learning threat model, and perform a remedial action on the potentially malicious artifact based on identifying the potentially malicious artifact as malicious.

The invention discloses a quantum signature and identity authentication method based on a quantum public key, relates to the technical field of quantum signature and quantum identity authentication, and solves the problems that existing digital signature and identity authentication are low in security, and eavesdropping and potential quantum computing threats cannot be detected. The method is composed of a registration stage, an initialization stage, a signature stage, an identity verification stage and a signature verification stage, a public key encryption algorithm based on quantum gate transformation is designed in the method and is applied to a quantum public key identity authentication stage, on one hand, encryption processing is conducted on a public key, and on the other hand, the identity authentication process is conducted. Therefore, the security of the signature identity is ensured. Meanwhile, a quantum signature method based on unitary operation is used, so that the security and quantum attack resistance of the signature stage are ensured. Finally, the security analysis shows that the security of the method depends on the undistinguishability of an unknown quantum sequence and a quantum man-in-the-middle attack threat model. According to the method, the security of signature and identity authentication is effectively improved.

The embodiment of the invention provides a threat analysis method and device for an Internet of Things automobile, a medium and a program product, and relates to the technical field of automobile information safety. The method comprises the following steps: determining a target attack path corresponding to a target service scene and a target modeling component corresponding to the target attack path according to a rule base constructed for the Internet of Things automobile; wherein the rule base is constructed according to a corresponding relationship between each service scene in the service scene base and each attack path in the attack path base, and a corresponding relationship between each attack path and each modeling component in the modeling component base; the target service scene is a service scene specified by a user in each service scene; connecting the target modeling component according to the target attack path, and establishing a threat model; and searching target threat data matched with the threat model from a threat database. According to the embodiment of the invention, the technical effect of automatically carrying out threat modeling analysis on the Internet of Things automobile can be realized.

Systems and methods for implementing a threat model that classifies contextual events as threats.

Methods and systems for securing software architectures are disclosed. The software architectures may be secured through the implementation of threat models. The threat models may include design threat models that indicate vulnerabilities that software based on an architecture may exhibit, and build threat models that indicate vulnerabilities of implementation of the software based on the architecture may exhibit. The threat models may be used to select where and how to deploy software to limit exploitable vulnerabilities to be within acceptable levels.