79 results about "Threat perception" patented technology

The invention discloses a dynamic honey point collaborative intelligent threat trapping system and method based on a genetic algorithm in the technical field of network security, and the system comprises a multi-source information collection and dual-mode output module, a reinforcement learning strategy engine, a graph neural network prediction module, a digital twin simulation environment, a strategy verification and optimization module, and a real network defense execution module. A dynamic honey point deployment strategy is generated in real time through a reinforcement learning strategy engine, and the problem of strategy stiffness is solved; a third-generation non-dominated sorting genetic algorithm (NSGA-III) multi-objective optimization algorithm is used for coordinating honey point density adjustment, trip line sensitivity calibration and other actions; attacking path risks are quantified based on a threat scoring formula, digital twin environment pre-verification and high-risk node precise protection are driven, closed-loop linkage of threat perception, strategy optimization and active trapping is finally achieved, and the intelligent defense capability capable of achieving autonomous evolution is formed.

The invention relates to the technical field of multi-modal data processing, and discloses a multi-modal threat perception method and system based on a space-time diagram neural network, and the method comprises the steps: obtaining a multi-modal original data set in a vehicle insurance claim settlement link, and carrying out the business relation mining and space-time dynamic analysis, and obtaining an entity space-time relation diagram; inputting the entity space-time relation graph into a space-time graph neural network for space-time fusion to obtain a node threat embedding vector; performing graph contrast learning and cross-modal feature discrimination on the node threat embedding vector to obtain a vehicle insurance threat feature vector; and carrying out fraud space-time propagation modeling based on the vehicle insurance threat feature vector, and generating a vehicle insurance threat blocking strategy, the method can accurately predict a propagation path and an influence boundary of gang fraud in a vehicle insurance ecological network, and identifies potential threats and starts prevention measures before a fraud behavior is completely displayed.

The invention relates to a data security processing method and system based on distributed storage, and relates to the technical field of computer information processing. The method comprises the following steps: cutting data into encryption fragments with a configurable number by adopting a dynamic fragmentation strategy, and generating a physically isolated dynamic check block in combination with a timestamp to realize tampering prevention; a dynamic threshold value is dynamically calculated based on the data sensitivity index and the node load, and the node is optimized through the reliability score for cooperative decryption; a database table is divided into independent marshalling storage according to main foreign key association, foreign key fields are encrypted by adopting cross keys, and cross-marshalling access needs to meet a multi-key threshold condition; an intelligent threat perception engine is constructed, access logs and threat intelligence are analyzed in real time, and key rotation, fragment replacement and joint defense response mechanisms are dynamically triggered. According to the invention, full life cycle protection of data is realized, and the problems of key leakage risk and cross-table association attack are effectively solved.

The invention discloses a multi-class network security threat perception and active and passive cooperative response processing system and method, and the system comprises a multi-class threat perception module which is used for perceiving a plurality of security threats existing in a network environment, and transmitting an obtained security event to a threat information association module; the threat information association module is used for analyzing and integrating various security events and extracting threat information from the security events; the attack graph-based threat path analysis module is used for mining vulnerability information in a network system, describing a network topology structure and an operation state, constructing an attack graph and obtaining active defense nodes in combination with a currently occurring security event and an analysis result of the attack graph; and the strategy generation module generates a corresponding response processing strategy according to the threat information and the property and the emergency degree of the security event, and generates an active defense strategy in combination with the active defense node, thereby realizing active defense and advanced deployment and control of potential threats. According to the invention, network security threats can be timely and effectively found and coped with.

The invention discloses an enterprise information security management method and system based on artificial intelligence, and belongs to the technical field of information management, and the method comprises the steps: inputting original data, integrating the original data into a first behavior graph structure, and constructing an attribute vector for a user node; threat perception and behavior risk assessment are carried out through a graph learning model, and the threat probability of each edge is output; identifying and quantifying attack paths in the graph, and generating an attack path set and a path risk score set; generating a protection strategy candidate set for each path, performing evaluation to obtain a grading result of the protection strategies, and sorting the protection strategies according to the grading result; and a protection strategy is deployed, the deployment state and protection feedback are monitored, after strategy deployment is completed, the state of a deployment target is recorded, a lightweight monitoring assembly is installed on the deployment target, and deployment feedback information is collected. According to the method, potential security threats are identified in real time in a mode of combining intelligent prediction and simulation, and the security policy is dynamically adjusted according to the change of the threats.

The invention relates to the technical field of TEM models, provides a pilot dynamic evaluation method, system and device based on a TEM model and a storage medium, and solves the problems of low accuracy of flight training evaluation and poor adaptability of a training scheme. The method comprises the steps that flight control, physiological monitoring and cockpit voice data are acquired, and a multi-modal data stream is formed through time synchronization; performing threat perception, error management and non-technical skill three-level evaluation on the feature vector by using a TEM model, generating corresponding indexes, and fusing the indexes into a comprehensive feature vector; respectively processing the time sequence and cognitive features by means of a dual-channel long-short-term memory network, and extracting deep features; performing decision tracing by adopting an SHAP value so as to locate a capability defect node; finally, defect types are matched through a personalized improvement scheme recommendation mechanism, and self-adaptive training content is generated. According to the invention, the accuracy of flight training evaluation and the adaptability of the training scheme are improved.

The invention provides a method and a system for dynamically optimizing a security defense strategy based on an AI Agent, and aims to solve the problems that the traditional network security defense strategy is static and cannot adapt to a dynamic network environment and novel network threats, and the processing efficiency of massive security data is low and the response is not timely. The method comprises the following steps: firstly, realizing whole network node data acquisition through a distributed AI Agent, performing accurate identification in combination with a multi-dimensional threat perception and fusion detection mechanism, and establishing a threat parameter quantitative evaluation model; secondly, the AI Agent generates a dynamic defense strategy according to the analysis result of the intelligent threat detection and the real-time state of the network in combination with threat features and risk assessment; and finally, according to the dynamic defense response result, realizing attack path tracking, accurate vulnerability positioning, automatic repair execution and traceability information retention processing. According to the method, real-time sensing and quick response to network threats can be realized, and the hysteresis of a traditional static defense strategy is overcome.

The invention provides a vehicle-mounted network security threat sensing system and method based on edge and cloud collaboration, and belongs to the technical field of vehicle network security. Comprising the following steps: S1, collecting vehicle multi-modal data through an edge layer; s2, preprocessing the multi-modal data of the vehicle; s3, performing feature extraction on the preprocessed vehicle multi-modal data to obtain a high-dimensional feature vector; s4, calculating a threat confidence score based on the high-dimensional feature vector; s5, performing hierarchical response decision based on the threat confidence score and a predefined response strategy library, and generating hierarchical response data; s6, extracting threat metadata based on the hierarchical response data; s7, performing global association analysis based on the threat metadata, and upgrading a defense system; and S8, based on the global threat intelligence and the upgraded defense system, carrying out edge layer updating, and then skipping to S1. The method is beneficial to eliminating response delay, relieving network bandwidth pressure and optimizing cloud computing resource load.

The invention relates to the technical field of network security, in particular to a network security threat perception recognition response method based on a security knowledge graph, and the method comprises the steps: obtaining data; determining temporary nodes and concerned nodes; determining a marked node; determining risk nodes and suspicious nodes; obtaining a corrected risk node; connecting map edges; determining an abnormal node; adjusting the threshold value and giving an alarm. According to the method, various key indexes are obtained in real time, marked nodes are determined according to the flow change rate in combination with the inlet and outlet flow ratio and the source I P address, risk nodes and suspicious nodes are further determined, the suspicious nodes are corrected through the inlet and outlet flow ratio, map edges are connected, abnormal nodes are determined, and then the threshold value is dynamically adjusted. And finally, giving an alarm based on the abnormal node, and optimizing the judgment standard in real time according to the change of the network environment, thereby effectively solving the problems of low danger identification accuracy and slow response speed caused by overlarge data volume and excessive dependence on the model.

The invention belongs to the technical field of network management, and particularly relates to a road toll collection system network security task dynamic allocation and load balancing method, which comprises a road toll collection system, and the road toll collection system comprises a network security task dynamic allocation system and a load balancing system. The network security task dynamic allocation system serves as an intelligent security protection scheduling center, is used for coping with continuous evolution threats, and comprises a real-time threat perception and response scheduling integration, a resource elastic scaling system and a strategy self-adaptive adjustment system. The load balancing system serves as a foundation stone of service continuity and performance, ensures stable operation of high-concurrency transactions, and comprises an intelligent flow distribution system, an automatic fault isolation and recovery system and a load balancing system. The method can deal with sudden security events, optimize the resource utilization rate, improve the protection precision, guarantee high availability, improve the user experience and support the elastic expansion of the system.

The invention provides a public network-oriented global threat perception method and system, and relates to the technical field of advanced persistent attack threat detection, and the specific technical scheme is as follows: setting a network trip line and a domain name trip line of a public network to establish honey point equipment, and establishing honey court equipment based on an IP address reputation mechanism; building a honey hole device based on a camouflage traceability technology and a reverse chain technology, and building a sub-honey array based on a honey point device, a honey court device and the honey hole device; generating a honey point template based on the sub-honey array to deploy honey point equipment, obtaining public network traffic based on a honey yard equipment preposition and combining with the honey point equipment, and detecting the public network traffic to obtain a detection result; and making a countering strategy of the honey hole device based on the behavior of the attacker in the detection result, obtaining threat intelligence of the attacker, and updating IP address resources of the honey point device and the honey court device based on the threat intelligence. According to the invention, a low-intrusive threat probing mechanism and a high-universality global threat sensing system are established through four-honey equipment.

The invention relates to the technical field of network situation awareness, in particular to a network situation intelligent awareness security system based on multi-source data analysis, which accurately acquires a perception threat confidence vector, a service interruption risk vector, an attack chain complete vector and a user behavior deviation vector based on multi-source data fusion and targeted analysis. According to the method, network situation key information can be comprehensively and accurately captured, a reliable basis is provided for subsequent decision making, the comprehensiveness and real-time performance of threat perception are improved, dynamic balance of safety protection, service efficiency and operation and maintenance cost is achieved by relying on a multi-target game mechanism and a network space digital twinning technology, and the safety and reliability of threat perception are improved. A simulation deduction deviation value is introduced as a core index of strategy evaluation, a real network situation is simulated through a digital twin environment, the difference between a strategy execution effect and an expected target is quantified, and in combination with reproduction of an attack scene by the twin environment, deviation value analysis is ensured to be more fit with the real network environment.

The invention relates to the field of internet security, and discloses a big data risk early warning and evaluation method based on artificial intelligence, comprising the following steps: step S1, collecting original security data from a heterogeneous data source; s2, constructing a global causal model; s3, constructing and evolving an event causal evolution diagram so as to establish directed edges with weights among the nodes; s4, dynamically evaluating the ability level of the attacker; s5, performing adversarial intention projection; s6, calculating a dynamic risk score; and generating an early warning when the score exceeds an early warning threshold. According to the method, asymmetric information flows among event types are quantified through transfer entropy, and a context evidence fusion mechanism is combined, so that a real causal relationship and a simple statistical correlation can be distinguished; the defect that a high false alarm rate is easily generated based on rule or simple threshold matching is overcome, so that the event causal evolution diagram can accurately reflect the internal logic and time sequence characteristics of an attack behavior, and the accuracy of complex threat perception is improved.

The invention relates to a personnel identification and behavior detection method and device and a security robot, and the method achieves the whole-process intelligent processing from threat perception to precise intervention through a multi-module cooperative working mechanism and an innovative algorithm design. According to the method, the problem of balance between threat detection precision and real-time performance in the prior art is solved, and accurate three-dimensional positioning and tracking of a threat target are realized through effective integration of depth information. According to the method, through technologies of deep learning algorithm optimization, three-dimensional space positioning and the like, the threat detection capability, the response speed and the intervention accuracy of the security robot in a complex environment are comprehensively improved, powerful technical support is provided for high-risk scene safety prevention and control, and the method has remarkable practical value and popularization prospects.

The invention belongs to the technical field of network security management and control, and particularly relates to a network security threat perception and adaptive defense system based on artificial intelligence. Comprising a data acquisition preprocessing module, a threat feature intelligent mining module, a threat situation comprehensive evaluation module, a self-adaptive defense strategy generation module, a defense effect dynamic feedback module and a background supervision terminal. The data acquisition and preprocessing module acquires various data from a network environment and performs related preprocessing operation, the threat feature intelligent mining module mines potential network security threat features, and the threat situation comprehensive evaluation module comprehensively evaluates the network security threat situation. The self-adaptive defense strategy generation module generates a self-adaptive defense strategy based on the threat level and the influence range, and the defense effect dynamic feedback module monitors and evaluates the implementation effect of the self-adaptive defense strategy in real time, thereby providing an omnibearing, intelligent and self-adaptive guarantee for network security.

The invention discloses a power grid vulnerability micropatch generation method, system and device based on call chain backtracking and a medium, and belongs to the technical field of network security, and the method comprises the following steps: based on a dynamic probe, realizing kernel layer protocol analysis, lock-free acquisition of system call and user state call chain reconstruction; key path marking is realized through LLVM-IR semantic analysis and power business feature matching; generating a security micropatch based on the metadata and realizing isolated hot loading; and the patch compatibility is ensured by adopting digital simulation verification and a layered release mechanism. The method has the advantages that a five-dimensional cooperative power grid active defense system of observation-modeling-reasoning-evaluation-arrangement is constructed, millisecond observation is achieved through eBPF collection synchronized with PTP, a multi-domain ontology atlas supports cross-domain reasoning, a GNN-RL model predicts an attack path, protection logic is verified through double-target-range simulation, and the method is high in reliability and high in reliability. The intention-driven mechanism realizes second-level response, and a complete closed loop from threat perception to adaptive protection is formed.

The invention relates to a network security active defense honeypot system, which comprises a centralized management and control module and a threat sensing module, and is characterized in that the centralized management and control module is used for monitoring, maintaining and querying honeypots in a centralized manner and providing an access entrance; the threat sensing module comprises a honeynet management module, a threat analysis module, a report generation module and a linkage cooperative defense module; the honeynet management module is used for managing a honeypot simulation scene, a honeypot virtual machine, a honeypot mirror image, trapping node equipment, disguise agent node equipment, network asset equipment and honeypot bait release; the threat analysis module is used for analyzing threat data reported by the honeypot; the report generation module makes a report according to the analysis data; and the linkage cooperative defense module shares the threat data with the third-party security system for cooperative defense. According to the method, the high-sweetness honeypot is deployed in an enterprise network, the emergency response and defense level is improved by means of disguising, zero false alarm, high handling and traceability, and multi-scene independent deployment can be realized without influencing services.

The invention discloses an urban network security multi-dimensional monitoring management system and method, and the system comprises threat sensing probes which are disposed at a monitored urban network unit center and each node bypass, and are used for carrying out the threat detection processing; the full-flow collector is deployed in a monitored urban network unit center and each node bypass and is used for evidence obtaining and source tracing processing; the threat sensing system is used for performing centralized management on the threat sensing probe and the full-flow collector of each node; the centralized management comprises unified monitoring, unified management, unified upgrading, centralized strategy issuing, threat analysis and threat hunting. Therefore, each security product is prevented from combating independently, centralized management is realized, threat detection capability is improved, tracing is realized, efficient management of various security products is realized, and multi-dimensional monitoring management of urban network security is realized.

The invention belongs to the technical field of avionics, and particularly discloses an airborne synthetic visual dynamic threat intelligent identification system based on multi-source fusion, which comprises a multi-source data acquisition module, an integrated GNSS unit, an IMU unit, a camera, a laser radar and a millimeter wave radar, and is used for acquiring images, point cloud and meteorological data of a flight environment through a space-time calibration mechanism; the dynamic threat analysis module is used for performing fusion processing on the multi-source data, identifying a dynamic threat target based on a target detection model and outputting a threat level; and the visual scene display module is used for dynamically adjusting the display content and the alarm mode of the synthetic visual scene according to the threat level in combination with the eye movement tracking data and the flight stage information. The problems that a traditional synthetic visual system is lagged in dynamic threat perception, insufficient in multi-source data fusion and low in man-machine interaction efficiency are solved, and the situation awareness and safety guarantee capability of an aircraft in a complex airspace environment is remarkably improved.

The invention discloses a threat sensing system based on active domain name generation and real-time malicious domain name detection, and belongs to the technical field of network security detection. The system comprises a historical threat sensing module, a real-time threat sensing module and a malicious detection module. In the historical threat sensing module, a domain name generation module constructs a similar domain name generation model by using an autoregression model based on Transform and generates a similar domain name list of a target enterprise, a risk assessment module detects whether similar domain names are registered or not, and if the similar domain names are registered and can be accessed, the similar domain names are added into a to-be-detected list; the real-time threat sensing module monitors newly registered domain names in real time, and adds the newly registered domain names into a suspicious domain name list if the similarity between the newly registered domain names and the target enterprise domain names is high; and the malicious detection module detects the list to be detected and the suspicious domain name list and identifies phishing websites. The domain name generated by the system can keep high similarity with the real domain name of an enterprise visually and semantically, and the potential domain name abuse risk can be quickly identified and evaluated.

The invention discloses a network security protection method for an electric power monitoring system, relates to the technical field of electric power network security operation and maintenance, and can more effectively identify high-concealment attacks which are dynamically renamed or permeated by using system vulnerabilities through a constructed risk instruction feature database. Then, the received network access request is subjected to multi-dimensional analysis, the defect of an existing system on multi-dimensional instruction verification is overcome, secondary biological feature authentication is introduced for high-risk operation in a benign process, a digital signature verification mechanism is started for file transmission, an endogenous safety barrier of the system is directly reinforced, and the safety of the system is improved. A machine learning algorithm is applied to analyze the compliance of an instruction sequence, and real-time risk early warning is performed on an instruction stream deviating from a normal mode, so that the problem of insufficient dynamic threat perception of an existing system is solved, and the dynamic defense capability and the full-life-cycle safety control level of the power monitoring system in a complex network environment are remarkably enhanced.

The invention provides a cloud honey point dynamic arrangement method and system based on software-defined spoofing defense, and the system comprises a base construction control layer and an execution layer based on software-defined spoofing defense, the control layer comprises a threat sensing unit, a game decision unit and an arrangement control unit, the execution layer comprises a cloud native arrangement unit and a defense resource library; the threat sensing unit collects threat intelligence and generates a structured intelligence object; the game decision-making unit is used for game solving of an optimal response strategy; the arrangement control unit reads the defense strategy state data, generates a strategy configuration instruction according to the optimal response strategy, and issues the strategy configuration instruction to the cloud native arrangement unit; the cloud native arrangement unit responds to the instruction and dispatches a defense resource library to instantiate a Pod comprising a honey point container and a distributed feedback component; the defense resource library is used for maintaining honey point configuration files for generating honey point instances. By applying the system, self-adaptive closed-loop active defense can be realized.

This invention discloses a security threat perception and detection method for global network devices. It simultaneously collects three types of data: network traffic, behavior logs, and attack characteristics, forming multi-dimensional factual evidence. The method utilizes a firework algorithm to optimize the deployment of logical monitoring points (feature nodes) in the virtual network and calculates the dynamic intensity of threat propagation at each point, thereby constructing a node-level threat field that quantifies the spatial distribution of threats. Subsequently, peak, mean, and dispersion indicators are extracted, and behavioral load, threat polarization, and cumulative threat indicators are calculated from the raw data, forming a six-dimensional vector. This vector is input into a pre-trained global threat level classification model, outputting a discrete threat level. Finally, based on this level, firewall rules, intrusion detection feature libraries, and other protection strategies are dynamically adjusted to achieve automatic matching of security configuration and threat posture.

The present invention belongs to the field of network security technology, and discloses a network threat perception and defense strategy optimization system and method based on machine learning; the method comprises: obtaining traffic level data, log level data and user level data in a single session; constructing original samples based on the traffic level data, log level data and user level data, inputting the original samples into a pre-trained anomaly recognition model, and outputting corresponding network information categories; constructing adversarial samples based on the original samples; merging the adversarial samples and the original samples into an expanded training set, annotating the adversarial samples with the network information categories corresponding to the original samples, and then performing secondary training on the anomaly recognition model to obtain an adversarially optimized anomaly recognition model; the present invention effectively improves the protection capability of the network.

The invention discloses an industrial cloud side-end collaborative security situation awareness method and device, and relates to the technical field of industrial internet and information security, and the method comprises the steps: obtaining a device-level security event through anomaly detection and white list verification based on original security data reported by a terminal device; carrying out aggregation analysis on the events on the edge side by utilizing a lightweight rule base, and generating an edge domain level local security situation; fusing a multi-edge domain situation at a cloud end, and performing global association reasoning by means of a knowledge graph and a graph neural network to form a system-level security situation; and finally, generating a hierarchical early warning and response strategy according to the global situation, and supporting dynamic optimization of a rule base and a knowledge graph based on feedback. Through the above mode, efficient cooperative processing and intelligent analysis of industrial security data at three levels of end, edge and cloud are realized, and the real-time performance, the accuracy and the response capability of threat perception of a large-scale industrial system are improved.

The invention belongs to the technical field of cloud native environments, and particularly relates to a cloud native environment-oriented full-flow threat sensing and tracing system, which comprises a data acquisition layer deployed on each computing node of a cloud native cluster and used for acquiring east-west network flow and north-south network flow; the data preprocessing and storage layer is connected with the data acquisition layer, and is used for performing analysis, specification and standardization processing on the acquired original traffic and storing the processed original traffic as a structured traffic log; the dynamic strategy engine is connected with the data preprocessing and storage layer and is used for generating and adjusting a security strategy based on a real-time flow analysis result; and carrying out visualization and traceability analysis. According to the invention, through multi-level data acquisition and fusion, all-around deep monitoring of network activities in a cloud native environment is realized, and specifically, an eBPF probe is deployed on a kernel layer of an operating system in a data acquisition layer, so that basic network connections and data packets of all Pods can be captured without invasion.

The application discloses a kind of urban network security multidimensional monitoring management system and method, comprising: threat perception probe, deployment is in the center of the unit of the monitored city network and each node bypass, for threat detection processing;Full-flow collector, deployment is in the center of the unit of the monitored city network and each node bypass, for evidence tracing processing;Threat perception system is used to the threat perception probe and full-flow collector of each node are centrally managed;The centralized management includes unified monitoring, unified management, unified upgrade, centralized strategy issue, threat analysis and threat hunting. Avoid each security product fight each other, and then centralized management, improve threat detection capability, trace source, realize the efficient management of multiple kinds of security products, and multidimensional monitoring management is carried out to city network security.

The application belongs to the technical field of personalized federated learning, and discloses an industrial control system intrusion detection method based on personalized federated learning. The method solves the problem of insufficient model generalization ability under Non-IID data, realizes the balance between local adaptability and global threat perception through similar client cooperative learning, and proposes a similarity calculation mechanism based on JS divergence to realize collaborative modeling between similar clients, thereby ensuring personalization and enhancing global knowledge sharing ability. An industrial network feature extraction tool is designed to support Session, Flow and Stream three-layer modeling, extract high semantic features of industrial protocols, and improve the quality of model training data. The tool has industrial protocol perception ability, can extract various high semantic features from various key industrial control protocols, effectively support the standardized conversion of multi-entity data sources, and enhance the representativeness and difference of model training data.

The invention provides a real-time threat sensing method and device for network media equipment and electronic equipment, and relates to the technical field of information security, and the method comprises the steps that the threat sensing equipment obtains the current playing content of the network media equipment, analyzes the current playing content, and sends the analyzed current playing content to the network media equipment; obtaining a face and scene feature sequence of the current playing content, a high-frequency head word set sequence of the current playing content and an audio fingerprint sequence of the current playing content; the threat sensing device compares the face and scene feature sequence of the currently played content with the face and scene feature sequence, compares the high-frequency head word set sequence of the currently played content with the high-frequency head word set sequence, and compares the audio fingerprint sequence of the currently played content with the audio fingerprint sequence; and when the threat sensing device judges that the currently played content is illegal, sensing that the network media device is in a threat state. According to the invention, the accuracy of real-time threat perception of the network media equipment can be effectively improved.

The application discloses a threat perception system based on active domain name generation and real-time detection of malicious domain names, and belongs to the technical field of network security detection. The system comprises a historical threat perception module, a real-time threat perception module and a malicious detection module. In the historical threat perception module, a domain name generation module uses a self-recurrence model based on a Transformer to construct a similar domain name generation model, generates a similar domain name list of a target enterprise, and a risk assessment module detects whether the similar domain names have been registered; if yes, the similar domain names can be accessed and added to a detection list. The real-time threat perception module monitors newly registered domain names in real time, and adds domain names with high similarity to the target enterprise domain names to a suspicious domain name list. The malicious detection module detects the detection list and the suspicious domain name list, and identifies phishing websites. The domain names generated by the system can be highly similar to the real domain names of an enterprise in terms of vision and semantics, and can rapidly identify and evaluate potential domain name abuse risks.