71 results about "Vulnerability" patented technology

The invention belongs to the crossing field of network space security, software engineering and artificial intelligence, and discloses a dynamic and static cooperative vulnerability full-link intelligent analysis and verification method based on a large language model and an MCP protocol, and the method comprises the steps: S1, task initialization and context construction; s2, target code deep analysis and static taint preanalysis are carried out; s3, carrying out Fuzzing Harness directional generation and iterative optimization on the basis of the stain paths; s4, performing dynamic and static collaborative sandbox execution and dynamic stain tracking; and S5, vulnerability accessibility judgment and report output of multi-source data fusion are carried out. According to the method, a dynamic and static combination mechanism is adopted, vulnerability analysis and verification can be automatically completed for software target codes, and accurate technical support is provided for vulnerability risk grading and repairing priority ranking.

The application discloses a routing protocol analysis method and device, equipment and a storage medium. After obtaining a routing protocol to be analyzed, an attack point in the routing protocol to be analyzed is identified, the attack point is an attack purpose of an attacker, the path of the attack to be performed by the attacker to achieve the attack purpose is reversely searched in the routing protocol to be analyzed starting from the attack purpose of the attacker, a detection rule is generated for the attack path, and the routing protocol to be analyzed is analyzed based on the generated detection rule. The attack path is obtained by comprehensively searching in the routing protocol to be analyzed starting from the attack point. The detection rule is obtained by analyzing the attack path. The routing protocol is analyzed according to the detection rule. The possible vulnerabilities in the routing protocol can be comprehensively analyzed.

The application discloses a firmware vulnerability judgment and positioning method based on syntax similarity analysis, extracts syntax features of firmware and third-party software vulnerabilities based on collected third-party software vulnerability patch information and firmware databases, compares the extracted feature information through a similarity analysis technology, determines whether the firmware has the vulnerability and positions a vulnerability function position, completes judgment on vulnerability existence and positioning of the vulnerability, and has high automation characteristics, is migratable for different types of firmware file systems, greatly reduces the ability requirement of an analyst, performs coarse-grained screening on the entire syntax features of a binary executable file before using an accurate algorithm to position the vulnerability function position, greatly shortens the time required for vulnerability search and analysis, improves n-days vulnerability search efficiency, analyzes ACFG of a vulnerability function by using a graph embedding algorithm, identifies s vulnerability and determines the vulnerability function position, and improves the efficiency of vulnerability analysis.

This invention discloses a method for assessing the vulnerability of bridge piers under ship impact, comprising: obtaining the tensile stress threshold at the pier base for different failure states of the bridge pier under ship impact; extracting multiple parameter combinations from the core parameter space affecting the tensile stress at the pier base using the optimal Latin hypercube sampling method; calculating the tensile stress at the pier base corresponding to each parameter combination using a finite element model of the bridge pier under ship impact, and fitting an initial surrogate model for the tensile stress at the pier base; based on the prediction accuracy of the initial surrogate model, supplementing the extraction of multiple parameter combinations in the parameter space region where the prediction error or the degree of nonlinearity of the function is greater than the corresponding threshold; and using the supplemented extracted parameter combinations to return to the operation of calculating using the finite element model to obtain a new surrogate model; repeating this process until the prediction accuracy of the final surrogate model meets the requirements; and fitting the pier vulnerability curve for each failure state. This embodiment is more consistent with the damage mechanism of concrete cracking and structural failure.

A computer-implemented method for transforming security advisories into targeted actionable mitigation strategies is provided. The method includes receiving a security advisory describing a vulnerability, processing the security advisory using a first language learning model (LLM) to extract vulnerability characteristics, generating an interaction model of sub-systems within a target system based on a topology of the target system, generating at least one actionable mitigation strategy for the vulnerability using a fine-tuned second LLM based on the extracted vulnerability characteristics and the interaction model, and outputting the actionable mitigation strategy as a security enhancement implementable on the target system. The method enables customized security enhancements for systems lacking official patches or manufacturer support.

The present disclosure provides a system and methods for cyber risk management. The system determines risk values for a network environment having one or more assets based on asset weights of the assets and impact vectors of one or more vulnerabilities associated with the assets. The system iteratively generates one or more attack paths using the vulnerabilities, and applies one or more security controls to mitigate the vulnerabilities to prevent attackers from attacking the network environment using any of the attack paths.

Systems and methods are disclosed herein for identifying security vulnerabilities within a domain. In an embodiment, a security application accesses logs of activity performed with respect to cloud content items within the domain and determines, using a plurality of machine learning models, a plurality of risk signals from the logs. The security application inputs the plurality of risk signals into a unified detection model and receives, as output from the unified detection model, risk classifications for a plurality of risks evident from the logs. The system determines, based on the risk classifications, at least one remedial action, and outputs a control signal instructing performance of the at least one remedial action.

The application provides an OpenAPI multi-step state fuzzy testing method and related device, and relates to the technical field of network security. Through two stages of offline knowledge construction and online state exploration, the problems of too large sequence space, poor request executability and disconnection of exploration are solved, the search space is effectively compressed, semantic guidance is provided, and combination explosion is avoided; through runtime load multiplexing, the executability of deep state paths is ensured; deep-first search scheduling and snapshot rollback are adopted to ensure exploration efficiency and result reproducibility, thereby having the advantages of efficiently detecting multi-step state vulnerabilities.

This application discloses a test case generation method and related equipment for vulnerability version identification. This solution obtains a target function call sequence suitable for the target version by inputting the source code of the original version of the program under test, the function call stack when the vulnerability is triggered in the original version, the original test cases, and the source code of the original test cases. The target version of the program under test is run, and test cases that can trigger the vulnerability to be verified are generated through mutation. The function call status of the test process during execution is monitored, and the test process is terminated early if the function call status cannot satisfy the target function call sequence. The embodiments of this application use targeted fuzz testing technology to achieve high-efficiency vulnerability identification and verification with no false positives, and can generate test cases to facilitate vulnerability analysis by testers. It can be widely applied in the field of computer security testing technology.

This invention discloses a multi-dimensional information security risk dynamic assessment system and method for detection platforms, relating to the field of information security technology. It collects multi-dimensional operational parameters such as assets, vulnerabilities, and attacks, converting them into risk factors. An initial comprehensive risk index is calculated using a radial basis function algorithm. Real-time business load is sensed to calculate weight offsets, and risk weights are redistributed and normalized, updating the risk index. A sliding assessment cycle is used to clean the sequence, and quantile regression is applied to determine a basic threshold. This basic threshold is then adjusted using historical statistical data of the load status to generate a dynamic risk threshold. When the risk index exceeds the dynamic threshold, a risk is identified and a response is triggered. This achieves accurate risk fusion and adaptive judgment, reduces response lag, and improves assessment accuracy, aiming to solve the problems of insufficient risk perception and high false alarm rates in complex environments.

This application provides a vulnerability handling method, apparatus, device, storage medium, and program product, relating to the fintech field or other related fields. The method includes: responding to an original access request from a target service, obtaining the request content from the original access request; detecting whether a vulnerability to be patched exists in the request content; if a vulnerability to be patched exists, calling the target patching plugin corresponding to the vulnerability from among multiple vulnerability patching plugins, and using the target patching plugin to patch the request content to obtain a patched access request; and sending the patched access request to the target service so that the target service executes the patched access request. The method of this application can directly identify and trigger vulnerability patching, shorten the vulnerability patching window, and achieve zero-downtime maintenance.

The techniques disclosed herein provide a system for automated deprecation of software codebases using a self-training analysis agent and a weighted input representing a plurality of codebase factors. Generally speaking, operating a cloud computing platform is complex and can involve managing a large number of software codebases including source code, infrastructure, configuration, and user applications. Consequently, as new products and / or services are released, technology advances, and various software codebases age, portions of the cloud computing platform may become vulnerable to errors, malicious actors, and other undesirable behaviors that lead to degraded service quality. The system presented herein utilizes a self-training analysis agent to automatically identify a given software codebase for deprecation using a weighted input representing a plurality of factors relating to the codebase such as code type, a code age, and usage metrics. Accordingly, the codebase is archived for a predefined time period prior to final deprecation.

A vulnerability inspection server 10 according to an embodiment of the present invention suppresses missing of important functions in a vulnerability inspection of a website. The server 10 provides, to a user who operates a user terminal 30 communicatively connected to the server 10 through a communication network 20, a vulnerability inspection service in which a website 22 or the like specified by the user is inspected for vulnerabilities (flaws in terms of information security). During the crawling of the website 22, the server 10 determines an inspection-requiring function that requires an inspection for vulnerabilities on a webpage, determines the degrees of relatedness between respective multiple operations executable on the webpage and the inspection-requiring function, and executes an operation identified on the basis of the degrees of relatedness from among the executable operations. That is, the server 10 is able to execute the operation identified on the basis of the degrees of relatedness to the inspection-requiring function. This facilitates crawling of webpages corresponding to important functions.

Systems and methods are provided for incident analysis in Cyber-Physical Systems (CPS) using a Temporal Graph-based Incident Analysis System (TGIAS) and / or Transition Based Categorical Anomaly Detection (TCAD). Dynamically gathered multimodal data from a distributed network of sensors across the CPS are preprocessed to identify abnormal sensor readings indicative of potential incidents, and a multi-layered incident timeline graph, representing abnormal sensor readings, relationships to specific CPS components, and temporal sequencing of events is constructed. Severity scores are calculated, and severity rankings are assigned to identified anomalies based on a composite index including impact on CPS operation, comparison with historical incident data, and predictive risk assessments. Probable root causes of incidents and pathways for anomaly propagation through the CPS are identified using causal interference and the incident timeline graph to detect underlying vulnerabilities and predict future system weaknesses. Recommended actions are generated and executed for incident resolution and system optimization.

A system and method for automatically rating, with respect to one or more systems, a set of vulnerabilities of components includes prioritizing a set of vulnerabilities of the components according to at least one of a risk severity of a vulnerability, characteristics of a vulnerability, a component or characteristics of the component, a system or characteristics of the system, usage of a system or a component, a configuration parameter, and the number of systems including a common component; and providing information related to a set of one or more vulnerabilities and their associated rate.

This application provides a vulnerability remediation method, system, and device, relating to the field of computer technology and applicable to network scenarios such as FTTR where Linux operating systems are deployed. In this vulnerability remediation system, an issue ticket subsystem acquires vulnerability issue tickets in a blocked state and sends them to a vulnerability tracking subsystem. The vulnerability tracking subsystem acquires the remediation status of each code vulnerability included in the issue ticket from the upstream open-source community. If the remediation status of each code vulnerability is "not affecting" or "remediated," the vulnerability issue ticket is set to a "downloadable" state. When the vulnerability issue ticket is in a downloadable state, if there are code vulnerabilities in a "remediated" state, the code synchronization subsystem pulls the patch code corresponding to the remediated code vulnerabilities from the upstream open-source community and merges the patch code into the internal code repository. This solution can reduce the manual intervention cost in code vulnerability remediation in scenarios such as FTTR.

This invention belongs to the field of code security detection and automated repair technology. Specifically, it is a closed-loop system for automated repair and verification of code vulnerabilities based on unit tests. It completes vulnerability root cause localization and feature extraction through program slicing and static analysis. Then, based on the vulnerability root cause, it generates reproducible test cases with multi-dimensional assertions and regression test cases that meet coverage standards. Candidate patches are generated through retrieval enhancement and invalid patches are filtered out by static pre-verification. Patch verification is completed in an isolated sandbox using core and auxiliary dual-dimensional rules. Failure results are classified into scenarios and structured semantic feedback is generated to guide iterative repair. Finally, successful cases are structured and stored in a knowledge base in the form of triples to achieve self-evolution. This invention solves the core problems of existing technologies, such as unstable reproducible test cases, low iterative convergence efficiency, inability to identify overfitted patches, and lack of self-evolution capabilities. It can achieve fully automated repair and verification of code vulnerabilities, meeting the requirements for production environment application.

This application discloses a method, apparatus, and device for auditing vulnerability mechanisms, relating to the field of software security technology. The method includes: extracting vulnerability causal elements and sorting out causal relationships from multi-source evidence associated with vulnerabilities, which is linked to corresponding nodes in a causal graph through globally unique evidence citation identifiers; obtaining a causal graph with vulnerability causal elements as nodes and causal dependencies as edges; extracting observed variables from the multi-source evidence based on the causal graph and constructing a structural equation model based on causal dependencies; solving the structural equation model to obtain the quantitative contribution of each vulnerability causal element to the occurrence of the vulnerability; performing a bidirectional mapping match between the vulnerability causal elements and a pre-set security compliance clause library based on the quantitative contribution to obtain a bidirectional mapping relationship; and integrating multi-source evidence, quantitative contribution, and bidirectional mapping relationship to obtain a structured audit report. This enables complete tracing and accountability for the explanation of vulnerability mechanisms.

The application discloses a data leakage detection system and method based on time series data anomaly detection, relates to the technical field of data leakage detection, and solves the problems of a traditional data leakage detection method based on rule matching or static threshold detection, high false positive rate, high false negative rate, poor adaptability and early warning lag when facing zero-day vulnerabilities, malicious theft by internal personnel and advanced persistent threats. The application comprises a data acquisition and analysis module, a user entity behavior portrait construction module, a core detection engine, a model management and optimization module and an alarm aggregation and response arrangement module; the data acquisition and analysis module is used for collecting original security logs and network metadata from heterogeneous data sources in real time and performing standardized analysis. The application can more accurately identify various leakage scenarios from single-point anomalies to coordinated attacks by capturing complex time patterns through "multimodal time series coding" and revealing associated threats through "graph context analysis".

This invention discloses a method and system for assessing equipment health and predicting remaining lifespan based on a dual degradation mechanism. The method includes: initializing the equipment's health and vulnerability; updating the health based on a preset natural wear rate within each discrete time step; if a fault event occurs within the current time step, calculating the damage amount based on the severity, duration, and current vulnerability of the fault event, and updating the health and vulnerability accordingly; if the fault is resolved, calculating the recovery amount of the health based on a preset recovery factor, and updating the health accordingly; updating the vulnerability based on a preset forgetting factor; and calculating the remaining lifespan of the equipment based on the updated health and a preset failure threshold. Compared with existing technologies, this invention achieves real-time accurate assessment of equipment health status and precise prediction of remaining lifespan through a dual degradation mechanism of natural aging and fault impact, and its damage memory effect.

One or more systems, devices, computer program products and / or computer-implemented methods of use provided herein relate to AI-driven vulnerability management for legacy medical systems. Accordingly, a system can comprise a memory that can store computer executable components. The system can further comprise a processor that can execute at least one of the computer executable components that collects information pertaining to a legacy medical system. In various aspects, at least one of the computer executable components can further leverage an artificial intelligence model and Retrieval Augmented Generation to detect a vulnerability in the legacy medical system. In various instances, the system can further generate a mitigation strategy for correcting the detected vulnerability. In various aspects, at least one of the computer executable components can further implement the mitigation strategy, thereby mitigating the detected vulnerability.

The present disclosure provides a system and method for substantially continuous and dynamic vulnerability scoring. According to the present disclosure, the method includes detecting one or more vulnerabilities. The method includes determining a context-prioritized score (CPS) for each of the one or more vulnerabilities based on historical data, where the historical data includes a series of context features corresponding to each of the one or more vulnerabilities. The method may include determining a partial CPS score by an agent in response to the detection of an event. The method may include generating an updated CPS based on the CPS and the new partial CPS when a new partial CPS score is determined, and transmitting the updated CPS to each of one or more computing devices.

The application discloses a network vulnerability closed-loop management system and method based on artificial intelligence, and relates to the technical field of artificial intelligence, and comprises the following steps: calling historical reproduction records of network vulnerabilities, obtaining reliable values of the reproduction records, and extracting target vulnerabilities; obtaining various basic indexes of the target vulnerabilities and a to-be-repaired vulnerability, calling repair records of repair personnel, and obtaining a first matching degree between the repair personnel and the to-be-repaired vulnerability; calling code submission records of the repair personnel, and obtaining a second matching degree according to the number of implanted files or modified code lines involved in the reproduction process of the to-be-repaired vulnerability; calculating a total matching degree between the repair personnel and the to-be-repaired vulnerability, determining target personnel of the to-be-repaired vulnerability, and realizing intelligent allocation of a to-be-repaired vulnerability task. The application comprehensively considers the actual matching degree between the repair personnel and the vulnerability through the reproduction records, the repair records and the code submission records, obtains suitable target personnel, and is helpful to improving vulnerability repair efficiency and reducing vulnerability risks.

The application discloses a kind of multi-dimension information security risk dynamic evaluation system and method for detection platform, it is related to information security technical field, and collection asset, vulnerability, attack and other multi-dimension operating parameters are converted into risk factor, and initial comprehensive risk index is calculated using radial basis function algorithm;Real-time sensing business load to calculate weight offset, execute risk weight redistribution and normalization and update risk index;Through sliding evaluation period cleaning sequence, application quantile regression determines basic threshold, and basic threshold is adjusted floatingly in combination with the historical statistical data of load state, generates dynamic risk threshold;When risk index exceeds dynamic threshold, determine risk and trigger response, realize the accurate fusion and adaptive determination of risk, reduce response hysteresis, improve evaluation accuracy, aim at solving the problem of risk perception under complex environment and high false alarm rate.

This invention discloses an intelligent scanning method for software security vulnerabilities based on static analysis, specifically relating to the field of software security testing technology. The method acquires a snapshot of the baseline version source code and a snapshot of the modified version source code corresponding to the software project under test, establishes alignment relationships between program elements of the previous and current versions, and forms a set of modified elements. Combining the baseline version program graph cache, function summary cache, and historical hazard index, a comprehensive quantity of the impact of changes is formed, and a subgraph of the impact of changes is constructed. Static incremental vulnerability analysis is performed on the subgraph of the impact of changes to identify newly added risk paths and activated historical hazard paths, and a trusted comprehensive quantity of risk activation is formed. Based on the trusted comprehensive quantity of risk activation, confirmation screening and baseline updates are performed, and valid incremental alerts or paths awaiting review are output. This invention can narrow the analysis scope, reduce the resource consumption of full scans, and improve the ability to identify incremental vulnerabilities and the activation of historical hazard paths.

The application belongs to the cross field of network space security, software engineering and artificial intelligence, and discloses a kind of dynamic and static cooperative type vulnerability full-link intelligent analysis and verification method based on large language model and MCP protocol, comprising: S1: task initialization and context construction;S2: target code depth analysis and static stain pre-analysis;S3: Fuzzing Harness directional generation and iterative optimization based on stain path;S4: dynamic and static cooperative sandbox execution and dynamic stain tracking;S5: vulnerability accessibility determination and report output of multi-source data fusion.The application method adopts dynamic and static combination mechanism, and can automatically complete vulnerability analysis and verification for software target code, providing accurate technical support for vulnerability risk grading and repair priority sorting.

A method, system and computer program product for automatically and continuously monitoring security vulnerabilities in software applications with third-party components and reporting newly-discovered vulnerabilities in the third-party software components used by a software application is provided. The method includes receiving a software bill of materials (SBOM) including a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components of the SBOM for known vulnerabilities and generating a first list of known vulnerabilities; storing the first list of known vulnerabilities; automatically analyzing, after a first period of time, each of the plurality of third-party components identified in the SBOM for newly-discovered vulnerabilities; storing a compiled second list of known vulnerabilities; comparing the compiled second list of known vulnerabilities with the original list of known vulnerabilities; and in response to the second list differing from the original list, transmitting, through a network, a notification identifying a set of differences in vulnerabilities between the second list and the original list.

The application discloses a kind of C / C++ vulnerability and its patch interlink recovery system and method based on sequencing, comprising: vulnerability data acquisition;Generate vulnerability related features, including based on Bert+BiLSTM+CRF named entity recognition, vulnerability automatic detection based on deep learning and text similarity calculation based on TF-IDF+cosine similarity;Based on the correlation between patch and vulnerability is sorted to related features by sequencing model RankNet, supplemented with manual verification, realize the link recovery between vulnerability and its patch.The application can better utilize the semantic information in vulnerability description and the type information of patch code, fully exploit the correlation between vulnerability and patch, better balance the relationship between the coverage of vulnerability patch and manual workload, compared with the popular defect link recovery method, the method focuses on the link recovery of vulnerability, and compared with the existing vulnerability patch positioning work, can expand the coverage area of patch.