735 results about "Vulnerability" patented technology

The invention provides an intelligent vulnerability mining platform construction method and system based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code snippets with the security risks, arranges the code snippets into risk code paragraphs, identifies target code paragraphs, determines known vulnerabilities, generates context information, captures key events in actual operation, and records real execution paths and state changes. The method comprises the steps of generating a dynamic execution track, simulating different paths, generating an attack vector path, predicting unknown vulnerabilities and credibility scores of the unknown vulnerabilities, testing prediction results of high-credibility scores, confirming and generating real vulnerability information, recording the information to a vulnerability knowledge base, and generating a security report containing vulnerability description, influence ranges, risk levels and repair suggestions. According to the technical scheme provided by the embodiment of the invention, the detection accuracy and efficiency of the security vulnerabilities in the software system are improved.

Methods and systems for dynamic shielding in network security is disclosed. The method comprises analyzing real-time network traffic to detect a potential threat and assessing a severity level for each detected threat. Vulnerabilities of the devices in the network and the communications network to which each device is connected can be determined. A risk score can be generated for the threat based on the severity level of the threat and the vulnerabilities in the network. A response strategy can be implanted based on the risk score. The response strategy can include predefined actions for risk scores below a threshold, and maximum protective measures for risk scores above the threshold. The methods and systems can employ machine learning algorithms for threat detection and classification and utilize adaptive learning to refine future response strategies based on historical data of network interactions and system responses.

The invention discloses a CAPEC vulnerability management system based on a large language model, and belongs to the technical field of network security. The system comprises three modules: a vulnerability-CAPEC dynamic mapping module jointly encodes vulnerability description and code context through a bimodal large language model, accurately associates vulnerability logic with a CAPEC attack mode in combination with comparative learning and knowledge graph construction, and breaks through semantic limitation of traditional rule matching; the adversarial repair code generation module is used for generating high-robustness repair codes through adversarial training and syntax tree verification by fusing CAPEC relieving suggestions and code features on the basis of the association result, so that the secondary vulnerability risk is remarkably reduced; and the full-process automatic verification and DevOps integration module performs multi-dimensional security verification such as symbolic execution, fuzzy testing and the like on the generated repair code, and deeply integrates a development tool chain to realize real-time pushing and closed-loop management of a repair scheme.

The invention discloses a failure chain quantitative analysis and risk assessment method and system based on a multi-level security model, and aims to solve the defects that accident cause analysis of a complex social technology system is inaccurate, and a risk assessment result is lack of effective verification. According to the method, a multi-level causal model is systematically constructed, a multi-dimensional failure chain (MDFC) is extracted, multi-dimensional risk quantification is performed on the MDFC, a directed weighted failure propagation network is constructed based on the multi-dimensional risk quantification, and structural features of the directed weighted failure propagation network are analyzed to identify key risk factors. The core innovation of the method is that reverse accident reason tracing and forward risk propagation path analysis based on the weighted network are fused, mutual verification and iterative optimization are realized by comparing analysis results of the two paths, so that the understanding of an accident evolution mechanism is deepened, and the reliability of evaluation is improved. The system vulnerability can be revealed more comprehensively, powerful support is provided for formulating accurate risk control measures, and the overall safety level of a complex system is improved.

Described herein are systems and methods for discovering and proactively mitigating previously unknown security vulnerabilities. The systems and methods herein can utilize security vulnerability information to discover potential security threats and can utilize this information to generate an attack using a machine learning model, such as a large language model. Generated attacks can be carried out to assess impact of a security vulnerability. An output can be provided that represents the assessed impact. In some implementations, the systems and methods herein generate patches or other mitigations for security vulnerabilities, which can be tested and deployed to address security vulnerabilities.

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

Described herein are systems and methods for discovering and proactively mitigating previously unknown security vulnerabilities. The systems and methods herein can utilize security vulnerability information to discover potential security threats and can utilize this information to generate an attack using a machine learning model, such as a large language model. Generated attacks can be carried out to assess impact of a security vulnerability. An output can be provided that represents the assessed impact. In some implementations, the systems and methods herein generate patches or other mitigations for security vulnerabilities, which can be tested and deployed to address security vulnerabilities.

The invention provides an SCA and SAST combined vulnerability reachable path detection method and device. The method comprises the steps of obtaining a to-be-detected item; extracting an entry function based on the to-be-detected item; when the to-be-detected item is a source code item or a product item, generating a function call graph based on call graph generation logic corresponding to the source code item or call graph generation logic corresponding to the product item; identifying a vulnerability function in the dependent component of the item to be detected through a software component analysis tool based on preset software bill of material information; taking the vulnerability function as a starting point, performing depth-first search traversal in the function call graph, and detecting whether an entry function is traversed or not; and if yes, determining a path from the entry function to the vulnerability function as a vulnerability reachable path. According to the method and the device, the reachable path of the vulnerability can be automatically detected, so that whether the security vulnerability is triggered or not is determined, invalid checking of the SCA tool in the use process can be avoided, and the reliability of the SCA tool is improved.

The invention discloses a network security vulnerability identification and repair method and system, a medium and a program product, and the method comprises the steps: segmenting a system behavior sequence into a plurality of subsequences; constructing a behavior dependency graph; calculating functional similarity, and dividing the functional similarity into node clusters; calculating a behavior consistency score, and determining a potential vulnerability region; determining call chain information; constructing a vulnerability propagation path, and calculating criticality; dividing first-level hazard vulnerabilities, second-level hazard vulnerabilities and third-level hazard vulnerabilities according to the criticality; determining a repair priority, and generating a vulnerability report; according to the vulnerability types, the repair priorities and the propagation path information, corresponding repair strategies are sequentially matched from a preset repair template library according to the sequence of the repair priorities; and performing hierarchical repair on the application code based on the repair strategy obtained by matching to obtain a repair code, and deploying the repair code to the target system. According to the invention, the accuracy and efficiency of identifying and repairing network security vulnerabilities are improved.

Detecting package execution for threat assessments, including: receiving, from an agent on a host of a cloud deployment, data describing one or more active packages installed on the host, wherein each of the one or more active packages are identified by the agent from a plurality of packages in response to detecting a corresponding file open event; and generating a threat assessment for the host describing which of the one or more active packages have any known vulnerabilities.

The invention discloses an automatic code security optimization method based on a large language model, and belongs to the technical field of code security optimization. Acquiring large-scale programming data to establish a programming data set, establishing a primary training model, generating an initial code and establishing an initial code set; the predefined vulnerability mode set scans the initial code set, vulnerabilities in the initial code set are identified and defined as initial vulnerabilities, and the initial vulnerabilities are positioned and classified; static analysis is matched with a semantic discriminator to evaluate the code snippets to obtain a new generation strategy, and the primary generation strategy is adjusted to obtain an optimized training model; capturing potential vulnerabilities as training signals, and optimizing the optimization training model to obtain a continuous optimization training model; and establishing a vulnerability library and a repair strategy library, and optimizing vulnerability time and a repair algorithm by analyzing data of the vulnerability library and the repair strategy library. Potential vulnerabilities in generated codes can be automatically recognized and repaired, a large amount of manual intervention is not needed, and code generation safety is improved.

Embodiments can relate to a system for automated exploit generation that receives input data representative of a target action to establish a target having a potential target vulnerability. The system can build a simulated target environment that includes the established target. The system can conduct an analysis method including a static, a concrete, a dynamic, and / or a symbolic analysis. The system can create a chainable sequence including an information disclosure, a read, a write, and / or an execution exploit primitive. The system can generate an exploit chain that, when executed by the processor in response to the target action, can transform the target action to a target failure within the simulated target environment and thereby expose the target vulnerability. The system can execute the exploit chain within the simulated target environment to examine coverage of the exposed target vulnerability. The system can generate an output representative of the exposed target vulnerability.

A method of operating an IDS for a device includes performing a fuzzing operation on a software program being executed on a system under test, the software program corresponding to a deployed software program on the device monitored by the IDS and the system under test being configured to emulate at least one system of the device, the fuzzing operation including supplying fuzzing inputs to the software program, monitoring outputs of the software program, and detecting, based on the outputs, a vulnerability to intrusion in the software program caused by supplying the fuzzing inputs to software program. The method further includes generating and storing a vulnerability entry corresponding to the detected vulnerability, the vulnerability entry including information identifying the detected vulnerability, and updating, based on the vulnerability entry, at least one of a component of the IDS and a code portion of the deployed software program.

A method includes scanning a plurality of hosts in a network to obtain risk information of each instance of vulnerability associated with each host during a period, calculating a vulnerability risk score (VRS) for each instance of the vulnerability based on the associated risk information, determining a number of vulnerabilities associated with each of the plurality of hosts during the period, obtaining a criticality score of each of the plurality of hosts, obtaining for each host, a representative VRS based at least in part on the VRS for each instance of vulnerability associated with the host, calculating a host risk score (HRS) for each host based on the representative VRS, the number of vulnerabilities and the criticality score of the host, calculating a network risk score (NRS) for the network based on the HRSs, and facilitating a security action based on the HRS for each host and the NRS.

The invention provides an intelligent data security exposed surface risk assessment method, system and device and a medium, and relates to the technical field of information security, and the method comprises the steps: constructing an exposed surface asset map through an asset fingerprint recognition engine, and calculating an asset exposure index; constructing a vulnerability knowledge base, and identifying potential vulnerabilities; based on the standard vulnerability score, the vulnerability utilization tool activeness and the attack event frequency in the set time period, calculating the triggering probability of the potential vulnerability as a dynamic vulnerability score; malicious IP access frequency and leakage record matching degree are obtained through firewall logs and dark web monitoring data, and threat intelligence factors are obtained through calculation; calculating an exposed surface risk value in combination with the asset exposure index, the dynamic vulnerability score and the threat intelligence factor; and based on a time decay model, according to the exposed surface risk value and the business influence factor, calculating a residual risk value, and obtaining an exposed surface risk assessment result. The accuracy of risk assessment is further improved through multi-dimensional data fusion.

The invention discloses a black-box test zero-day vulnerability analysis method and system based on multi-dimensional data, and aims to solve the problems that a traditional black-box test means is weak in unknown vulnerability recognition capability, high in false alarm rate, lack of path modeling and verification mechanisms and the like. The method comprises the following steps: constructing a cross-time window behavior graph by acquiring multi-dimensional heterogeneous information such as network input, system call, log information and abnormal signals; on the basis, potential abnormal paths are identified through structure entropy change and graph structure mutation analysis, path vector representation is constructed by combining graph representation learning and a path embedding method, and path-level risk modeling and mode clustering analysis are achieved; furthermore, vulnerability confirmation is carried out on the suspicious path through multiple verification mechanisms such as attack replay, fuzzy testing and sensitive function combination identification. The system has a multi-module cooperation capability, can realize automatic mining, verification and visual tracing of zero-day vulnerabilities in a source-source-free environment, and has good universality and expansibility.

Method and system for analyzing at least one computing system for supply chain vulnerabilities of at least one machine learning model include configuring machine learning model and optionally additional data; decomposing operations of the machine learning model's computational graph into smaller decomposed components; associating properties of each decomposed component with properties of the original operations and associating additional data; detecting the semantic similarity of decomposed component and previously encountered decomposed components; converting decomposed components into a standardized representation; calculating signature of decomposed components; evaluating whether portions of the machine learning model are similar to previously calculated signature; testing for supply chain and model vulnerabilities that exist based on previous signatures; identifying vulnerabilities that persist and correlating defenses; storing the generated signatures, identified vulnerabilities, and identified defenses; and generating report detailing the machine learning model's supply chain, vulnerabilities, and defenses.

Real-time monitoring and alerting of breached security credentials for server-based endpoints is described herein. In various embodiments, a software component (that intercepts outgoing network traffic from a computing device) or a server-based breach monitoring component may receive a request for endpoint data. Credential data may be included in the request. The endpoint and / or the credential data may be compared to credential data linked to a list of compromised endpoints. An alert may be generated for the client device when both a match is detected with credential data of a breach object on the list of compromised endpoints and the breach time field of the breach object is after a previous credentials change for the endpoint. Access to the endpoint may be blocked and / or a change password mechanism may also be displayed to change the user credentials prior to revisiting the endpoint.

Machine learning techniques are provided for analyzing operational technology networks. An attack simulation model is trained to simulate attacks on a network replica by a plurality of threats. The attack simulation model outputs simulated attack data comprising a set of simulated attack paths corresponding to one or more threats of the plurality of threats. The network replica comprises a structured representation of a plurality of assets belonging to an OT network environment, communication pathways between the plurality of assets, security controls implemented in the OT network environment, and vulnerabilities. A threat analysis system is generated. The threat analysis system is configured to apply the attack simulation model to an input network replica and provide one or more risk reduction recommendations based on output simulated attack data from the attack simulation model. The threat analysis system is deployed to generate risk reduction recommendations for one or more OT network environments.

Systems and methods for resolving code vulnerabilities through collaborative agents which may include accessing a code base of an identified vulnerability; configuring a plurality of autonomous agents, each comprising a predefined agent role associated with application security remediation process; executing a directed workflow of the plurality of agents, wherein the workflow is a conditional sequence of agent-driven processing steps for generating a proposed resolution to the identified vulnerability; and outputting a candidate resolution for the vulnerability based on results produced by the workflow.

The invention provides an automatic vulnerability processing method and system.The method comprises the steps that multi-source heterogeneous data and temperature field distribution of a target system are obtained, vulnerability data and historical repair records are subjected to semantic association, and vulnerability propagation path features are generated in combination with a dynamic dependency chain; and identifying a hardware load abnormal region by matching the temperature field distribution with a thermodynamic mode of known vulnerability attacks. And based on a dynamic graph attention mechanism, collaboratively analyzing vulnerability propagation path characteristics and hardware abnormal data, and generating a patch deployment strategy which comprehensively considers the repair priority and resource allocation. In the execution process, the topological sequence and the data throughput of patch distribution paths are dynamically adjusted, the resource occupation proportion is optimized, and it is ensured that the cross-system service interruption duration is controlled within a safety window. According to the method and the device, the vulnerability repair accuracy and the system stability are improved.

The embodiments herein provide a method for managing knowledge for solving vulnerability issues using an organizational knowledgebase. The method includes linking a vulnerability management platform knowledgebase (KB) article to an organization's core documents. The method further includes applying a vulnerability management platform formula, to enhance the knowledge management and security practices within the organization's knowledgebase. The method for applying the vulnerability management platform formula comprises tagging (CVEs) or (CWEs), to the vulnerability platform knowledgebase (KB) articles; attaching rich articles as links to a ticket tracking system; linking the vulnerability management platform KB articles to a new ticket created; and automatically linking a code commit to the vulnerability management platform KB articles. The method further comprises defining and configuring a plurality of Service Level Agreements (SLAs) at an application or sub-application level to set acceptable timelines for acknowledging and mitigating security concerns.

Systems and method for detecting vulnerabilities in code are provided herein. A pre-trained artificial intelligence (AI) model is engaged, and a plurality of prompts and the source code are provided to the AI model. A plurality of detected vulnerabilities and a plurality of code locations in the source code are identified using the AI model. Each of the plurality of code locations corresponds to at least one of the plurality of detected vulnerabilities. One or more false positive vulnerabilities in the plurality of detected vulnerabilities are identified. A plurality of augmented prompts is generated, based on the one or more false positive vulnerabilities. The plurality of augmented prompts is outputted to a database of prompts for use in future code analyses, without necessarily having to retrain the AI model.

The invention relates to the field of software security, and particularly discloses a software supply chain security analysis method which comprises the following steps: S1, collecting data of components of a software supply chain, and calculating a historical security risk weight for each component in the supply chain; s2, collecting behavior data of the software during operation, and performing association analysis in combination with the supply chain data; s3, preprocessing the collected behavior data and supply chain data, and extracting key features; according to the software supply chain security analysis method, through dynamic behavior analysis, runtime threats, such as zero-day vulnerabilities and hidden backdoor threats, which cannot be detected by static analysis can be found, the coverage rate of threat detection is remarkably improved, meanwhile, historical security risk weights are introduced, historical security problems of supply chain components are quantified, and the security of the software supply chain is improved. And intelligent risk assessment and threat traceability are realized by combining a knowledge graph and a graph neural network technology.

The invention provides a power network equipment vulnerability repairing method and system based on dynamic behavior analysis, and the method comprises the steps: obtaining an operation data set of power network equipment, carrying out the dynamic behavior analysis processing of the operation data set, and obtaining a dynamic behavior feature set of data of a plurality of operation cycles; based on a preset dynamic strategy matching rule, performing vulnerability feature extraction processing on the dynamic behavior feature set, and generating a vulnerability repair strategy set corresponding to the abnormal behavior pattern; according to the execution priority and the execution condition parameter in the vulnerability repair strategy set, triggering vulnerability repair operation of the power network equipment, and obtaining equipment operation verification data after repair; and generating a repair effect evaluation result based on a difference parameter between the equipment operation verification data and a preset safety operation standard, and adjusting the dynamic strategy matching rule according to the difference parameter. According to the invention, the vulnerability repair system can maintain a stable security protection level in a complex and changeable power network environment.

The invention discloses a multi-dimensional evaluation method for credential environment migration, and particularly relates to the field of evaluation. According to the method, an evaluation index system covering infrastructure, an application system, data resources and security compliance is constructed, and comprehensive scanning is realized through instruction set detection, binary analysis and equal security compliance inspection; dynamically calculating the weight by adopting an AHP-entropy weight hybrid model, and triggering weight rebalance based on the volatility; through combination of static scanning and a dynamic probe, the compatibility, performance and safety differences are quantitatively analyzed; and finally, generating a visual risk assessment report, integrating data of each stage to calculate a compatibility score, a performance loss rate and a security level, providing instruction level difference comparison, a performance flame graph and a vulnerability attack path interaction view, and outputting a migration suggestion comprising a priority reconstruction list, an NEON instruction optimization scheme and a staged reinforcement plan.

The invention discloses a model testing method and device. A plurality of risk queries of an initial model are obtained, each risk query is split to obtain a query group, the query group comprises a plurality of sub-queries, the initial model is trained based on the query group to obtain a red team model, and a to-be-tested model is tested through the red team model. Therefore, a single round of query is divided into multiple rounds of query, so that a security protection mechanism of the to-be-tested model is bypassed, security vulnerabilities of the to-be-tested model are mined and exposed, and the effectiveness of model testing is improved.

The invention discloses a vulnerability repairing method and system based on a knowledge graph and a large language model, and relates to the technical field of network security, and the method comprises the steps: preprocessing vulnerability data, and providing semantic information support in a vulnerability repairing process; constructing a vulnerability repair knowledge graph, matching the vulnerability code with the repair code, and providing a matching result; and generating a vulnerability repair patch code based on the large language model, and automatically repairing the vulnerability. According to the method, the accuracy and the efficiency of vulnerability repair are improved, a data basis and semantic understanding are provided for subsequent vulnerability repair, the matching speed and the matching accuracy are improved, powerful support is provided for automatic repair, key features of vulnerability problems are accurately identified, and the vulnerability repair efficiency is improved. And the repair patch is automatically generated through the large language model, so that manual intervention is reduced, the repair speed and reliability are improved, efficient and reliable automatic patch repair is realized, and the safety risk is reduced.

The invention provides a vulnerability positioning method and system based on cross-modal features. The method comprises the following steps: firstly, obtaining cross-modal information of a vulnerability to be positioned; the cross-modal information comprises a vulnerability description text and candidate vulnerability function codes; inputting the cross-modal information into a pre-trained vulnerability positioning model, and obtaining a vulnerability positioning result output by the vulnerability positioning model; wherein the pre-trained vulnerability positioning model is used for determining cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, performing correlation calculation and sorting according to the cross-modal alignment features, and taking a correlation sorting result as a vulnerability positioning result; the cross-modal alignment feature is used for aligning the feature of the vulnerability description text and the feature of the candidate vulnerability function code; the pre-trained vulnerability positioning model is obtained by training based on a vulnerability positioning training set, and the vulnerability positioning training set comprises a vulnerability description text sample and a vulnerability function code sample. According to the invention, automatic vulnerability positioning can be realized, and the accuracy and efficiency of vulnerability positioning are improved.

The invention provides an efficient multi-dimensional network penetration testing method based on RAG, which comprises the following steps: firstly, identifying sub-domain names possibly existing in a target website, and sequentially expanding attack surfaces of penetration testing to obtain vulnerability information pairs; secondly, a design model generated based on retrieval enhancement is adopted, vulnerability information pairs are extracted from the queue to be utilized, knowledge items related to local knowledge base retrieval and network intelligent search retrieval are utilized, and finally, a large model generates vulnerability utilization information according to the knowledge items; acquiring target machine permission for the previously acquired vulnerability information pair construction command injector, and further scanning other hosts of the intranet accessed by the target skipping machine; finally, combining vulnerability information obtained by penetration testing, utilizing a large model to sort vulnerabilities existing in different assets, and outputting penetration testing reports for different assets. According to the method and the system, comprehensive penetration testing of cross-network and cross-system is realized, security experts are helped to quickly identify, verify and repair vulnerabilities in a complex and changeable network environment, and high-efficiency and low-cost network security maintenance is realized.