341 results about "Vulnerability scanning" patented technology

The invention discloses an automatic penetration test method, system and device based on deep reinforcement learning, and a medium, and the method comprises the steps: carrying out the vulnerability scanning and baseline verification of a device through employing a vulnerability scanning and baseline verification tool, and obtaining the vulnerability information of a tested system; generating an attack graph according to the obtained vulnerability information, determining a vulnerability utilization probability according to the vulnerability information, and assigning values to edges of the attack graph to obtain a Bayesian attack graph; designing an attacker target node reward value on the generated Bayesian attack graph, simulating a possible attack behavior of an attacker, and calculating an attack strategy of the attacker by using a deep reinforcement learning method; simulating potential attack behaviors of an attacker in the attack graph according to an attack strategy, and generating a penetration attack path which is most likely to be adopted by the attacker; and performing an automatic penetration test to generate a penetration test report. According to the invention, the penetration test scheme can be intelligently generated according to the vulnerability of the system, and the precision and efficiency of network security evaluation are greatly improved.

The invention relates to the technical field of medical monitoring, in particular to a multi-mode intelligent management system for monitoring and preventing stress injury. The system comprises a multi-modal data acquisition and preprocessing module, a deep fusion risk prediction model module, an intelligent path planning and resource allocation module, a personalized intelligent intervention module and a data security module, so as to acquire time sequence physiological data and generate a body pressure thermodynamic diagram in real time, and realize standardization through normalization; a risk prediction model is generated through modeling, the contribution degree of each modal feature is calculated, and a risk level is determined according to a preset early warning grading mechanism; an optimal path is generated through intelligent planning, a nursing scheme is dynamically optimized and generated according to the risk level, and the nursing scheme is encrypted and transmitted to a cloud platform through HTTPS to be regularly subjected to security vulnerability scanning and repairing. According to the invention, the skin condition, the body position change and the pressure distribution of the patient can be accurately monitored, so that the closed-loop management of the pressure injury is realized.

The invention relates to the technical field of network security monitoring scheme design based on computing power, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: collecting network traffic, system logs and user behavior data; dynamically distributing CPU / GPU computing power according to network flow, attack frequency and the like; performing cleaning and format conversion on the data; intrusion detection, vulnerability scanning and traffic anomaly analysis are executed through multi-task parallel processing; a potential attack mode is mined in combination with deep learning model and rule engine association analysis; and judging threats according to a preset rule base and triggering early warning. According to the method, the resource utilization rate is improved through intelligent computing power scheduling, the threat recognition capability is enhanced in combination with deep learning and rule double engines, the method can adapt to a complex network environment, the threat detection accuracy is 98.7% according to actual measurement display, the resource occupation is reduced by 30%, and the method is suitable for high-concurrency scenes such as a cloud platform and the Internet of Things.

The invention relates to a notebook software vulnerability scanning method based on a security policy. According to the method, firstly, a security policy library of a target notebook is obtained, and the security policy library comprises access control rules, data operation limiting conditions and vulnerability detection reference requirements for different software types; collecting software running data of the target notebook computer, wherein the software running data comprises current running process information, file system operation records, network connection states and software configuration parameters; performing matching analysis on the software operation data and the security policy library to generate a preliminary scanning result; evaluating the risk level of the software vulnerability according to the preliminary scanning result; and finally, based on the risk level and the repair guide terms in the security policy library, generating software vulnerability repair guide information. Therefore, notebook software vulnerabilities can be scanned comprehensively and accurately, and effective repair guidance is provided.

Mechanisms are provided for scanning container images for vulnerabilities. With these mechanisms, a container image is received for inclusion in a container image registry and each layer of the container image is scanned to generate file signatures for each file referenced in each layer. Vulnerability signature(s) are applied to each layer, based on the file signatures of the layer, to determine if criteria of the vulnerability rule(s) of the vulnerability signature(s) are satisfied by at least one layer of the container image. Registration of the container image in the container image registry is accepted or denied based on results of the application of the vulnerability signature(s). Each vulnerability signature comprises one or more vulnerability rules generated from a scanning and indexing of layers of one or more other container images.

A method including generating a queue of a plurality of workloads for execution in a data processing environment, where the plurality of workloads are organized in the queue based on respective priority values, and where a vulnerability scan is queued with a lower priority value and segmenting the vulnerability scan using at least one selected from a group consisting of: parallel segmentation and iterative segmentation. The parallel segmentation is configured to implement respective segments of the vulnerability scan at predetermined times to reduce downtime or performance impact of the data processing environment and the iterative segmentation is configured to repeatedly segment the vulnerability scan until respective segments of the vulnerability scan can be implemented in the data processing environment without any downtime or significant performance impact. The method further includes implementing the segmented vulnerability scan in the data processing environment.

The invention discloses an industrial network threat state monitoring method and system, belongs to the technical field of industrial system security, solves the limitation of single flow detection through collaborative analysis of fused flow characteristics, equipment logs, threat intelligence and vulnerability scanning data, establishes a real-time association mechanism of log events and flow anomalies, and improves the safety of the system. Threat confirmation and response time is shortened from a traditional hour level to a minute level, and active strategy adjustment is realized based on linkage of a configuration baseline deviation degree and a vulnerability scanning result.

A method includes identifying, by a processing device, a set of parameters to generate a container image for a container. The parameters comprise one or more dependencies associated with running the container in a cloud-based environment. A manifest file referencing the one or more dependencies is obtained and the container image is generated based on the set of parameters, wherein the manifest file is stored in a predetermined location associated with the container.

The invention discloses a network security event vulnerability detection method and system, particularly relates to the field of network security event detection, and is used for solving the problems of vulnerability life cycle evaluation and dynamic risk quantification in a containerized environment. According to the method, the defect of traditional static scanning in vulnerability life cycle measurement is overcome, vulnerability risk time-sensitive evaluation is realized, and resource waste caused by misinformation of expired vulnerabilities is reduced. Analyzing a vulnerability component position by using micro-service call chain topology, calculating a position contribution weight in combination with path contribution and a downstream dependency ratio, deducing an actual attack surface influence coefficient in linkage with a vulnerability survival time probability, accurately depicting a vulnerability propagation potential and an influence range, calculating a container instance level dynamic risk score, and calculating a vulnerability level dynamic risk score; the asset list and the risk score are updated in real time after the container capacity expansion and contraction event is triggered, and it is ensured that the evaluation result is synchronous with the actual operation state.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The invention discloses an information system security online test method, system and device and a medium, and the method comprises the steps: carrying out the vulnerability scanning of an information system, and generating a vulnerability report according to a vulnerability scanning result; performing simulation attack on the information system, and generating an attack simulation report according to a simulation attack result; and generating a risk assessment matrix according to the vulnerability report and the attack simulation report. According to the method, the system, the equipment and the medium, comprehensive security verification can be carried out before the information system is online.

The invention is suitable for the technical field of payment data system vulnerability assessment, and provides a payment data security assessment method and system.The method comprises the steps that after vulnerability scanning and penetration testing operation is conducted on a payment data storage system, a plurality of scanned security defects are determined, and acquiring a preliminary risk priority evaluation index allocated to each security defect, and acquiring a historical operation log of the payment data storage system. According to the method, the mechanism of double correction factors is introduced, so that the repair priority evaluation of the potential risk vulnerabilities in the payment data storage system is optimized. Firstly, in combination with a hysteresis effect correction factor and a secret key updating frequency deviation correction factor, the accuracy and timeliness of vulnerability repair are effectively improved;

The invention provides a vulnerability scanning method, electronic equipment, a readable storage medium and a computer program product. The method comprises the following steps: receiving a natural language instruction input by a user; recognizing the natural language instruction through an intention recognition model to obtain an instance statement recognition result; determining a system call statement corresponding to the instance statement recognition result according to a vector database; triggering a vulnerability scanning management system to execute a corresponding scanning task according to the system call statement to obtain a scanning result; performing vulnerability risk analysis according to the scanning result to obtain a vulnerability analysis result; generating a scanning report according to the scanning result and the vulnerability analysis result; and outputting the scanning report on the interactive interface. Therefore, according to the method, efficient and flexible operation of vulnerability scanning management can be achieved according to the natural language instruction input by the user, a tedious customized development process does not need to be carried out, the universality and usability of the system are improved, and the operation and maintenance cost of the system is reduced.

The embodiment of the invention provides an information system security evaluation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evaluation index model corresponding to a security evaluation request, and obtaining a simulation system corresponding to a target information system; performing vulnerability scanning on the simulation system based on the scanning missing tool and the MDATA knowledge base to obtain a corresponding first scanning result and a corresponding second scanning result, and performing scanning result fusion analysis based on the MDATA knowledge base to obtain a system risk assessment result of the simulation system; obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and the expert knowledge base; the attack and defense test is performed on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test result, and the security evaluation result of the target information system is obtained based on the evaluation index model and the attack and defense test result, so that the accuracy of evaluating the information system is improved.

The invention relates to the technical field of intelligent power grid network security, in particular to an adaptive scanning concurrency number adjusting method under micro-grid isolation, which comprises the following steps: S1, respectively deploying load monitoring nodes in a control area, a non-control area and a management information area, collecting service load and network state data of each area in real time through the load monitoring node; and S2, based on the collected service load and network state data, constructing a concurrent number calculation formula, and through dynamic concurrent adjustment driven by the real-time load, the vulnerability scanning efficiency is ensured, and the service operation of each region of the micro-grid is prevented from being interfered.

The invention discloses a vulnerability scanning auditing method and a related device, and relates to the field of software testing. After a to-be-audited vulnerability scanning file in a preset format is obtained, whether first scanning result data in the to-be-audited vulnerability scanning file is compliant or not is judged according to a standard verification rule. And on the basis of judging that the first scanning result data is compliant, judging whether software associated with the to-be-audited vulnerability scanning file is a scanning-free type or not. If yes, whether second scanning result data in the to-be-audited vulnerability scanning file is compliant or not is judged according to pre-configured scanning-free management content. And when the software associated with the to-be-audited vulnerability scanning file is not a scanning-free type, judging whether third scanning result data in the to-be-audited vulnerability scanning file is compliant or not according to pre-configured vulnerability management content. According to the vulnerability scanning auditing method, the compliance of the vulnerability scanning file can be automatically judged according to the configured management content and the judgment process, and the checking efficiency and accuracy are effectively improved.

The invention discloses an asset vulnerability repair priority evaluation method based on an attack graph, and the method comprises the following steps: S1, carrying out the detection of all assets, and carrying out the vulnerability scanning of the detected assets; s2, obtaining a network access relation of the detected assets; s3, constructing an asset access relation graph based on the network access relation; s4, extracting external reachable vertexes based on the asset access relation graph; s5, carrying out asset importance calculation on the extracted vertexes; and S6, performing vulnerability priority ranking according to asset importance. According to the method, the accessibility of the network access relation is considered when the vulnerabilities are subjected to priority ranking, various attack paths possibly existing in the network can be fully reflected, and therefore the asset vulnerability repair priority can be more comprehensively and accurately reflected.

The invention belongs to the technical field of data processing, and discloses an industrial internet data security capability maturity evaluation method and system, and the method comprises the steps: recognizing multi-dimensional security data at an industrial internet edge node; integrating the multi-dimensional security data and carrying out mapping relation analysis to obtain a digital twinborn body; scanning the digital twin by using a vulnerability scanning tool to obtain node vulnerability data, and calculating a CVSS score; dynamically quantifying node connectivity weights based on connectivity and vulnerability heterogeneity of the nodes; performing risk assessment based on the node connectivity weight in combination with the CVSS score to obtain a node risk attribute of each node; constructing an attack path probability matrix of the digital twin through a Bayesian network; embedding the obtained node risk attribute and the attack path probability matrix into a digital twinborn body to obtain a digital twinborn simulation model; through the combination of a plurality of technical links, the capability maturity of industrial internet data security is effectively evaluated.

The invention discloses a network attack path automatic generation and defense strategy optimization method, system and device and a medium, and relates to the technical field of network security, and the method comprises the steps: constructing a topology mapping model, obtaining a network architecture, an asset list and a dependency relationship, constructing a visual topology chart, building a vulnerability association analysis model, and combining a vulnerability scanning result. The method comprises the steps of obtaining a vulnerability knowledge graph, optimizing a path calculation process based on the vulnerability knowledge graph, establishing a path derivation model, generating an attack chain by applying a path derivation algorithm, optimizing defense logic, formulating an optimization step model, and establishing a real-time simulation feedback model based on the generated attack chain. And performing simulation implementation on the defense strategy through a multi-level simulation training scheme, and dynamically optimizing the defense strategy according to feedback data. According to the method, the crossing from passive protection to active prediction and from single-point defense to global optimization is realized, and the accuracy and adaptive capacity of network defense are remarkably improved.

The invention provides a vulnerability risk assessment monitoring system for network security, and relates to the field of network security. According to the method, a first vulnerability scanning channel is obtained, an abnormal feature coding training mechanism is set, and then a precise abnormal coding feature data set is obtained; performing vulnerability filtering on the target URL according to the accurate abnormal coding feature data set to obtain a skipping source; setting a second vulnerability scanning model, obtaining a target weighting coefficient corresponding to a skipping source, and further obtaining a potential target URL; pre-storing a permission database, performing permission limitation on the skipping source according to the permission database, and obtaining an authorized skipping source; a third transmission encryption model is set, a confirmation log is obtained according to the authorization jump source, a user confirmation mechanism is set, the confirmation log is confirmed according to the user confirmation mechanism, and an encryption jump user is obtained; monitoring the encrypted jump user to obtain abnormal jump data; and the abnormal jump data is managed.

Techniques for a centralized vulnerability security scanning and distributed detection system are disclosed. Some techniques set forth a set of operations including receiving, in a first cloud environment of a cloud system, image scan results from a second cloud environment of the cloud system, receiving container identity data from a particular deployed container of a set of deployed containers in the first cloud environment, based on a comparison between the image scan results and the container identity data, determining that the particular deployed container of the set of deployed containers is running a vulnerable software product, and generating, for presentation on a graphic user interface (GUI), information associated with the vulnerable software product. The image scan results correspond to a vulnerability scan of a plurality of software products running in the set of deployed containers.

The invention discloses an intelligence management method and system based on network security, and relates to the technical field of network security, and the method comprises the steps: setting a firewall between a client network and a server network; performing encryption processing on the key data by using a key encryption algorithm; carrying out virus detection and intrusion detection, and applying an intrusion detection technology and vulnerability scanning in a server network; user identity verification is carried out, a user login process is designed, and login operation of the user is controlled and managed; tracking and positioning the source of the security problem; corresponding server network data processing authority is given to the user; double servers and a disk array are adopted for data storage, and the data are automatically backed up every preset backup cycle. The information collection module and the information management module are arranged to effectively block illegal invasion and virus spreading programs, so that the safety of user information and information is protected, and the confidentiality of the information in the transmission and storage process is ensured.

The invention relates to the technical field of network security, and discloses a network security vulnerability scanning method and a priority evaluation method thereof, and the network security vulnerability scanning method comprises the steps: obtaining internal and external information of a target system, generating a preliminary vulnerability list through matching, screening a target vulnerability according to a preset rule, and verifying vulnerability existence. According to the priority evaluation method for network security vulnerability scanning, the hazard index and the system state quantized value of the vulnerability are comprehensively evaluated, the final priority score is generated, the vulnerability needing to be processed preferentially is determined according to the priority ranking list, and the repair work is guided. By adopting the method and the device, efficient and accurate vulnerability scanning and priority evaluation are realized, the scanning efficiency and the detection precision are remarkably improved, the false alarm rate and the repair cost are effectively reduced, meanwhile, the dynamic adaptability is relatively high, the strategy can be optimized in real time according to the system load and the network environment change, and a comprehensive guarantee is provided for the network security.

The present invention discloses an automatic scanning and early warning management system for network security vulnerabilities based on big data, and specifically relates to the technical field of network security vulnerabilities. An automatic scanning and early warning management system for network security vulnerabilities based on big data includes a collection module, a processing module, and a push module, and each module is connected by a signal; the present invention obtains matching information and scanning information of network components, establishes a network component evaluation index, evaluates a new batch of deployed network components, and screens out network components that need to be scanned for vulnerabilities, thereby saving scanning resources and reducing resource waste. At the same time, by obtaining system status information and network component information, a vulnerability scanning evaluation index is established, and the screened network components are further evaluated to determine whether to immediately perform vulnerability scanning on them, so that the timing of vulnerability scanning is more reasonable, avoiding scanning when the system is under high load or during critical business periods, thereby reducing the impact on system performance.

The invention provides an automatic vulnerability scanning template generation method and device based on a large language model, and relates to the technical field of network security, and the method comprises the steps: generating vulnerability interaction summary information based on a concept verification proof; in any one vulnerability interaction process, generating a request load by utilizing a request agent according to vulnerability interaction summary information, extracting key fragment information in the vulnerability interaction process by utilizing a judgment agent under the condition of judging that the request load is valid, and generating a verification rule according to the key fragment information by utilizing an extraction agent; and generating a vulnerability scanning template for the target vulnerability based on the request load and the verification rule corresponding to each vulnerability interaction process. According to the automatic vulnerability scanning template generation method and device based on the large language model, the step-by-step conversion process is executed through three cooperative model agents, automatic conversion from concept verification proof to the vulnerability scanning template is achieved, and the generation efficiency of the vulnerability scanning template is greatly improved.

A code sensor system is provided, configured for execution by one or more processors, for cataloging and analyzing code repositories containing Artificial Intelligence (“AI”) and associating risks and vulnerabilities to the code repositories, the system comprising: a Detect AI module configured to identify code repositories that may contain AI; a Deep Scan module configured to generate an AI Bill-of-Materials (“BOM”) from the code repositories, the AI BOM including a plurality of categories including technologies, models and datasets; a Vulnerability Scan module configured to generate an interactive assessment of the risks and vulnerabilities associated with the AI BOM by cross-referencing content of the AI BOM with Open-Source Resources and a Threat Intelligence Database; a Code Sensor Platform configured to control the operation of the Detect AI module, the Deep Scan module and the Vulnerability Scan module; and a User Interface configured to display the risks and vulnerabilities to a user.

The invention discloses a network security monitoring system and method, belongs to the technical field of network security, and aims to solve the technical problem of how to carry out network security detection on an online internet financial website. Comprising a network threat discovery subsystem which is used for analyzing a network attack sample of the Internet financial platform, extracting an event rule, carrying out routing inspection on the Internet financial platform, discovering a network threat event aiming at the Internet financial platform based on the event rule and a routing inspection result, and recording the network threat event; the website vulnerability scanning subsystem is used for carrying out asset detection and vulnerability scanning on the Internet financial website to find security vulnerabilities; and the mobile APP security detection subsystem is used for performing security detection and risk analysis on the Internet financial mobile application to discover security vulnerabilities and transaction security risks.

The invention discloses a network security risk assessment method and system based on a data model. The method comprises the following steps of: firstly, collecting equipment logs, operation records, medical data access records and alarm information from key nodes of a hospital network, such as network equipment, a server, safety equipment and a medical information system in multiple channels, cleaning, de-weighting and normalizing, and then analyzing network topology, equipment safety, data sensitivity and user behaviors; building a model by using K-means clustering and a support vector machine, and training and optimizing by using historical data; and combining an analytic hierarchy process, vulnerability scanning and time sequence analysis to calculate asset value, vulnerability score and threat possibility, and obtaining a risk level according to a risk matrix method. The system comprises multiple layers of architectures such as data acquisition, processing, model construction, risk assessment decision, display interaction and the like, and the layers cooperate with each other. The system accurately adapts to a hospital network, comprehensively considers medical data characteristics, builds a foundation for hospital network safety management, and protects medical services.

The invention provides an asset vulnerability repairing method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of security scanning. The repairing method comprises the following steps: identifying potential asset vulnerabilities of an asset association graph at the current moment based on a vulnerability detection fusion model; based on a multi-dimensional vulnerability evaluation model, evaluating a vulnerability score of the potential asset vulnerability at the current moment; and based on the vulnerability score and a repair strategy optimization model, determining a repair plan of the potential asset vulnerability at the current moment. The problems of long time consumption, low efficiency and low timeliness in the process of finding vulnerabilities and taking effective defense measures in related technologies are at least solved. The method is suitable for vulnerability scanning and repairing scenes.

The invention provides a security operation and maintenance auditing system, which collects original log data generated by a plurality of system components through a log auditing unit, carries out structured processing based on the original log data to obtain a plurality of event triples, and constructs an event graph database based on the event triples. Traversing the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; a vulnerability scanning unit determines a current risk level of a target asset based on the target asset involved in the attack behavior chain and a log behavior density, an event type, a historical risk level and an abnormal operation frequency corresponding to the target asset in a preset time period, and configures a scanning task scheduling parameter based on the current risk level of the target asset, executing a vulnerability scanning task for the target asset based on the scanning task scheduling parameter; the operation and maintenance auditing unit generates the operation and maintenance request based on the attack behavior chain and / or the execution result of the vulnerability scanning task of each asset, so that the system security is effectively improved.