234 results about "Vulnerability scanning" patented technology

The invention relates to the technical field of medical monitoring, in particular to a multi-mode intelligent management system for monitoring and preventing stress injury. The system comprises a multi-modal data acquisition and preprocessing module, a deep fusion risk prediction model module, an intelligent path planning and resource allocation module, a personalized intelligent intervention module and a data security module, so as to acquire time sequence physiological data and generate a body pressure thermodynamic diagram in real time, and realize standardization through normalization; a risk prediction model is generated through modeling, the contribution degree of each modal feature is calculated, and a risk level is determined according to a preset early warning grading mechanism; an optimal path is generated through intelligent planning, a nursing scheme is dynamically optimized and generated according to the risk level, and the nursing scheme is encrypted and transmitted to a cloud platform through HTTPS to be regularly subjected to security vulnerability scanning and repairing. According to the invention, the skin condition, the body position change and the pressure distribution of the patient can be accurately monitored, so that the closed-loop management of the pressure injury is realized.

The invention relates to the technical field of network security monitoring scheme design based on computing power, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: collecting network traffic, system logs and user behavior data; dynamically distributing CPU / GPU computing power according to network flow, attack frequency and the like; performing cleaning and format conversion on the data; intrusion detection, vulnerability scanning and traffic anomaly analysis are executed through multi-task parallel processing; a potential attack mode is mined in combination with deep learning model and rule engine association analysis; and judging threats according to a preset rule base and triggering early warning. According to the method, the resource utilization rate is improved through intelligent computing power scheduling, the threat recognition capability is enhanced in combination with deep learning and rule double engines, the method can adapt to a complex network environment, the threat detection accuracy is 98.7% according to actual measurement display, the resource occupation is reduced by 30%, and the method is suitable for high-concurrency scenes such as a cloud platform and the Internet of Things.

The invention relates to a notebook software vulnerability scanning method based on a security policy. According to the method, firstly, a security policy library of a target notebook is obtained, and the security policy library comprises access control rules, data operation limiting conditions and vulnerability detection reference requirements for different software types; collecting software running data of the target notebook computer, wherein the software running data comprises current running process information, file system operation records, network connection states and software configuration parameters; performing matching analysis on the software operation data and the security policy library to generate a preliminary scanning result; evaluating the risk level of the software vulnerability according to the preliminary scanning result; and finally, based on the risk level and the repair guide terms in the security policy library, generating software vulnerability repair guide information. Therefore, notebook software vulnerabilities can be scanned comprehensively and accurately, and effective repair guidance is provided.

Mechanisms are provided for scanning container images for vulnerabilities. With these mechanisms, a container image is received for inclusion in a container image registry and each layer of the container image is scanned to generate file signatures for each file referenced in each layer. Vulnerability signature(s) are applied to each layer, based on the file signatures of the layer, to determine if criteria of the vulnerability rule(s) of the vulnerability signature(s) are satisfied by at least one layer of the container image. Registration of the container image in the container image registry is accepted or denied based on results of the application of the vulnerability signature(s). Each vulnerability signature comprises one or more vulnerability rules generated from a scanning and indexing of layers of one or more other container images.

The invention discloses an industrial network threat state monitoring method and system, belongs to the technical field of industrial system security, solves the limitation of single flow detection through collaborative analysis of fused flow characteristics, equipment logs, threat intelligence and vulnerability scanning data, establishes a real-time association mechanism of log events and flow anomalies, and improves the safety of the system. Threat confirmation and response time is shortened from a traditional hour level to a minute level, and active strategy adjustment is realized based on linkage of a configuration baseline deviation degree and a vulnerability scanning result.

The invention discloses a network security event vulnerability detection method and system, particularly relates to the field of network security event detection, and is used for solving the problems of vulnerability life cycle evaluation and dynamic risk quantification in a containerized environment. According to the method, the defect of traditional static scanning in vulnerability life cycle measurement is overcome, vulnerability risk time-sensitive evaluation is realized, and resource waste caused by misinformation of expired vulnerabilities is reduced. Analyzing a vulnerability component position by using micro-service call chain topology, calculating a position contribution weight in combination with path contribution and a downstream dependency ratio, deducing an actual attack surface influence coefficient in linkage with a vulnerability survival time probability, accurately depicting a vulnerability propagation potential and an influence range, calculating a container instance level dynamic risk score, and calculating a vulnerability level dynamic risk score; the asset list and the risk score are updated in real time after the container capacity expansion and contraction event is triggered, and it is ensured that the evaluation result is synchronous with the actual operation state.

The invention relates to the field of network security, and discloses an attack surface management method based on network assets and risk vulnerabilities, comprising the following steps: step 1, automatically discovering internal and external network assets of an enterprise, including collecting enterprise asset information through a public platform and scanning network resources through a crawler technology, integrating to obtain a complete network asset list of the enterprise; step 2, performing vulnerability detection on the network assets, scanning each asset by using a vulnerability scanning tool, and identifying various security vulnerabilities through a preset vulnerability feature library; and step 3, scanning a result according to the vulnerability of each network asset. According to the invention, comprehensive and real-time discovery and tracking are carried out on internal and external network assets of an enterprise through an automation technology, wide coverage and timely updating of the network assets are ensured, all assets of the enterprise can be actively identified and managed, the risk of missing key assets is avoided, and thus the comprehensiveness and accuracy of network security protection are remarkably improved.

The embodiment of the invention provides an information system security evaluation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evaluation index model corresponding to a security evaluation request, and obtaining a simulation system corresponding to a target information system; performing vulnerability scanning on the simulation system based on the scanning missing tool and the MDATA knowledge base to obtain a corresponding first scanning result and a corresponding second scanning result, and performing scanning result fusion analysis based on the MDATA knowledge base to obtain a system risk assessment result of the simulation system; obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and the expert knowledge base; the attack and defense test is performed on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test result, and the security evaluation result of the target information system is obtained based on the evaluation index model and the attack and defense test result, so that the accuracy of evaluating the information system is improved.

The invention relates to the technical field of intelligent power grid network security, in particular to an adaptive scanning concurrency number adjusting method under micro-grid isolation, which comprises the following steps: S1, respectively deploying load monitoring nodes in a control area, a non-control area and a management information area, collecting service load and network state data of each area in real time through the load monitoring node; and S2, based on the collected service load and network state data, constructing a concurrent number calculation formula, and through dynamic concurrent adjustment driven by the real-time load, the vulnerability scanning efficiency is ensured, and the service operation of each region of the micro-grid is prevented from being interfered.

The invention discloses an asset vulnerability repair priority evaluation method based on an attack graph, and the method comprises the following steps: S1, carrying out the detection of all assets, and carrying out the vulnerability scanning of the detected assets; s2, obtaining a network access relation of the detected assets; s3, constructing an asset access relation graph based on the network access relation; s4, extracting external reachable vertexes based on the asset access relation graph; s5, carrying out asset importance calculation on the extracted vertexes; and S6, performing vulnerability priority ranking according to asset importance. According to the method, the accessibility of the network access relation is considered when the vulnerabilities are subjected to priority ranking, various attack paths possibly existing in the network can be fully reflected, and therefore the asset vulnerability repair priority can be more comprehensively and accurately reflected.

The invention belongs to the technical field of data processing, and discloses an industrial internet data security capability maturity evaluation method and system, and the method comprises the steps: recognizing multi-dimensional security data at an industrial internet edge node; integrating the multi-dimensional security data and carrying out mapping relation analysis to obtain a digital twinborn body; scanning the digital twin by using a vulnerability scanning tool to obtain node vulnerability data, and calculating a CVSS score; dynamically quantifying node connectivity weights based on connectivity and vulnerability heterogeneity of the nodes; performing risk assessment based on the node connectivity weight in combination with the CVSS score to obtain a node risk attribute of each node; constructing an attack path probability matrix of the digital twin through a Bayesian network; embedding the obtained node risk attribute and the attack path probability matrix into a digital twinborn body to obtain a digital twinborn simulation model; through the combination of a plurality of technical links, the capability maturity of industrial internet data security is effectively evaluated.

The invention discloses a network attack path automatic generation and defense strategy optimization method, system and device and a medium, and relates to the technical field of network security, and the method comprises the steps: constructing a topology mapping model, obtaining a network architecture, an asset list and a dependency relationship, constructing a visual topology chart, building a vulnerability association analysis model, and combining a vulnerability scanning result. The method comprises the steps of obtaining a vulnerability knowledge graph, optimizing a path calculation process based on the vulnerability knowledge graph, establishing a path derivation model, generating an attack chain by applying a path derivation algorithm, optimizing defense logic, formulating an optimization step model, and establishing a real-time simulation feedback model based on the generated attack chain. And performing simulation implementation on the defense strategy through a multi-level simulation training scheme, and dynamically optimizing the defense strategy according to feedback data. According to the method, the crossing from passive protection to active prediction and from single-point defense to global optimization is realized, and the accuracy and adaptive capacity of network defense are remarkably improved.

Techniques for a centralized vulnerability security scanning and distributed detection system are disclosed. Some techniques set forth a set of operations including receiving, in a first cloud environment of a cloud system, image scan results from a second cloud environment of the cloud system, receiving container identity data from a particular deployed container of a set of deployed containers in the first cloud environment, based on a comparison between the image scan results and the container identity data, determining that the particular deployed container of the set of deployed containers is running a vulnerable software product, and generating, for presentation on a graphic user interface (GUI), information associated with the vulnerable software product. The image scan results correspond to a vulnerability scan of a plurality of software products running in the set of deployed containers.

The invention relates to the technical field of network security, and discloses a network security vulnerability scanning method and a priority evaluation method thereof, and the network security vulnerability scanning method comprises the steps: obtaining internal and external information of a target system, generating a preliminary vulnerability list through matching, screening a target vulnerability according to a preset rule, and verifying vulnerability existence. According to the priority evaluation method for network security vulnerability scanning, the hazard index and the system state quantized value of the vulnerability are comprehensively evaluated, the final priority score is generated, the vulnerability needing to be processed preferentially is determined according to the priority ranking list, and the repair work is guided. By adopting the method and the device, efficient and accurate vulnerability scanning and priority evaluation are realized, the scanning efficiency and the detection precision are remarkably improved, the false alarm rate and the repair cost are effectively reduced, meanwhile, the dynamic adaptability is relatively high, the strategy can be optimized in real time according to the system load and the network environment change, and a comprehensive guarantee is provided for the network security.

The invention provides an automatic vulnerability scanning template generation method and device based on a large language model, and relates to the technical field of network security, and the method comprises the steps: generating vulnerability interaction summary information based on a concept verification proof; in any one vulnerability interaction process, generating a request load by utilizing a request agent according to vulnerability interaction summary information, extracting key fragment information in the vulnerability interaction process by utilizing a judgment agent under the condition of judging that the request load is valid, and generating a verification rule according to the key fragment information by utilizing an extraction agent; and generating a vulnerability scanning template for the target vulnerability based on the request load and the verification rule corresponding to each vulnerability interaction process. According to the automatic vulnerability scanning template generation method and device based on the large language model, the step-by-step conversion process is executed through three cooperative model agents, automatic conversion from concept verification proof to the vulnerability scanning template is achieved, and the generation efficiency of the vulnerability scanning template is greatly improved.

A code sensor system is provided, configured for execution by one or more processors, for cataloging and analyzing code repositories containing Artificial Intelligence (“AI”) and associating risks and vulnerabilities to the code repositories, the system comprising: a Detect AI module configured to identify code repositories that may contain AI; a Deep Scan module configured to generate an AI Bill-of-Materials (“BOM”) from the code repositories, the AI BOM including a plurality of categories including technologies, models and datasets; a Vulnerability Scan module configured to generate an interactive assessment of the risks and vulnerabilities associated with the AI BOM by cross-referencing content of the AI BOM with Open-Source Resources and a Threat Intelligence Database; a Code Sensor Platform configured to control the operation of the Detect AI module, the Deep Scan module and the Vulnerability Scan module; and a User Interface configured to display the risks and vulnerabilities to a user.

The invention discloses a network security risk assessment method and system based on a data model. The method comprises the following steps of: firstly, collecting equipment logs, operation records, medical data access records and alarm information from key nodes of a hospital network, such as network equipment, a server, safety equipment and a medical information system in multiple channels, cleaning, de-weighting and normalizing, and then analyzing network topology, equipment safety, data sensitivity and user behaviors; building a model by using K-means clustering and a support vector machine, and training and optimizing by using historical data; and combining an analytic hierarchy process, vulnerability scanning and time sequence analysis to calculate asset value, vulnerability score and threat possibility, and obtaining a risk level according to a risk matrix method. The system comprises multiple layers of architectures such as data acquisition, processing, model construction, risk assessment decision, display interaction and the like, and the layers cooperate with each other. The system accurately adapts to a hospital network, comprehensively considers medical data characteristics, builds a foundation for hospital network safety management, and protects medical services.

The invention provides an asset vulnerability repairing method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of security scanning. The repairing method comprises the following steps: identifying potential asset vulnerabilities of an asset association graph at the current moment based on a vulnerability detection fusion model; based on a multi-dimensional vulnerability evaluation model, evaluating a vulnerability score of the potential asset vulnerability at the current moment; and based on the vulnerability score and a repair strategy optimization model, determining a repair plan of the potential asset vulnerability at the current moment. The problems of long time consumption, low efficiency and low timeliness in the process of finding vulnerabilities and taking effective defense measures in related technologies are at least solved. The method is suitable for vulnerability scanning and repairing scenes.

The invention provides a security operation and maintenance auditing system, which collects original log data generated by a plurality of system components through a log auditing unit, carries out structured processing based on the original log data to obtain a plurality of event triples, and constructs an event graph database based on the event triples. Traversing the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; a vulnerability scanning unit determines a current risk level of a target asset based on the target asset involved in the attack behavior chain and a log behavior density, an event type, a historical risk level and an abnormal operation frequency corresponding to the target asset in a preset time period, and configures a scanning task scheduling parameter based on the current risk level of the target asset, executing a vulnerability scanning task for the target asset based on the scanning task scheduling parameter; the operation and maintenance auditing unit generates the operation and maintenance request based on the attack behavior chain and / or the execution result of the vulnerability scanning task of each asset, so that the system security is effectively improved.

Systems and methods provide agentless security assessment for workloads and cloud posture control across multi-cloud environments. Discovery modules are configured with collection intervals to ingest posture control data including assets, identities, configurations, activities, network flows, and build-time artifacts. A multi-cloud configuration inventory maintains current and historical states and produces misconfiguration and identity-activity findings. For workload vulnerability evaluation, an external snapshot manager obtains point-in-time root-disk state without installing an in-workload agent. A file system data processor derives operating system and package metadata, and a detector matches the metadata against a vulnerability feed refreshed on a recurring basis to identify vulnerabilities. Identified vulnerabilities are correlated with misconfiguration and activity findings to generate prioritized risk exposures. Results are stored per workload and presented through graphical user interfaces that display risk levels, timelines, alerts, and guided remediation, enabling continuous, low-overhead security coverage for cloud workloads and configurations.

The invention discloses a Web application vulnerability automatic scanning method based on a security agent. The method comprises the following steps that S0, security knowledge is collected, and a penetration tool is combined with a large model to construct the security agent; s1, a user inputs a vulnerability scanning task into the security agent; s2, the security agent disassembles the vulnerability scanning task, generates a tool as required, and calls the tool; s3, vulnerability scanning and blasting are executed in sequence based on the disassembled tasks; s4, processing the data after vulnerability scanning and blasting, and performing information extraction; and S5, aggregating the extracted information as structured data, analyzing the structured data and generating a visual report. According to the method, a large model is adopted to understand task requirements, task steps are intelligently disassembled, corresponding safety tools are dynamically called, and end-to-end automatic vulnerability scanning is achieved.

The invention discloses an original vulnerability data translation compression method based on a large language model and related equipment, based on a preset Prompt template, structured facts are extracted from original vulnerability data by using the large language model, the structured facts comprise network service facts and vulnerability existence facts, the network service fact is used for describing a target IP address, a running service name, a protocol type, a port number and a service running authority; the vulnerability existence facts are used for describing vulnerabilities existing in the service running on the target IP address, and identifying the existing vulnerabilities through standard vulnerability numbers; associating the vulnerabilities with the standard vulnerability numbers with the standardized vulnerability attribute tags to generate vulnerability attribute facts; establishing a direct mapping relationship between the vulnerability associated with the standardized vulnerability attribute tag and an MSF utilization module path, and generating an MSF utilization module mapping fact; network service facts, vulnerability existence facts, vulnerability attribute facts and MSF utilization module mapping facts are combined and translated and compressed to form a compressed vulnerability data set, and the compressed vulnerability data set is represented by a standardized predicate logic or key value pair set. According to the method, original and lengthy vulnerability scanning data can be converted into a highly-structured and information-refined representation form.

The invention provides a vulnerability processing method, electronic equipment and a storage medium, and relates to the technical field of data security transmission, and the method comprises the following steps: carrying out vulnerability scanning on a data center platform, obtaining a vulnerability information list of the data center platform, determining a preset associated parameter list of the data center platform influenced by vulnerabilities, a plurality of optimization parameter values are generated for each preset associated parameter in the preset associated parameter list, so that a combination list of all the optimization parameter values is obtained, and the security risk value of the data center platform under each combination is determined based on the combination list of the optimization parameter values. And the data center platform is optimized by using the combination corresponding to the minimum security risk value, and the vulnerability influence is reduced by optimizing the preset associated parameters.

The invention provides a container vulnerability scanning method for protecting cloud security and a related device, and the method comprises the steps: responding to a detected file opening event in a host machine, and determining the container information of a target container generating the file opening event and a target file path associated with the file opening event; determining target vulnerability information of a target container mirror image from the host machine vulnerability information according to the container information of the target container; wherein the target container is generated by a target container mirror image, vulnerability information of at least one container mirror image associated with the host machine is stored in the host machine vulnerability information, and the vulnerability information of the at least one container mirror image comprises a mapping relation between vulnerabilities and paths where the vulnerabilities are located; and determining a target vulnerability corresponding to the target file path according to the target file path and a mapping relationship between vulnerabilities in the target vulnerability information and paths where the vulnerabilities are located. According to the method, static vulnerability scanning and dynamic vulnerability scanning are combined, and container load safety and cloud safety can be protected.

The invention discloses a vulnerability scanning method and device based on a template cluster and a storage medium, and the method comprises the steps: responding to a vulnerability scanning request initiated by a user, and determining a scanning target of the vulnerability scanning request; loading at least one YAML classification template adapted to the scanning target to form a template cluster; performing global request merging and path optimization based on the address information of the scanning target and the request specification of each YAML classification template in the template cluster to obtain a detection request set; sending a detection request set to the scanning target, and receiving a response data set returned by the scanning target based on the detection request set; extracting a response matching rule of each YAML classification template in the template cluster, and performing matching analysis on the response data set through the response matching rule; and generating a vulnerability detection report according to a matching analysis result. According to the method, through template rule packaging and global intelligent optimization, scanning request magnitude reduction and efficient resource utilization are realized, and the detection efficiency and accuracy are remarkably improved.

The invention provides a penetration testing method and system based on multi-source data association and risk aggregation, and the method comprises the steps: firstly carrying out the automatic collection and normalization processing of heterogeneous security data from penetration testing, source code detection, vulnerability scanning and the like, and breaking an information island; and intelligent association and attack path discovery are carried out on discrete vulnerabilities based on an attack chain model, and a dynamic risk quantification model fusing a business influence weight and attack path complexity is innovatively introduced to carry out comprehensive risk assessment. According to the technical scheme, the problems of data splitting, single analysis dimension and disjunction between risk assessment and services of a traditional scheme are effectively solved, accurate identification and quantitative grading of composite attack chain risks are finally achieved, the safety analysis operation efficiency is remarkably improved, expert knowledge is solidified in the system, and the safety analysis efficiency is improved. And a visual and reliable data support is provided for safety investment decision-making of key information infrastructure industries such as power generation and the like.

The present application relates to a kind of electric power information system vulnerability scanning verification intelligent method.The present application is formed by the key technologies such as electric power information network Web system asset identification and vulnerability intelligent detection, and forms the intelligent, non-destructive electric power information network Web system asset identification and vulnerability intelligent detection technology system, comprehensively improves the deep level vulnerability mining of electric power information network Web system and the accurate identification ability of attack, makes the supplement for the research of company network security field in scientific research, technology and equipment etc.Aspects of research.From the angle of attack research, it will promote the research and development of related security technology and product in the field of electric power.

Techniques are described for providing a software-based platform for context-based vulnerability management of information technology (IT) environments. In some examples, a vulnerability management application collects vulnerability scan data, from potentially many different scanning agents, as well as vulnerability information from other third-party sources. The vulnerability management application also accesses asset and activity data associated with an IT environment. The vulnerability management application can provide a user interface contextualizing vulnerabilities, based on the contextual asset or activity data, allowing for user-configured or automated vulnerability risk adjustments to impact the management and remediation of vulnerabilities for the IT environment.

The invention discloses a network security auxiliary analysis decision method based on a generative large model, and relates to the technical field of system research and development and demonstration, and the method comprises the steps: collecting data from a firewall log, an intrusion detection system log and a vulnerability scanning report, and carrying out the preprocessing; performing network security intelligent association analysis based on the generative large model, and realizing multi-dimensional data association by adopting a question and answer mode analysis mode; carrying out learning analysis on the historical network security data, predicting attack behaviors and sending out early warning; generating decision suggestions and action plans according to the threat detection analysis result; performing visual display through the security situation map, the threat thermodynamic diagram and the attack path diagram; and sending an alarm notification according to a preset rule and a threshold value. The invention aims to carry out analysis and decision support on the network security data by utilizing the capability of the generative large model. A large amount of network security information can be automatically processed and understood, and real-time security situation awareness, threat detection, attack prediction and decision suggestions are provided.

The invention discloses a product design verification system based on a block chain. The system comprises a user authentication and authority management module, a design data chaining module, an intelligent contract verification module, a consensus mechanism module, a data retrieval and traceability module, a visualization and interaction module and a cross-module collaborative optimization module. According to the product design verification system based on the block chain, dual verification is carried out through the user authentication module by adopting biological characteristics and TOTP dynamic tokens, user sensitive data is encrypted and stored in combination with AES-256, design data is subjected to Hash solidification through SHA-256 before being chained, version chain management is realized by utilizing an intelligent contract, and the product design verification system based on the block chain has the advantages of being high in practicability and high in practicability. According to the method, all-link encryption from user identity access to data storage and circulation is achieved, unauthorized access and data tampering are completely eradicated, meanwhile, an intelligent contract verification module automatically verifies design parameter compliance through formalized verification and vulnerability scanning, traditional manual auditing is replaced, an improved PBFT algorithm is adopted by a consensus mechanism, and rapid uplink confirmation of design data is supported.