39 results about "Zero-day attack" patented technology

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

The invention provides a network malicious traffic detection and analysis method and system, and the method comprises the steps: obtaining suspected malicious traffic slice data of network traffic data according to a network traffic feature library, and carrying out the attack mode correlation analysis according to an abnormal value detection result based on the suspected malicious traffic slice data to obtain an abnormal threat level, after an initial traffic management strategy is automatically generated based on a preset inference engine, multi-dimensional feature data obtained by sequentially carrying out noise reduction on suspected malicious traffic slice data and feature extraction based on a feature engineering technology are input into a malicious traffic detection model for malicious traffic identification to obtain a suspected zero-day attack sample; and according to the zero-day attack type of the suspected zero-day attack sample, a malicious traffic prevention and control strategy is obtained for adjusting the initial traffic management strategy to generate an optimal traffic management strategy. According to the method, the change of the flow mode and the attack means can be sensed in a self-adaptive manner, the hidden attack mode is deeply mined, and the zero-day attack can be quickly and accurately identified and blocked.

The invention discloses a log-based APT attack detection and tracing method, and belongs to the technical field of attack detection. In order to solve the problems of high efficiency, fine granularity and accuracy of APT attack detection, the method comprises the following steps: acquiring original system log data, and then preprocessing the original system log data to obtain a data set; and constructing a traceability graph based on the four operation types. The four operation types comprise file operation, process operation, authority operation and network operation; performing node anomaly detection by using a BERT model and a VAE model to obtain a threat node set; and based on the obtained threat node set and the traceability graph, obtaining an attack path comprising all threat nodes by using a Steiner tree algorithm. The method is suitable for learning under the condition that a large number of labeled samples and priori knowledge do not exist, the problem that a traditional algorithm cannot detect zero-day attacks can be solved, and a simple APT attack path traceability graph can be extracted from a large number of system logs.

The invention discloses a network intrusion intelligent detection system based on a 5G network, and relates to the technical field of network security. Comprising a traffic anomaly detection and analysis module, a data encryption tampering detection module, an anomaly analysis and evaluation module, an attack prediction and prevention module, a dynamic isolation and protection module, a reverse tracking and tracing module and a redirection and isolation protection module. According to the system, more efficient and more accurate intrusion detection and threat defense can be realized in a 5G network environment by integrating a plurality of advanced technologies and intelligent modules. Compared with a traditional rule-based detection method, the system can adaptively learn and identify a new attack mode, and the detection capability for zero-day attacks, variant attacks and advanced persistent threats (APT) is enhanced. Besides, by combining deep learning and reinforcement learning algorithms, the system can predict potential attacks in a dynamically changing network environment and automatically optimize a defense strategy, and the response speed and accuracy of the defense system are improved.

The invention discloses a vulnerability and threat scanning method and system based on artificial intelligence, and particularly relates to the technical field of artificial intelligence. The method comprises the following steps of: extracting known threat and potential zero-day attack data from a real environment to train an AI model, performing threat detection test on the AI model in diversified scenes by combining with generated simulation attack samples of high-complexity low-anomaly and low-complexity high-anomaly, analyzing the response capability of the AI model to high-complexity attacks, and determining the risk of high-complexity attacks by recording and counting false alarm and missing alarm conditions. Comprehensively evaluating the accuracy of identifying unknown novel threat features by the model; when it is detected that recognition of the model on unknown novel threat features is not accurate, by predicting the abnormal degree in a fixed time period, generating an early warning signal and optimizing the model, the detection capacity of the AI model on complex camouflage attacks can be remarkably improved, a blind area of the model in an actual environment can be found and repaired in time, and the recognition accuracy of the model on the unknown novel threat features is improved. And breakthrough of zero-day vulnerabilities and advanced persistent threats to the system is effectively prevented.

The invention relates to a construction method and device of a network security knowledge graph, equipment and a storage medium, and the method comprises the steps: obtaining multi-source data of a network security application scene, and carrying out distributed processing to obtain a security data set; performing structured storage management and security knowledge extraction on the security data set to obtain an initial knowledge graph; performing zero-day attack prediction construction based on the initial knowledge graph to obtain potential attack data; performing path fusion association on the potential attack data and the initial knowledge graph to obtain attack chain fusion information; and obtaining real-time event data of the network security application scene, and carrying out dynamic iteration updating on the initial knowledge graph by using the real-time event data and the attack chain fusion information to obtain the network security knowledge graph. According to the invention, the timeliness and practicability of the network security knowledge graph can be ensured.

The invention belongs to the technical field of network security, and particularly relates to a network security detection method based on artificial intelligence, which comprises the following steps of: acquiring network flow data, system log data, user behavior data and external threat intelligence data, generating a multi-source heterogeneous data set, preprocessing the multi-source heterogeneous data set, and acquiring a multi-source heterogeneous data set; comprising the steps of data normalization, missing value filling and noise filtering, feature extraction is conducted on preprocessed data through a multi-modal fusion model, extracted multi-modal features are input into a mixed detection engine, the detection rate of zero-day attacks can be increased to a high level through multi-modal data fusion, and compared with the prior art, the detection rate of zero-day attacks is increased. The detection rate of a traditional method has obvious advantages in the aspect of coping with novel threats, and meanwhile, the false alarm rate can be reduced below a normal value in the aspect of false alarm rate control, so that the burden of safety personnel for handling invalid alarms is greatly reduced, and the situation that a large number of false alarms cause waste of manpower and material resources and possibly cause the fact that real safety threats are neglected is avoided.

The invention belongs to the technical field of intrusion detection, and relates to an intrusion detection method, system and device for a roadside heterogeneous device network, and the method comprises the steps: calculating an action feature value for describing the change condition of a function code in front and back frames of data according to the function code in each frame of data, and obtaining an action feature vector; calculating each function code in each frame of data to read a time interval of a previous register with the same serial number to obtain a time interval vector; constructing a network behavior vector through the action feature vector and the time interval vector; clustering network behavior vectors constructed by normal network data through an anomaly detection model based on a clustering algorithm to obtain a central point and a threshold distance of each cluster; and judging whether the data points are abnormal data or not according to whether the network behavior vectors of the data points in the network data meet the characteristics of the outliers or not. The zero-day attack detection method is small in computing power requirement and can effectively detect zero-day attack at a low false alarm rate.

The invention relates to an intrusion detection method and system based on a generative adversarial network and a trusted execution environment, and belongs to the technical field of intrusion detection. The method comprises the following steps: acquiring encrypted original traffic data, and cooperatively training the encrypted original traffic data through trusted execution to obtain an initial intrusion detection model; distilling the intrusion detection initial model to obtain an edge deployable intrusion detection initial model; acquiring edge real-time traffic data, and processing the edge real-time traffic data through the edge deployable intrusion detection initial model to obtain a suspicious traffic set; and processing the suspicious traffic set and the historical intrusion attack set through dynamic adversarial evolution to obtain an anti-cheating security intrusion detection model, thereby synchronously improving zero-day attack detection capability and model anti-cheating performance on the premise of ensuring data security, and adapting to real-time requirements of edge scenes.

A method at a computing device including fragmenting a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embedding each of the plurality of byte strings in an embedding network to generate a plurality of embeddings; for each embedding in the plurality of embeddings, finding a nearest neighbor; and setting a predicted family for the malware sample based on a fusion of the nearest neighbor for each of the plurality of embeddings.

The invention discloses an attack detection method and system for gateway equipment. According to the heterogeneous cooperative defense system based on protocol context awareness provided by the invention, a'kernel mode instruction recombination-user mode adversarial learning 'double-engine architecture is innovatively constructed, and low-delay extraction of attack features and active evolution of a protection strategy are realized. Specifically, the invention provides a migration type adversarial evaluation model, which breaks through the dependence of a traditional detection scheme on protocol grammar, dynamically constructs a cross-protocol attack sample through a generative adversarial network, captures traffic time sequence anomaly in combination with a bidirectional LSTM, and constructs a dynamic graph containing threat propagation probability and resource occupation trend. Therefore, feature migration and generalization modeling can be carried out on unknown or variant attack behaviors, the recognition capability on zero-day attacks and cross-protocol attacks is enhanced, and finally the detection accuracy is improved.

The invention discloses a firewall dynamic policy adaptation method and system based on big data, and the method comprises the steps: collecting multi-source heterogeneous data in a network, and constructing a dynamic network entity map in real time; processing the time sequence of the atlas by using a preset time sequence diagram attention network model to obtain a behavior fingerprint vector representing the behavior state of the entity, and calculating the risk score of the entity; when the risk score exceeds a risk threshold value, automatically generating a temporary security policy for managing and controlling the access behavior of the entity; and managing the life cycle of the temporary security policy, and automatically updating, renewing or cancelling according to the entity risk state change. According to the method, the network entity behavior baseline is constructed and the risk prediction is carried out, so that the conversion from passive defense to active defense is realized, the security policy can be automatically and accurately generated and managed, advanced persistent threats and zero-day attacks can be effectively coped with, and the self-adaptability and the intelligent level of network defense are improved.

The invention discloses an unknown sample-oriented semantic-driven encrypted ransomware detection method and system, and relates to the field of computer security. The method comprises the steps that original log data streams are collected, noise is removed through self-adaptive sampling and triple filtering, and effective candidate events are converted into a semantic structured event set containing standardized natural language description through a retrieval enhancement generation mechanism; performing multi-stage time sequence sorting on the semantic structured events, identifying high-density behavior stages, clustering to generate event clusters, generating macroscopic and microscopic language paragraphs based on event cluster information, and classifying and segmenting event operation information to obtain an inter-segment time alignment relationship; and based on the paragraph and the alignment relationship, carrying out maliciousness test on the behavior chain by adopting four gating verification mechanisms, carrying out quantitative evaluation through a weighted confidence model, and outputting a detection result. According to the method, semantic comprehension and multi-dimensional behavior analysis are deeply fused, and the detection precision, interpretability and system generalization ability of unknown ransomware variants and zero-day attacks are effectively improved.

AI Powered Cybersecurity Computer Device for Detecting Zero-Day Attacks'

The present invention discloses a vulnerability and threat scanning method and system based on artificial intelligence, and specifically relates to the field of artificial intelligence technology. By extracting known threats and potential zero-day attack data from a real environment to train an AI model, combined with generating high-complexity and low-abnormality and low-complexity and high-abnormality simulated attack samples, the AI ​​model is tested for threat detection in diversified scenarios, and its response capability to high-complexity attacks is analyzed. By recording and counting false positives and false negatives, the accuracy of the model in identifying unknown new threat features is comprehensively evaluated. When it is detected that the model has inaccurate recognition of the unknown new threat features, by predicting the degree of abnormality within a fixed time period, an early warning signal is generated and the model is optimized, which can not only significantly improve the AI ​​model's detection capability for complex disguised attacks, but also promptly discover and repair the model's blind spots in the actual environment, effectively preventing zero-day vulnerabilities and advanced persistent threats from breaking through the system.

The application discloses a kind of based on log data's continuous automation vulnerability mining method, belong to network and information security technical field.The application can penetrate application surface layer, accurately identify dynamic generation interface, hidden application program interface and deep vulnerability parameter that traditional technology cannot touch, to significantly improve attack entry point coverage in real traffic, realize panoramic coverage of attack surface by quantitative information flow analysis and topology discovery based on data tracing.The application can capture, understand and verify new attack mode including zero-day attack from real traffic in near real time based on static semantics-dynamic time sequence double-layer learning model and closed-loop feedback mechanism, shorten threat response time from several days to several hours, build adaptive threat immunity ability;Through the risk intelligent scheduling mechanism driven by multi-objective genetic algorithm, test resources are preferentially allocated to business critical and highest risk attack entry, to significantly optimize computing resource allocation.

A method at a computing device including fragmenting a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embedding each of the plurality of byte strings in an embedding network to generate a plurality of embeddings; for each embedding in the plurality of embeddings, finding a nearest neighbor; and setting a predicted family for the malware sample based on a fusion of the nearest neighbor for each of the plurality of embeddings.

The invention discloses a computer virus intelligent defense method and system based on data mining, and belongs to the technical field of network security, and the defense method comprises the following specific steps: I, collecting various behavior data in a computer system, extracting corresponding behavior characteristics, carrying out entropy modeling according to each behavior characteristic, and analyzing entropy fluctuation in real time; iI, constructing a heterogeneous threat relation graph according to an analysis result, and reasoning a threat propagation path based on the heterogeneous threat relation graph; according to the method, the whole-process defense capability can be improved, normal behaviors and potential threats can be effectively distinguished, false alarm and missing alarm are reduced, the capability of coping with unknown viruses, variant viruses and zero-day attacks is greatly improved, the viruses are prevented from reversely bypassing defense, a complex threat propagation chain can be accurately recognized, the active trapping and behavior reduction capability is improved, and the method is suitable for popularization and application. The attack chain tracking and threat tracing capability is improved, and the system robustness is improved.

The invention provides a zero-day attack detection method and device, and a storage medium, and the method comprises the steps: capturing a network data package of a to-be-detected application network scene, and carrying out the feature extraction and preprocessing operation, and obtaining network traffic feature data; inputting the network traffic feature data into an intrusion signature detection model, matching the network traffic feature data with a known network traffic signature, and if the matching is successful, identifying the network traffic as a known attack traffic; and if the matching is not successful, inputting the network flow characteristic data into the intrusion baseline detection model for re-detection, and extracting uncovered attack fingerprint characteristic information as incremental knowledge to be fed back to the intrusion signature detection model. According to the method, the fingerprint features of the uncovered attacks can be effectively extracted, and the detection accuracy is remarkably improved.

The invention provides an attacker behavior prediction system and method based on an implicit Markov model. The system comprises: a security database module for collecting information from an existing open source vulnerability library and an attack database, and constructing an influence mapping pair caused by attacker operation and on a target system for subsequent model training and zero-day attack detection; the system monitoring module is used for capturing attacker behaviors by using a kernel-level honeypot and generating a configuration file; the attacker modeling module is used for modeling activities of an attacker according to an attacker configuration file from the honeypot, generating a minimum attack graph and updating the attack graph according to real-time data; the graph data mapping module is used for aligning information in the minimum attack graph with parameters of the implicit Markov model; the attacker behavior prediction module is used for processing training data and behavior modeling in a simulated real-time environment, training by adopting a Baum-Welch algorithm and predicting by using a Viterbi algorithm; and finally, calculating the maximum likelihood path in the implicit Markov model, selecting the path with the maximum probability in the final time step, and determining and generating the most probable hidden state sequence of the given observation action sequence according to the path, namely the most probable behavior executed by the attacker in the next stage.

The invention relates to the technical field of network security, in particular to a network security protection method based on big data, which comprises the following steps of: acquiring and preprocessing traffic at a boundary gateway, extracting dominant features and recessive features, constructing a session feature vector, and performing detection and interception judgment by using a pre-constructed gene pool. And meanwhile, based on a clustering algorithm, performing periodic clustering analysis on session feature vectors, evaluating interception rationality and dynamically adjusting related parameters. According to the network security protection method based on the big data, the advantages of the big data are flexibly utilized, so that the limitation that traditional network security protection depends on static feature matching and fixed threshold judgment is overcome, zero-day attacks and novel variant threats can be effectively detected, the false report and missing report rate is reduced, and the network security protection efficiency is improved. According to the invention, automatic optimization and accurate interception of the detection rule are realized, the adaptive capability and real-time detection efficiency of network security protection are improved, and a more intelligent, dynamic and accurate protection mechanism is provided for network information security.

In one implementation, a device obtains metrics regarding software executed in a computer network. The device determines, based on the metrics, a probability of the software representing a potential vulnerability. The device generates an attack graph that represents the potential vulnerability along a particular attack path. The device provides the attack graph for analysis.

The invention relates to a website operation method and device for restraining zero-day attacks, computer equipment and a storage medium. The method comprises the following steps: after an operator issues new website content, synchronizing website data of an internal version to an intermediate version; carrying out production environment adaptation processing on the website data synchronized to the intermediate version, wherein the production environment adaptation processing comprises one or more of database optimization processing, domain name search replacement processing and security reinforcement processing; and synchronizing the website data of the intermediate version after the production environment adaptation processing to a public version which is not used by a user at present, and updating a user access entry to enable the public version to be used by the user. According to the method and the device, zero-day attacks (namely attacks based on zero-day vulnerabilities) aiming at WordPress can be restrained, and loss can be minimized when a security protection means fails.

The invention relates to the technical field of network security, in particular to a traffic attack detection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring network traffic characteristics of communication traffic to be detected; performing affiliation evaluation of at least one known traffic attack on the network traffic characteristics to obtain abnormal scores of the network traffic characteristics belonging to different known traffic attacks; according to each abnormal score, determining an attack type corresponding to the to-be-detected communication flow; wherein the attack type comprises a known traffic attack and a zero-day attack; when traffic attack detection is carried out, the abnormal score that the network traffic feature belongs to different known traffic attacks can be obtained, and then the correlation between the network traffic feature and each known traffic attack is represented according to the abnormal score, so that the accuracy of subsequently determining the attack type corresponding to the communication traffic to be detected is ensured.

Software bill of materials (SBOM) vulnerability systems do not monitor software components behavior in real time, and rather rely on the static periodic updates. This gap leaves cloud-native software applications exposed to 0-day or supply chain attacks that exploit vulnerabilities that are not known or updated into the public vulnerability data sources. The techniques described herein provide dynamic and intelligent identification of 0-day and supply chain attacks in runtime environments, mitigate the attacks in real-time, and share intelligence to prevent a malicious workload from being deployed through the CI / CD pipeline.

The application belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack-defense game model, wherein the evaluation system comprises four functional modules of attack-defense game construction, risk prediction, dynamic defense optimization and security situation awareness.The application introduces the idea of dynamic attack-defense game, carries out multi-level and multi-scene attack-defense simulation according to historical state, strategy data and real-time data, calculates and analyzes the best attack path and attack strategy through game equilibrium solution, pre-trains the generated defense rule base relying on reinforcement learning and deep learning technology, dynamically adjusts network resources and network security resources, and optimizes network configuration according to real-time evaluation results to reduce the waste of system resources.Through the execution of the system and method in the application, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be real-timely adjusted, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

The invention provides a CAN bus attack intrusion detection method based on a self-attention mechanism, and belongs to the technical field of communication security. Comprising the following steps: S1, CAN bus broadcast message acquisition; s2, data preprocessing and windowing; s3, building a model; and S4, model training, including supervised learning model training and unsupervised classifier model training. According to the method, high-dimensional features in CAN bus data are captured by utilizing an attention mechanism, normal data and attack data are accurately classified on the basis, and meanwhile, the degree of the attack data deviating from a normal mode can be captured by utilizing an auto-encoder architecture and only adopting the normal data for training, so that zero-day attack detection is realized.

The invention discloses a continuous automatic vulnerability mining method based on log data, and belongs to the technical field of network and information security. According to the method, through quantitative information flow analysis and topology discovery based on data tracing, an application surface layer can be penetrated, and a dynamic generation interface, an application program interface and a deep vulnerability parameter which cannot be touched by a traditional technology can be accurately identified, so that the attack entry point coverage rate in real flow is remarkably improved, and panoramic coverage of an attack surface is realized; on the basis of a static semantic-dynamic time sequence double-layer learning model and a closed-loop feedback mechanism, novel attack modes including zero-day attack can be captured, understood and verified from real traffic nearly in real time, the threat response time is shortened from several days to several hours, and the adaptive threat immunity is constructed; through a risk intelligent scheduling mechanism driven by a multi-target genetic algorithm, test resources are preferentially allocated to an attack entry with key service and highest risk so as to significantly optimize computing resource configuration.

The application relates to a website operation method and device for containing zero-day attacks, computer equipment and a storage medium. The method comprises the following steps: after an operator publishes new website content, synchronizing website data of an internal version to an intermediate version; performing production environment adaptation processing on the website data synchronized to the intermediate version, wherein the production environment adaptation processing comprises one or more of database optimization processing, domain name search replacement processing and security reinforcement processing; synchronizing the website data of the intermediate version which has completed the production environment adaptation processing to a public version which is not currently used by users, and updating a user access portal so that the public version is used by users. The application can contain zero-day attacks (attacks based on zero-day vulnerabilities) against WordPress and minimize losses when security protection measures fail.

The invention discloses a network information security protection system, which relates to the technical field of network information security, and comprises an encrypted traffic analysis module, a collaborative decision module, a dynamic defense execution module and a security protection terminal. According to the method, traditional network features are mapped to a high-dimensional complex vector space and nanosecond-level micro-timing analysis is carried out, so that the feature expression capability and analysis granularity are greatly expanded, and a fine abnormal mode which cannot be perceived by a traditional method can be captured, thereby effectively coping with unknown threats such as zero-day attack and APT attack, solving the problem of encrypted traffic analysis, and improving the safety of encrypted traffic analysis. According to the invention, the method breaks through the detection blind area of the encrypted traffic, achieves the deep analysis of the encrypted traffic, the collaborative decision of privacy protection and dynamic and active defense execution through the introduction of a quantum information processing technology and a mimic defense architecture, and effectively improves the overall protection capability and response efficiency of network security.