Abstract: The present disclosure discloses a method for detecting suspicious groups in collaborative stock transactions based on a bipartite graph. The method includes: determining transaction events and suspicious accounts as two different kinds of nodes of the bipartite graph based on historical stock transaction data, and searching for a transaction event and filtering out a suspicious account in an iterative updating loop until a set of transaction events and a set of suspicious accounts have converged; and constructing a collaborative transaction graph among accounts based on the set of transaction events and the set of suspicious accounts that have converged, performing a community division based on the collaborative transaction graph among accounts to determine one or more account communities that perform the collaborative stock transactions, and determining the one or more account communities as the suspicious groups in the collaborative stock transactions.

Abstract: A method for detecting physical intrusion attack in an industrial control system based on analysis of signals on serial communication bus is provided. This method comprises of actively sending a detection signal to communication bus via a bus controller in a serial communication bus network, sampling and analyzing signals on the communication bus by a monitoring device, performing differential comparison with a standard signal stored in the monitoring device database, detecting an intrusion signal in difference signal based on noise reduction technology and weak signal detection technology, and according to a detection result of the intrusion signal caused by an external device to effectively determine whether there is an external malicious device in the system, and whether the system is subjected to a physical intrusion attack.

Abstract: The present disclosure relates to a data flow forwarding abnormality detection method. In one example method, a switching device through which a to-be-detected data flow passes is determined by a controller. At least one flow entry in the switching device that matches the to-be-detected data flow is obtained. The at least one flow entry comprises actual traffic and a match field. The actual traffic is a value of a counter corresponding to the match field. An overdetermined equation set is established based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field. Based on the overdetermined equation set, a determination is made on whether the at least one flow entry is abnormal.

Abstract: The present disclosure relates to a data flow forwarding abnormality detection method. In one example method, a switching device through which a to-be-detected data flow passes is determined by a controller. At least one flow entry in the switching device that matches the to-be-detected data flow is obtained. The at least one flow entry comprises actual traffic and a match field. The actual traffic is a value of a counter corresponding to the match field. An overdetermined equation set is established based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field. Based on the overdetermined equation set, a determination is made on whether the at least one flow entry is abnormal.