Trend Micro Inc.

State Grid Jiangsu Electric Power Company

State Grid Corporation of China Co., Ltd

State Grid Shandong Electric Power Company

State Grid Jiangsu Electric Power Co., Ltd., Information and Communication Branch

State Grid Smart Research Institute Co., Ltd.

Jing Cao

Bo Liu

Quan Yuan

Juliang Jiang

Xiangdong Ruan

Zhiwei Wang

Yishen Wang

Siqi Wang

Bo Guo

Hunk Shi

Xinan Wang

Di Shi

Anthony Zhong

You Lin

Haifeng Li

Chunlei Xu

Zhengyang Ding

Systems and methods for generating a load model having composite load components for electric power systems are disclosed which include acquiring state information at a bus of the electric power system, acquiring a training event record, and generating the load model by sequentially executing steps of determining a final load component composition for a predetermined composite load model structure referencing to both the state information and the training event record, and determining a plurality of final load parameters corresponding to the final load component composition and the predetermined load model structure also referencing to both the state information and the training event record.

Systems and methods of composite load modeling for electric power systems

A login authentication process to access a computer service includes displaying a virtual keyboard on a display screen of a computer. A user enters a password by clicking on the virtual keyboard. The manner the user clicked on the virtual keyboard to enter the password is compared to the manner an authorized user of the computer service clicked on the virtual keyboard to enter an authorized password during a learning phase. The login authentication is deemed to be a success when the password matches the authorized password, and the manner the user clicked on the virtual keyboard to enter the password matches the manner the authorized user clicked on the virtual keyboard to enter the authorized password.

Frictionless authentication for logging on a computer service

A virtual keyboard rendered on a separate computing device is independent of the user's computer. A virtual keyboard displayed on the user's computer screen is blank without any alphanumeric characters. Another virtual keyboard displayed on the user's independent computing device has a randomly generated layout of alphanumeric characters on a keypad. The user enters a password by pressing the blank keys of the blank keyboard on his computer screen with reference to the other virtual keyboard. The position sequence of these entered keys is sent to an application on a remote server computer. The remote server computer shares a virtual keyboard having the randomly generated layout of characters with the independent computing device via an online or off-line technique. When online, an encoded image of the encrypted layout is sent to the client computer and displayed for scanning by the device. When off-line, both the application and the device generate the same random key sequence by using the same pseudo random number generator and the same seed value.

Password protection with independent virtual keyboard

An attachment to an e-mail message received at an e-mail gateway is scanned by a scan server and then is converted into an HTML file. The HTML file includes preview data of the attachment (minus any macro scripts), the entire original data of the attachment, scan functionality enabling a user to send the attachment back to a scan server for a second scan, or extract functionality enabling a user to extract the original attachment data for saving or opening in an application. The recipient is able to open or save the attachment directly if he or she believes it comes from a trusted sender. If the attachment seems suspicious, the recipient previews the attachment first before performing a scan, opening the attachment or deleting it. The recipient performs a scan of the attachment by clicking a 'scan' button to send the attachment to a backend server for a second scan where an updated virus pattern file may be available to detect any zero-day malware.

On-demand scanning of e-mail attachments

The system executes online on corporate premises or in a cloud service, or offline. An e-mail message is received at a server within a corporate network or cloud service. A header of the e-mail message is parsed to determine locations of server computers through which the e-mail message has traveled. Geographic locations are placed into a routing map. A banner is inserted into the e-mail message that includes the routing map or a link to the routing map. The routing map is stored by the e-mail gateway server at a storage location identified by the link. The modified e-mail message is delivered or downloaded from the e-mail server to a user computer in real time. The sender Web site is parsed to identify sender domain information to be inserted into the banner. If offline, a product fetches and modifies the e-mail message using an API of the e-mail server.

Visual representation of sender domain information and e-mail routing

A system is implemented in browser plug-in software or in endpoint agent software on a user computer. The user accesses a Web site and fills in a login request form and submits it to the Web site. The system triggers a 'forgot password' feature and detects a phishing Web site by determining that it does not send a reset link to a valid user e-mail address, or, the system detects a phishing Web site by determining that it does send a reset link to an invalid e-mail address. Or, the system detects a phishing Web site by determining that it sends a reset link to a user e-mail address from a domain different from the domain of a login request form. Or, the system fills in an incorrect account name or password in a login request form and detects a phishing Web site by determining that the Web site does not indicate that the incorrect user name or incorrect password are incorrect. Or, the system submits incorrect credentials and detects a phishing Web site by determining that the Web site does not implement any way to reset the account name or password.

Prevention of credential phishing based upon login behavior analysis

The presently-disclosed solution provides an innovative system and method to protect a computer user from a phishing attack. Computer vision is effectively applied to match identifiable key information in suspect content against a database of identifiable key information of legitimate content. In one embodiment, the presently-disclosed solution converts suspect content to a digital image format and searches a database of logos and/or banners to identify a matching logo/banner image. Once the matching logo/banner image is found, the legitimate domain(s) associated with the matching logo/banner image is (are) determined. In addition, the presently-disclosed solution extracts all the URLs (universal resource links) directly from the textual data of the suspect content and further extracts the suspect domain(s) from those URLs. The suspect domain(s) is (are) then compared against the legitimate domain(s) to detect whether the suspect content is phishing content or not. Other embodiments and features are also disclosed.

Anti-phishing system and method using computer vision to match identifiable key information

A central computer of a telecommunications company handles an incoming call from a caller. The telephone number of the caller is checked against a white list or blacklist and handled accordingly. If the caller is unknown, a question is played to the caller (optionally selected randomly) along with a number of possible answers. The answers are presented randomly, associated with random identifiers, etc. If the caller selects the correct answer then the call is routed to the receiver's telephone. If not, then the call is terminated or other action taken as specified. The incoming call may also be handled by a mobile telephone or computing device at the user's home or business. The mobile telephone may alert the user when answering the incoming call or wait until the question is answered correctly before ringing the telephone.

Telephone call challenge to block spam

A user generates a pattern in a matrix (or two-dimensional grid) and enters a user name and an associated password. This username, password and pattern are stored locally on a computing device or are transmitted to a remote computer server for later authentication. Upon authentication, an input matrix is displayed. The user enters the password into the matrix in the form of the pattern, and also enters the username. The computer retrieves the previously stored pattern and password with the username. The previously stored pattern is used to read the input password from the input matrix. A match with the stored password indicates authentication. Alternatively, the input matrix only includes the pattern and password is entered separately. The input matrix may also be filled with random characters to improve security. The stored pattern is compared to the input pattern using image analysis or by comparing a set of coordinates.

Password protection using pattern

Collected information is analyzed by the mobile device to determine whether the device is displaced from the owner. The mobile device monitors and detects a reduction of ambient light to automatically enter into protection mode without manual activation. If an increase of ambient light and movement of the mobile device are both detected, then the device enters into authentication mode. Various techniques to verify the user's identity may be implemented in authentication mode. The user must correctly match an input key code, button combination, or an image recognition photograph against the stored information according to the method of verification chosen in each respective process. An alarm is activated if the device determines authentication is not received but may be disabled when the user's identity is verified after another authentication attempt.

Growing community of inventors

Nanjing, China

Jing Cao