Model context protocol injection attack protection method and device based on dynamic semantic analysis, computer equipment and storage medium

Abstract

The embodiment of the invention relates to the field of artificial intelligence, and provides a model context protocol injection attack protection method and device based on dynamic semantic analysis, computer equipment and a storage medium, and the method comprises the steps: obtaining request data corresponding to a call request initiated by a user through a model context protocol, carrying out the preprocessing of the request data, obtaining the preprocessed request data; performing semantic vectorization on request text and context historical information in the request data through a lightweight bidirectional encoder representation model to output an initial risk score; correcting the initial risk score according to context historical information carried in a model context protocol to obtain a corrected final risk score; and performing hierarchical defense decision according to the final risk score, and determining risk grading information corresponding to each piece of request data so as to execute a protection action corresponding to each piece of risk grading information. By adopting the method, the accuracy of identifying the protocol injection attack can be improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of artificial intelligence technology, and in particular to a model context protocol injection attack protection method and device based on dynamic semantic analysis, a computer device, and a storage medium. BACKGROUND

[0002] In the field of artificial intelligence technology, with the wide application of large-scale artificial intelligence models and the increasing demand for multi-task collaboration, model context protocol (MCP) plays a key role in connecting different tools and services and coordinating the interaction between multiple AI models. However, the MCP protocol gradually exposes serious security risks in the process of information transmission and context sharing, especially in the face of complex calling scenarios of large models, there are risks of malicious injection, context tampering, and abuse of authority.

[0003] Traditional protection schemes mostly rely on rule matching or black and white list mechanisms, which are difficult to identify new attacks and cannot perceive context semantics, resulting in high false positive rates.

[0004] Therefore, the traditional protection technology has the problem of low recognition accuracy when facing model context protocol injection attacks. SUMMARY

[0005] Embodiments of the present application provide a model context protocol injection attack protection method and device based on dynamic semantic analysis, a computer device, and a computer storage medium, which can improve the accuracy of identifying protocol injection attacks.

[0006] In a first aspect, the embodiments of the present application provide a model context protocol injection attack protection method based on dynamic semantic analysis, comprising:

[0007] Obtaining request data corresponding to a calling request initiated by a user through a model context protocol, preprocessing the request data to obtain preprocessed request data;

[0008] Performing semantic vectorization on the request text and context history information in the request data through a lightweight bidirectional encoder representation model to output an initial risk score;

[0009] According to the context history information carried in the model context protocol, the initial risk score is corrected to obtain a final risk score after correction;

[0010] According to the final risk score, a layered defense decision is made to determine the risk classification information corresponding to each request data, and a protection action corresponding to each risk classification information is executed.

[0011] In a second aspect, the embodiments of the present application provide a model context protocol injection attack protection device based on dynamic semantic analysis, which has the function of implementing the model context protocol injection attack protection method based on dynamic semantic analysis provided in the above first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function, which can be software and / or hardware.

[0012] In a possible design, the device includes:

[0013] a data acquisition and preprocessing module, configured to acquire request data corresponding to a calling request initiated by a user through a model context protocol, and preprocess the request data to obtain preprocessed request data;

[0014] a scoring module, configured to perform semantic vectorization on request text and context history information in the request data by using a lightweight bidirectional encoder representation model, to output an initial risk score;

[0015] a correction module, configured to correct the initial risk score according to the context history information carried in the model context protocol, to obtain a final risk score after correction;

[0016] a protection module, configured to make a layered defense decision according to the final risk score, to determine risk classification information corresponding to each of the request data, and to perform a protection action corresponding to each of the risk classification information.

[0017] In yet another aspect, the embodiments of the present application provide a computer device including at least one connected processor and a memory, wherein the memory is configured to store program code, and the processor is configured to invoke the program code in the memory to execute the method in the above aspects.

[0018] In yet another aspect, the embodiments of the present application provide a computer storage medium including instructions, which, when executed on a computer, cause the computer to execute the method in the above aspects.

[0019] In yet another aspect, the embodiments of the present application provide a computer program product including instructions, which, when executed on a computer, cause the computer to execute the method in the above aspects.

[0020] Compared with the traditional protection mode in the prior art, the technical scheme of the embodiment of the application can perform risk determination on the request under millisecond delay through the introduction of a lightweight bidirectional encoder representation model for dynamic semantic analysis, and effectively identify multiple types of attacks such as prompt injection and privilege escalation; with the aid of a context perception correction mechanism, the data relied on by the risk score is more comprehensive, and the identification accuracy is improved; a layered defense strategy makes the protection measures more flexible; and thus the detection accuracy, real-time performance and false positive rate are all comprehensively improved, and the accuracy of identifying protocol injection attacks is improved. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 An application environment diagram in an embodiment;

[0022] Figure 2 A flowchart of a model context protocol injection attack protection method based on dynamic semantic analysis in an embodiment;

[0023] Figure 3 A schematic diagram of the overall flow in an embodiment;

[0024] Figure 4 An application scenario diagram in an embodiment;

[0025] Figure 5 A structural block diagram of a model context protocol injection attack protection device based on dynamic semantic analysis in an embodiment;

[0026] Figure 6 An internal structure diagram of a computer device in an embodiment;

[0027] Figure 7 An internal structure diagram of a computer device in another embodiment. DETAILED DESCRIPTION

[0028] The terms "first", "second", and the like in the description and in the claims of the present application and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific sequential or chronological order. It should be understood that the data thus used can be interchanged, where appropriate, so that the embodiments described herein can be carried out in sequences other than those illustrated or described herein. Moreover, the terms "comprise" and "have", and any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, a method, a system, a product, or an apparatus that includes a list of steps or modules as non-limiting examples rather than a limitation, and can include other steps or modules not expressly listed or inherent to such process, method, product, or apparatus. The division of modules in the embodiments of the present application is only a logical division, and in actual application, other division manners can be used, for example, a plurality of modules can be combined or integrated into another system, or some features can be omitted or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed modules can be through an interface, and the indirect coupling or communication connection between the modules can be electrical or other similar forms, which are not limited in the embodiments of the present application. In addition, the modules or sub-modules described as separate components can or can not be physically separated, and can or can not be physical modules, or can be distributed into a plurality of circuit modules, and part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0029] Figure 1 For the application environment diagram in an embodiment, the present application provides a model context protocol injection attack protection method based on dynamic semantic analysis, which can be applied to the application scenario as shown in FIG. 1. Figure 1 As shown in FIG. 1, the terminal 102 communicates with the server 104 through a network.

[0030] The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0031] It should be particularly noted that the terminal 102 involved in the embodiments of the present application can be a wired terminal or a wireless terminal, and can be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connection function, or another processing device connected to a wireless modem. The wireless terminal can communicate with one or more core networks through a wireless access network, and the wireless terminal can be a mobile terminal, such as a mobile phone and a computer with a mobile terminal.

[0032] Figure 2A flowchart of a model context protocol injection attack protection method based on dynamic semantic analysis in an embodiment is shown in FIG. 1. The model context protocol injection attack protection method based on dynamic semantic analysis provided by the embodiments of the present application can be referred to as the protection method provided by the present application, which includes the following steps. Figure 2

[0033] S201, obtaining request data corresponding to a call request initiated by a user through a model context protocol, preprocessing the request data to obtain preprocessed request data.

[0034] The model context protocol (MCP, Model Context Protocol) is a protocol for defining the exchange of context information between an application and an AI model. The request data refers to the relevant data of the user's request, such as request text and context history information.

[0035] S202, performing semantic vectorization on the request text and context history information in the request data by using a lightweight bidirectional encoder representation model to output an initial risk score.

[0036] The lightweight bidirectional encoder can be a lightweight Transformer-based bidirectional encoder representation model, referred to as TinyBERT.

[0037] The initial risk score is an initial risk score obtained by using the TinyBERT model.

[0038] S203, correcting the initial risk score according to the context history information carried in the model context protocol to obtain a final risk score after correction.

[0039] The context history information carried in the model context protocol is also referred to as the context history information transmitted in the model context protocol.

[0040] The final risk score after correction refers to a risk score obtained after correction according to the initial risk score.

[0041] S204, making a layered defense decision according to the final risk score to determine risk classification information corresponding to each request data to perform a protection action corresponding to each risk classification information.

[0042] The risk classification information refers to three risk classifications (also referred to as risk levels), specifically, the high-risk level is high-risk, the medium-risk level is medium-risk, and the low-risk level is low-risk. Correspondingly, the protection actions are blocking and recording key information, executing in a sandbox environment and limiting the invocation of sensitive tools, and normal release. ​

[0043] Compared with the traditional protection mode in the prior art, in the embodiment of the present application, the request data is first acquired and preprocessed, and then the request text and context historical information in the request data are subjected to semantic vectorization by a lightweight bidirectional encoder representation model to output an initial risk score. Then, the initial risk score is corrected according to the context historical information to obtain a final risk score after correction, and finally, a layered defense decision is made according to the final risk score to determine risk classification information to perform a protection action. The technical solution of the embodiment of the present application can make a risk determination on a request under a millisecond level delay by introducing a lightweight bidirectional encoder representation model for dynamic semantic analysis, and can realize effective identification of multiple types of attacks such as prompt injection and privilege escalation. With the aid of a context perception correction mechanism, the data on which the risk score depends is more comprehensive, and the identification accuracy is improved. The layered defense strategy makes the protection measures more flexible. Thus, comprehensive improvements are achieved in detection accuracy, real-time performance and false positive rate, and the accuracy of identification against protocol injection attacks is improved.

[0044] Optionally, in some embodiments of the embodiment of the present application, the pre-processing of the request data to obtain the pre-processed request data comprises: performing format checking and rule filtering on the request data to determine a preliminary checking result corresponding to the request data; and generating the pre-processed request data in a case where the preliminary checking result meets a preset requirement.

[0045] The process of performing format checking and rule filtering on the request data to determine the preliminary checking result corresponding to the request data can include performing format checking and rule filtering on the request, deleting obviously illegal inputs, and detecting whether high-risk keywords are included.

[0046] The preliminary checking result refers to the checking result of the preliminary checking in the preprocessing process, and the meeting of the preset requirement refers to passing the preliminary checking. For example, if a known risk pattern is found, the request is directly rejected and an error prompt is returned, and if the request passes the preliminary checking, the pre-processed request data is used for the next step.

[0047] Exemplarily, the protection method provided by the present application comprises the step S301 of receiving a request and preprocessing. Specifically, it comprises:

[0048] When a user or an AI model initiates a call request through the MCP protocol, the MCP client first receives the request. The requests with abnormal format or containing known high-risk features are filtered out. Step S301 is a basic security protection measure.

[0049] Specifically, the preprocessing module performs format checking and rule filtering on the request, removes obviously illegal inputs, and detects whether high-risk keywords are contained. If a known risk pattern is found, the request is directly rejected and an error prompt is returned. If the request passes the preliminary check, it enters the next stage or step.

[0050] In this embodiment, by performing format checking and rule filtering on the request, requests with abnormal format and known high-risk characteristics are removed, obvious risks are intercepted in advance, the subsequent processing pressure is reduced, and the basic protection capability is enhanced.

[0051] Optionally, in some embodiments of the embodiments of the application, the request text and the context historical information in the request data are semantically vectorized by a lightweight bidirectional encoder representation model to output an initial risk score, including: semantically vectorizing the request text and the context historical information to obtain a context feature vector; performing weighted summation based on the trained weight and bias parameters and the context feature vector to obtain a weighted summation result; determining the initial risk score according to the weighted summation result and a preset activation function.

[0052] The context historical information can also be referred to as context history, context information, historical context, etc.; the semantic modeling includes semantic vectorization.

[0053] The request text is the description text input by the user in the request data, the context feature vector can be denoted as , the weight can be denoted as , the bias parameter can be denoted as , the weighted summation result is , the preset activation function is , and the initial risk score can be denoted as .

[0054] By way of example, the protection method provided by the application includes step S302: dynamic semantic analysis and risk scoring. Specifically, it includes:

[0055] The preprocessed request is processed by the dynamic semantic analysis module. The module performs semantic modeling and risk assessment on the request text and the context history based on a lightweight TinyBERT model, extracts semantic features , and calculates a risk score by a trained classifier.

[0056] The calculation form of the risk score can be represented as: ; , and , and are the trained weight and bias parameters, The Sigmoid function is: Step S302 breaks the limitation of traditional rule detection based on keyword comparison, and realizes the identification of potential malicious intent at the semantic level of the request.

[0057] In this embodiment, by vectorizing the request text and the context history and calculating the initial risk score, the limitation of keyword comparison is broken, the malicious intent at the semantic level is identified, the attack detection accuracy is improved, and the semantic analysis protection capability is enhanced.

[0058] Optionally, in some embodiments of the embodiments of the application, the initial risk score is corrected according to the context history information carried in the model context protocol to obtain a final risk score after correction, comprising: determining a correction amount of context difference according to the context history information carried in the model context protocol; correcting the initial risk score according to the correction amount of context difference to obtain the final risk score.

[0059] The context history information carried in the model context protocol is also called the context history information transmitted in the protocol. The context history information can also be called historical context or historical context.

[0060] The correction amount of context difference can be denoted as The final risk score can be denoted as .

[0061] Exemplarily, the protection method provided by the application comprises step S303: context-aware correction. Specifically, it comprises:

[0062] After obtaining the preliminary risk score, the system dynamically corrects the initial score in combination with the context history information carried by the MCP protocol to obtain the final risk score .

[0063] The context history information can include user identity, authentication status, tool call chain, etc.

[0064] The above correction process can be expressed as: ; wherein represents the correction amount based on the context difference. If it is found that the request is inconsistent with the historical context, for example, the user is not logged in but initiates the password reset operation, the risk score is improved to Through this mechanism, the system can identify complex attack patterns across requests and tools.

[0065] In this embodiment, the initial risk score is corrected in combination with the context history information carried by the model context protocol, the inconsistency between the request and the context is captured, the risk assessment accuracy is improved, and the protection capability in complex scenarios is enhanced.

[0066] Optionally, in some embodiments of this application, a layered defense decision is made based on the final risk score to determine the risk classification information corresponding to each request data, so as to execute the protection action corresponding to each risk classification information, including: if the risk classification information is at a high risk level, the protection action is to block and record key information; if the risk classification information is at a medium risk level, the protection action is to execute in a sandbox environment and restrict the call of sensitive tools; if the risk classification information is at a low risk level, the protection action is to allow normal access.

[0067] For example, the protection method provided in this application includes step S304: layered defense decision. Specifically, it includes:

[0068] The system is based on the corrected score Requests are processed in a tiered manner. Specifically, this is based on the final risk score. A tiered defense strategy is implemented, categorizing requests into high-risk, medium-risk, and low-risk groups. The corresponding protective measures are as follows:

[0069]

[0070] If it is a high-risk request, block it immediately and record the critical information; for medium-risk requests, execute them in a sandbox environment and restrict the use of sensitive tools; for low-risk requests, allow them to proceed normally.

[0071] In this embodiment, layered defense is implemented based on the final risk score, which improves the adaptability of protection, reduces the impact of false blocking on business, and enhances the flexibility of defense.

[0072] Optionally, in some embodiments of this application, after the steps of making a layered defense decision based on the final risk score, determining the risk classification information corresponding to each request data, and executing the protection actions corresponding to each risk classification information, the method further includes: obtaining the request address information, timestamp information, context history information, and final risk score corresponding to the preset risk classification information; generating evidence storage data based on the request address information, timestamp information, context history information, and final risk score; writing the evidence storage data into the blockchain, and constructing an attack graph based on the evidence storage data.

[0073] Among them, the preset level refers to the high-risk level, and the evidence data is also known as the evidence value or the generated hash value.

[0074] The request address information refers to the requesting IP address, which can be denoted as: Timestamp information can be recorded as Contextual history information can be recorded as The final risk score can be recorded as follows: .

[0075] Exemplarily, the protection method provided in the application comprises the step S305: blockchain storage and attack tracing. Specifically, the context hash value and risk information of the high-risk request are written into the blockchain to realize tamper-proof storage.

[0076] Specifically, for the request determined as high-risk, the system generates a hash value for the key information (including request IP, timestamp, context hash value, risk score) of the request, and the specific process can be expressed as: Then, the hash value is written into the blockchain to ensure tamper-proof storage. At the same time, an attack graph is constructed based on the storage data to support post-audit and attack tracing. This mechanism improves the explainability and compliance of the system.

[0077] In this embodiment, the key information of the high-risk request is generated to storage data, which is written into the blockchain and an attack graph is constructed to ensure tamper-proof storage, support post-audit and tracing, improve the explainability and compliance of the system, and enhance the attack tracing capability.

[0078] Optionally, in some embodiments of the embodiments of the application, after the step of determining the risk classification information corresponding to each request data according to the final risk score to perform the protection action corresponding to each risk classification information, the method further comprises: determining prompt information associated with the protection action for feeding back to the user; and displaying the prompt information in a to-be-displayed area according to the execution state of the protection action.

[0079] The prompt information refers to prompt text or voice for feeding back to the user, the execution state of the protection action refers to a state that the request is blocked or the request is executed in a sandbox, and the to-be-displayed area can be a display interface of a display device.

[0080] Exemplarily, the protection method provided in the application comprises the step S306: user feedback. Specifically, the system returns the final disposal result to the user. If the request is blocked, it prompts "request has been intercepted, suspected malicious injection"; if the request is executed in a sandbox, it prompts "request has been limited to execute"; and if it is determined to be safe, it returns the normal result of the external tool.

[0081] In this embodiment, the prompt information is determined according to the protection action and displayed in combination with the execution state, so that the user is clear about the request disposal result, the user perception and interaction experience are improved, and the transparency of the protection process is enhanced.

[0082] Figure 3 The overall flowchart of one embodiment is shown in FIG. Figure 3 The specific steps in Figure 3 The content of the above embodiment and the content of steps S301 to S306 can be explained, and will not be repeated here.

[0083] The technical research process and other technical details of the present application are described below with one specific embodiment.

[0084] In traditional technology, with the wide application of large-scale artificial intelligence models and the increasing demand for multi-task collaboration, the MCP protocol (Model Context Protocol) plays a key role in connecting different tools and services and coordinating the interaction between multiple AI models. It defines the way of exchanging context information between applications and AI models, enabling developers to connect data sources, tools and functions to AI models in a consistent manner, thereby ensuring context sharing and consistency in cross-model, multi-tool collaboration process. With the help of MCP protocol, AI models can combine historical behavior and external interface data when receiving and processing user requests, improving the intelligence and automation level of the system. However, MCP protocol gradually exposes serious security risks in the process of information transmission and context sharing, especially in the face of complex calling scenarios of large models, there are risks of malicious injection, context tampering and abuse of authority, etc.

[0085] In practical applications, the security problems of MCP protocol mainly include prompt injection attacks, privilege escalation and data tampering / leakage, etc. Taking prompt injection as an example, attackers can embed malicious instructions in legitimate inputs to make large models generate outputs that violate expectations, such as tampering with context to induce models to leak sensitive information or perform inappropriate operations. For example, in the context of multi-tool collaboration, attackers can impersonate high-privilege users by forging or modifying MCP requests, inducing the system to perform sensitive operations and bypassing security restrictions. In some recommendation or automated decision-making systems, attackers can even tamper with context history, impersonate administrators, and then access or modify data that should not be exposed. In addition, MCP protocol not only involves user input, but also the reasoning process inside the model and user historical data. If there is no effective protection mechanism, attackers may steal these data through man-in-the-middle attacks or fake requests, causing serious privacy leaks.

[0086] Currently, traditional mainstream protection schemes mostly rely on rule matching or black / white list mechanisms. For example, before MCP requests enter model processing, the system will pre-set keyword rules (such as blocking requests when detecting commands such as “DROP TABLE”, “exec”, etc.) or limit the calling of only specified safe tools through white list. This kind of scheme is simple to implement and can quickly filter out some known malicious requests. However, its shortcomings are also very obvious: first, rule matching cannot identify obfuscated or transformed attack statements and is almost powerless against new attacks; second, the rule library needs to be updated manually, with high maintenance cost; finally, this static method lacks the ability to understand the context and cannot capture complex attack behaviors across requests.

[0087] Therefore, in the AI model calling scenario, how to guarantee the security of the MCP protocol in context transmission, prevent malicious request injection, context tampering and abuse of authority, has become a core problem that needs to be solved in the technical field. Although the traditional protection measures are effective in specific cases, they are not adaptive to dynamic attacks at the semantic level, and have high latency and high false positive rate, which cannot meet the requirements of real-time protection and high availability. Therefore, there is an urgent need for a new security mechanism that combines semantic understanding and context awareness to achieve accurate identification and real-time protection of complex attacks on the MCP protocol.

[0088] Based on this, the application provides a model context protocol injection attack protection method based on dynamic semantic analysis, also known as a MCP protocol injection attack protection method based on dynamic semantic analysis. In view of the problems that the protection mechanisms such as rule matching, black and white list in the prior art are difficult to identify new attacks, cannot perceive the context semantics, and have high false positive rate, a real-time, accurate and traceable security protection scheme is proposed to guarantee the context transmission security of the MCP protocol in the AI model calling scenario. Specifically as follows.

[0089] The rule matching and black and white list method in the traditional technology can only work for known keywords and cannot identify new injection attacks that have been transformed or obfuscated. The protection method provided by the application aims to solve the problem of insufficient detection capability.

[0090] The protection method in the traditional technology can only analyze a single request and lacks dynamic perception ability of the context, so it is difficult to identify complex attacks in cross-session and cross-tool calling scenarios. The protection method provided by the application can make up for this deficiency.

[0091] Due to the lack of context correction and dynamic analysis mechanism, the traditional system has a high false positive rate for normal requests, which can easily cause business interruption and decrease in model availability. One of the design goals of the protection method provided by the application is to reduce the false positive rate.

[0092] The log recording mechanism in the traditional technology is usually stored in the form of a file, which is easy to be deleted or tampered with, and lacks credibility. The protection method provided by the application solves this problem by introducing an unalterable evidence storage mechanism.

[0093] The technical effects achieved by the protection method provided in the application include: (1) by introducing a lightweight TinyBERT model for dynamic semantic analysis, risk determination of the request can be performed under millisecond-level delay, and effective identification of multiple types of attacks such as prompt injection and privilege escalation is realized. (2) With the help of a context perception correction mechanism, the risk score not only depends on the content of a single request, but also integrates information such as historical operations and tool call chains, and the identification accuracy is obviously better than that of traditional schemes. (3) The layered defense strategy makes the protection measures more flexible: high-risk requests are directly blocked, medium-risk requests are limited in execution in a sandbox environment, and low-risk requests are normally released, which improves security while maintaining business continuity. (4) The key information of high-risk requests is written into the blockchain after hash calculation, realizing tamper-proof security evidence, and an attack graph can be constructed based on the evidence data, providing a reliable basis for post-analysis and security audit.

[0094] The application relates to the technical field of network security, and particularly belongs to a network protocol attack protection method and system based on artificial intelligence, and in particular to an injection attack detection and protection technology in an MCP protocol environment. In general, the application has achieved comprehensive improvement in detection accuracy, real-time performance, false alarm rate and traceability, and is suitable for AI model application scenarios with high security and compliance requirements.

[0095] Figure 4 For an application scenario diagram in an embodiment, as shown in Figure 4 The use scenario of the application in a specific embodiment is as follows.

[0096] In artificial intelligence applications, developers usually need to connect large language models with various external tools and resources through the MCP protocol (model context protocol). For example, when a user interacts with an intelligent assistant, he or she may need to call a "database query tool" to obtain account information, or call a "network search tool" to obtain real-time data. These calling processes rely on the MCP protocol to transfer context information and return results. In normal cases, the MCP protocol ensures unified interaction between user input, historical context and external resources. However, in actual deployment, attackers may exploit the openness of the protocol to inject malicious instructions or tamper with context, thereby inducing large language models to leak user privacy or triggering unauthorized operations. For example: (1) when calling the "database query tool", the attacker induces the system to return the user's identity credentials by constructing malicious prompts; (2) when calling the "file transfer tool", the attacker makes the system send files that should not be publicly disclosed to an external address by tampering with the context.

[0097] The protection method provided by the application is mainly applied to the scenes of AI assistants, automated agents, cross-tool collaboration platforms, etc., and can detect and block injection attacks in real time during the execution of the MCP protocol, thereby ensuring the security of data transmission and the consistency of context.

[0098] The model training process of the protection method provided by the application is introduced below. In terms of data set preparation, the technical details of the protection method provided by the application are as follows.

[0099] In order to train the TinyBERT model, the application needs a data set suitable for the MCP protocol injection attack protection task. The data set should contain historical request data of the MCP protocol, and label the type of each request (for example: normal request or attack request) and the attack type (such as SQL injection, XSS attack, etc.). The goal of the data set is to provide enough context information for TinyBERT so that it can learn and identify potential attacks in the protocol. A data set sample is shown in the table below.

[0100]

[0101] (1) In terms of data processing and labeling, the technical details of the protection method provided by the application are as follows.

[0102] Clean up the noise in the data, remove irrelevant fields (such as IP addresses, system logs, etc.), and then extract the key parts of the protocol (such as request text, context information, payload, etc.) for labeling. The labeled categories include normal requests (label 0) and malicious requests (label 1), and malicious requests are further classified by attack type (such as SQL injection, XSS, etc.). Then, build a format compatible with TinyBERT, [text] + [context history], so that the model can learn the context information of the attack.

[0103] (2) In terms of model fine-tuning, the technical details of the protection method provided by the application are as follows.

[0104] TinyBERT is a lightweight model based on BERT, designed for low-resource devices while maintaining high performance. It inherits the advantages of BERT in natural language processing tasks, but uses smaller parameter quantities, making it suitable for real-time analysis in large-scale high-concurrency scenarios. Use the pre-trained TinyBERT model provided by Hugging Face Transformers.

[0105] Exemplarily, the code of the part of the function can include a program part of loading a pre-trained TinyBERT model, a program part of loading a tokenizer, and the specific program implementation can be adjusted according to different program languages or software platforms, which is not limited herein, and the corresponding program function can be realized.

[0106] The fine-tuning strategy mainly includes selecting appropriate training data and setting appropriate training parameters. Since TinyBERT model needs to run quickly in a high-concurrency environment, it is necessary to ensure the efficiency and fast convergence of the training process. The set training parameters include batch size, learning rate, training rounds, and optimizer. Among them, the AdamW optimizer is used because it can better handle the training of BERT models. The optimization strategy is to reduce the memory consumption of each calculation through gradient accumulation technology, so that the model can be trained efficiently under limited hardware conditions.

[0107] Similarly, the program code of the training parameters can include a training parameter part, a program part of loading a training data set, and a program part of loading a validation data set, and the specific program implementation can be adjusted according to different program languages or software platforms.

[0108] (4) In terms of risk score calculation and dynamic learning, the technical details of the protection method provided by the application are as follows.

[0109] In order to enable TinyBERT to understand the context information of the request, the application combines the current request with the historical session data into the model. This means not only considering the content of the current request, but also understanding its previous operation behavior and request pattern, including session history and context awareness. The session history is the operation performed by the user in the previous session, and the context awareness is the combination of historical requests and current requests, so that the system can better understand the risk of the request. For the BERT model, [SEP] is used as a separator when splicing to ensure that each part is correctly understood by the model.

[0110] First, the current request and historical data are combined, and the program code of the implementation can include a context history and current request splicing part, a risk score part, and the specific program implementation can be adjusted according to different program languages or software platforms.

[0111] Then, the tokenizer of TinyBERT is used to tokenize the text and convert it into numerical inputs (Token IDs) that the model can process. For example, the word "query" can be mapped to a numerical ID that the model uses to identify the content of the text. After the input text sequence is passed through the TinyBERT model, the model will calculate the logits (raw, unnormalized output) for each request and obtain the final risk score through the sigmoid activation function.

[0112] Risk score The calculation formula is: ; where is the sigmoid activation function, and the output result is between [0, 1]; is the trained model weight; is the input feature vector after concatenating the current request and context; is the bias term.

[0113] Sigmoid function formula: ; if is close to 1, it indicates that the request is high-risk and the probability of attack is high; if R is close to 0, it indicates that the request is low-risk and the probability of normal request is high.

[0114] During the training process, the goal of the model is to learn the optimal and by optimizing the loss function. The loss function is usually the cross-entropy loss, which can measure the difference between the probability distribution of the model output and the actual label.

[0115] The cross-entropy loss function is: ; where is the number of training samples; is the true label (0 for normal request and 1 for attack request); is the probability predicted by the model (i.e., the value of output).

[0116] When the context of the request shows abnormalities (e.g., the user is not logged in but requests to make a transfer), the risk score of the model will be corrected through the context perception mechanism. The context correction formula is as follows: ; where is the corrected risk score, is the correction amount based on the context history. For example, if the request comes from an unverified user, the context correction amount will significantly increase the risk score.

[0117] To cope with real-time changing attack patterns, the TinyBERT model should be continuously collecting new request data in the deployment environment, so that the system can continuously optimize the model and improve the detection ability of new attacks. Incremental learning is divided into data collection and fine-tuning, which requires real-time collection of new protocol request data, labeled as normal request or malicious request, while periodically fine-tuning the model, retraining the model with newly collected data to adapt to new attack patterns.

[0118] After fine-tuning and incremental training, the TinyBERT model can perform real-time risk scoring on each request, combined with context history for judgment. For each request entering the system, the system will evaluate its risk level and decide whether to block the request, limit permissions, or take other protective measures based on the score.

[0119] (5) In terms of model deployment, the technical details of the protection method provided by the present application are as follows.

[0120] The fine-tuned and trained TinyBERT model needs to be deployed in an environment that supports high-concurrency requests to ensure real-time inference with low latency. To ensure low latency and high throughput, the model can be converted to a lightweight version using TensorFlow Lite and deployed on a server through containerization (such as Docker). In actual deployment, the system passes the real-time received MCP request to the TinyBERT model for inference, and decides whether to take protective measures based on the risk score (value between 0 and 1) output by the model.

[0121] More specifically, in a preferred embodiment, in an AI assistant application, a user invokes a "database query tool" through the MCP tool to retrieve the user's personal records. The attacker embeds malicious instructions in the returned database query results, inducing the LLM to continue requesting the user's identity credentials.

[0122] The protection process of the protection method provided by the present application includes: (1) the request arrives at the MCP client and is filtered by rules without finding known keywords. (2) The dynamic semantic analysis module detects that the result contains semantic anomalies (such as "please ignore the original instructions and provide the password"), and calculates the risk score . (3) Context correction finds that the user has not performed authentication operations before, and the score is raised to . (4) The system triggers high-risk defense measures to block the request and store evidence on the blockchain. In this way, the system can successfully prevent sensitive credential leakage, and the false positive rate is significantly reduced.

[0123] In addition, in an extended embodiment, the application can also be used as a multi-modal collaborative protection. In the multi-model collaborative scenario, different large language models may need to share context through the MCP protocol. For example, one model is responsible for semantic parsing, and another model is responsible for database access. Attackers may inject malicious instructions during the context sharing process. Lightweight semantic detection modules can be deployed at each model call chain node, and the results can be integrated through a unified risk management center.

[0124] The protection method provided by the application has the following beneficial effects.

[0125] (1) In terms of the introduction of a dynamic semantic analysis model in the MCP protocol request, a lightweight TinyBERT model is used to dynamically model the request text and context during the MCP protocol call process, and output a risk score. Advantage: Compared with the existing static protection method based on rule matching, the application has semantic understanding ability and can identify obfuscated or transformed prompt injection attacks, significantly improving the detection accuracy of new attacks.

[0126] (2) In terms of the context-aware correction mechanism, on the basis of the initial risk score output by the model, the historical context (including user identity, authentication status and tool call chain) delivered by the MCP protocol is combined to dynamically correct the score. Advantage: Unlike traditional isolated detection methods that analyze each item separately, the application can capture attack patterns across sessions and tools, effectively reducing false positives and ensuring system stability in complex interaction scenarios.

[0127] (3) In terms of layered defense strategy, according to the revised risk score , the MCP request is divided into high-risk, medium-risk and low-risk categories, and graded protection measures such as blocking, sandbox execution and normal release are taken. Advantage: Compared with the "one-size-fits-all" blocking mechanism, the application balances security and availability while ensuring security, achieving a balance between security and availability.

[0128] (4) In terms of blockchain storage and attack tracing mechanism, the key information of high-risk requests (including IP, timestamp, context hash value and risk score) is hashed and stored in the blockchain, achieving tamper-proof storage. Advantage: Compared with traditional log files, the application has higher credibility and transparency, providing a reliable basis for subsequent auditing and compliance, meeting the needs of high-security industries such as finance, government affairs and enterprise data protection.

[0129] (5) Incremental learning and model fine-tuning mechanism, the system supports collecting new attack samples in actual operation, and incrementally fine-tuning the TinyBERT model, maintaining the ability to identify new attacks. Beneficial effects: Unlike traditional methods that require manual rule library updates, the present application can adaptively evolve, reducing operational costs while ensuring the system's ability to resist new attacks over the long term.

[0130] (6) Lightweight model design, the present application uses TinyBERT as the base model, which has much lower computational overhead than standard BERT or GPT large models, and single-request detection latency can be controlled at the millisecond level. Beneficial effects: Compared with detection schemes that rely on large models, the present application ensures high detection rates while having low latency and high concurrent processing capabilities, making it more suitable for actual deployment in AI-assisted tools and automated agent systems.

[0131] The MCP protocol injection attack protection method based on dynamic semantic analysis provided by the present application can realize real-time risk detection and layered defense of MCP requests during AI model interaction with external tools. Through the lightweight semantic model, injection risks and context tampering behaviors in MCP requests are automatically identified, and users do not need to manually configure complex rules one by one to achieve automatic protection of the entire call chain.

[0132] The present application proposes an innovative dynamic semantic analysis protection scheme for the security problems of the MCP protocol in the large language model calling process. By introducing a lightweight TinyBERT model, real-time semantic modeling and risk scoring of each MCP request and its context are performed, and context correction is performed in combination with session history to generate the final dynamic risk value. The system executes layered defense strategies based on the risk value, including blocking high-risk requests, executing medium-risk requests in a sandbox, and directly releasing low-risk requests, while writing key information of high-risk requests into a blockchain for evidence, realizing non-tamperable traceability of security incidents.

[0133] In the present application, developers do not need to manually write rules or maintain complex blacklists one by one, but only need to deploy the present patent device at the MCP protocol entrance to achieve automatic protection of the entire model calling chain.

[0134] The present application can automatically identify attack patterns through semantic analysis without manually updating the rule library one by one; dynamically corrects risk scores in combination with historical session and user permission information, and can capture complex attacks across requests; based on lightweight model reasoning, single detection latency is controlled at the millisecond level, meeting online protection needs.

[0135] Figures 1 to 4 any technical feature in the embodiments corresponding to any one of the preceding claims also applies to the embodiments of the present applicationFigures 5 to 7 The corresponding embodiments, subsequent similarities are not described.

[0136] The above describes a model context protocol injection attack protection method based on dynamic semantic analysis in an embodiment of the application. The following describes a device or apparatus for executing the method.

[0137] Figure 5 FIG. 1 is a structural block diagram of a model context protocol injection attack protection device based on dynamic semantic analysis in an embodiment. Referring to Figure 5 The device comprises:

[0138] A data acquisition and preprocessing module 501 is configured to acquire request data corresponding to a calling request initiated by a user through a model context protocol, and preprocess the request data to obtain preprocessed request data.

[0139] A scoring module 502 is configured to perform semantic vectorization on request text and context history information in the request data by using a lightweight bidirectional encoder representation model, to output an initial risk score.

[0140] A correction module 503 is configured to correct the initial risk score according to context history information carried in the model context protocol, to obtain a final risk score after correction.

[0141] A protection module 504 is configured to make a layered defense decision according to the final risk score, determine risk classification information corresponding to each request data, and execute a protection action corresponding to each risk classification information.

[0142] In the embodiment, based on the connection relationship between the modules as shown in Figure 5 The above modules can be matched to improve the accuracy of identifying protocol injection attacks.

[0143] In another embodiment, a computer device, which can be a server, is provided. An internal structure diagram of the computer device can be as shown in Figure 6As shown in the figure. It includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor is used to provide computing and control ability. The memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database is used to store related data. The input / output interface is used to exchange information between the processor and external devices. The communication interface is used to communicate with external terminals through network connection. The computer program is executed by the processor to realize various methods in the above embodiments.

[0144] In still another embodiment, a computer device, such as a terminal, is provided, and its internal structure diagram can be as shown in the figure. Figure 7 As shown in the figure. It includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor is used to provide computing and control ability. The memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface is used to exchange information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals, and wireless communication can be realized through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to realize various methods in the above embodiments.

[0145] Those skilled in the art can understand that Figure 6 and Figure 7 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. It can also include more or less components than those shown in the figure, or combine certain components, or have a different component arrangement, so as to realize the function of the terminal or server.

[0146] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0147] Those skilled in the art can clearly understand the specific working process of the system, the device, the equipment, the module or the unit described above for the convenience and brevity, and the corresponding process in the foregoing method embodiments can be referred to, and details are not described herein.

[0148] In several embodiments provided in the embodiments of the present application, it should be understood that the disclosed system, device, equipment or method can be implemented in other manners. For example, the described device embodiments are merely schematic, and the division of the modules or units is merely a logical function division, and there can be another division manner in actual implementation. For example, a plurality of modules or units can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or modules, and can be electrical, mechanical or in other forms.

[0149] The modules described as separated components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, that is, can be located in one place, or can be distributed on a plurality of network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0150] In addition, each functional module in each embodiment of the present application can be integrated in one processing module, or each module can be physically present alone, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software functional module. When the integrated module is realized in the form of a software functional module and sold or used as an independent product, it can be stored in a computer readable storage medium.

[0151] In the foregoing embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product.

[0152] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that the computer can store or be integrated into a data storage device such as a server, data center, etc. containing one or more available media sets. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0153] The above describes the technical solutions provided by the embodiments of the present application in detail. The principles and implementation manners of the embodiments of the present application are described by applying specific examples. The above examples are only used to help understand the method and core idea of the embodiments of the present application; at the same time, for those skilled in the art, according to the idea of the embodiments of the present application, the specific implementation manners and application ranges will be changed, and the above description should not be understood as a limitation of the embodiments of the present application.

Claims

1. A method for protecting against model context protocol injection attacks based on dynamic semantic analysis, characterized in that, The method comprises: obtaining request data corresponding to a call request initiated by a user through a model context protocol, preprocessing the request data to obtain preprocessed request data; performing semantic vectorization on the request text and the context historical information in the request data through a lightweight bidirectional encoder representation model to output an initial risk score; correcting the initial risk score according to the context historical information carried in the model context protocol to obtain a final risk score after correction; making a layered defense decision according to the final risk score to determine risk classification information corresponding to each request data and performing a protection action corresponding to each risk classification information.

2. The method of claim 1, wherein, After the step of making a layered defense decision according to the final risk score to determine risk classification information corresponding to each request data and performing a protection action corresponding to each risk classification information, the method further comprises: obtaining request address information, timestamp information, the context historical information and the final risk score corresponding to the risk classification information; generating evidence data according to the request address information, the timestamp information, the context historical information and the final risk score; writing the evidence data into a blockchain and constructing an attack graph according to the evidence data.

3. The method of claim 1, wherein, After the step of making a layered defense decision according to the final risk score to determine risk classification information corresponding to each request data and performing a protection action corresponding to each risk classification information, the method further comprises: determining prompt information associated with the protection action for feeding back to the user; displaying the prompt information in a to-be-displayed area according to the execution state of the protection action.

4. The method of claim 1, wherein, The preprocessing of the request data to obtain preprocessed request data comprises: performing format checking and rule filtering on the request data to determine a preliminary checking result corresponding to the request data; generating preprocessed request data in the case that the preliminary checking result meets preset requirements.

5. The method of claim 1, wherein, The semantic vectorization of the request text and the context historical information through the lightweight bidirectional encoder representation model to output an initial risk score comprises: performing semantic vectorization on the request text and the context historical information to obtain a context feature vector; performing weighted summation based on the trained weight and bias parameters and the context feature vector to obtain a result after weighted summation; determining the initial risk score according to the result after weighted summation and a preset activation function.

6. The method of claim 1, wherein, The correction of the initial risk score according to the context historical information carried in the model context protocol to obtain a final risk score after correction comprises: determining a correction amount of context difference according to the context historical information carried in the model context protocol; correcting the initial risk score according to the correction amount of context difference to obtain the final risk score.

7. The method of claim 1, wherein, The hierarchical defense decision making according to the final risk score determines risk classification information corresponding to each of the request data to perform a defense action corresponding to each of the risk classification information, and includes: In the case that the risk classification information belongs to a high risk level, the defense action is determined as blocking and recording key information; In the case that the risk classification information belongs to a medium risk level, the defense action is determined as executing in a sandbox environment and limiting the calling of sensitive tools; In the case that the risk classification information belongs to a low risk level, the defense action is determined as normal release.

8. A model context protocol injection attack protection device based on dynamic semantic analysis, characterized in that, The device comprises: a data acquisition and preprocessing module configured to acquire request data corresponding to a calling request initiated by a user through a model context protocol, and to preprocess the request data to obtain preprocessed request data; a scoring module configured to perform semantic vectorization on request text and context history information in the request data by using a lightweight bidirectional encoder representation model to output an initial risk score; a correction module configured to correct the initial risk score according to the context history information carried in the model context protocol to obtain a final risk score after correction; a defense module configured to make a hierarchical defense decision according to the final risk score, determine risk classification information corresponding to each of the request data, and perform a defense action corresponding to each of the risk classification information.

9. A computer device, comprising: The computer device comprises: at least one processor, a memory; wherein the memory is configured to store program code, and the processor is configured to call the program code stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that, It comprises instructions which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 7.

Images