Banking transaction message attack processing method and apparatus

Abstract

The application provides a bank transaction message attack processing method and device, comprising: obtaining bank transaction message data, using a first pulse time coding method to encode the bank transaction message data into a bank transaction message pulse sequence; inputting the bank transaction message pulse sequence into an attack detection model to obtain an attack detection result; performing threat modeling based on the attack detection result to obtain a threat modeling result; and determining a defense strategy through a bank transaction message large language model according to the attack detection result and the threat modeling result; the application captures the timing correlation anomaly of the transaction message through the pulse neural network of the first pulse time coding, and then analyzes the attack semantics through the bank transaction message large language model to complete the threat modeling and generate the defense strategy, thereby solving the problems of high false negative rate and large response delay in the prior art, and achieving efficient transaction message attack response, accurate identification of hidden message attacks and analysis of attack intentions.

Description

Technical Field

[0001] This invention belongs to the fields of artificial intelligence and information security technology, and in particular relates to a method and apparatus for handling bank transaction message attacks. Background Technology

[0002] Bank transaction messages are the core carriers of business processing, and the mainstream standard adopts the ISO 8583 format. Their security directly determines the security of bank funds and data. Attacks against transaction messages, such as tampering, forgery, replay, and abnormal injection, are characterized by strong time sequence, high concealment, and diverse attack patterns.

[0003] In existing technologies, traditional rule-based defense methods are difficult to capture time-series correlation anomalies, have a high false negative rate and large response delays, and are difficult to effectively deal with increasingly complex bank transaction message attacks. Summary of the Invention

[0004] This invention provides a method for handling bank transaction message attacks. It captures temporal correlation anomalies in transaction messages using a pulse neural network with first-pulse time coding, then parses the attack semantics to complete threat modeling, and determines defense strategies using a large language model of bank transaction messages. This solves the problems of high false negative rates and large response delays in existing technologies, enabling efficient transaction message attack response, accurate identification of covert message attacks, and parsing of attack intent. The method includes: The bank transaction message data is obtained by using the first pulse time encoding method to encode the bank transaction message data into a bank transaction message pulse sequence; The attack detection model is input into the pulse sequence of bank transaction messages to obtain the attack detection result; the attack detection result includes the attack type, attack severity, and abnormal message information; the attack detection model is obtained by training a spiking neural network based on the pulse sequence of historical bank transaction messages. Threat modeling is performed based on the attack detection results to obtain threat modeling results; the threat modeling results include attack path, attack intent and prediction information of subsequent attack actions. Based on the attack detection results and threat modeling results, a defense strategy is determined using a large language model of bank transaction messages; the large language model of bank transaction messages is obtained by training a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies.

[0005] This invention provides a bank transaction message attack processing device. It captures temporal correlation anomalies in transaction messages through a pulse neural network with first-pulse time coding, then parses attack semantics to complete threat modeling, and determines defense strategies using a large language model of bank transaction messages. This solves the problems of high false negative rate and large response delay in existing technologies, enabling efficient transaction message attack response, accurate identification of covert message attacks, and parsing of attack intent. The bank transaction message attack processing device includes: The data acquisition module is used to acquire bank transaction message data and uses the first pulse time encoding method to encode the bank transaction message data into a bank transaction message pulse sequence. The attack detection module is used to input the pulse sequence of bank transaction messages into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity, and abnormal message information; the attack detection model is obtained by training a spiking neural network based on the pulse sequence of historical bank transaction messages. The threat modeling module is used to perform threat modeling based on attack detection results and obtain threat modeling results; the threat modeling results include attack path, attack intent and prediction information of subsequent attack actions; The defense strategy determination module is used to determine the defense strategy based on the attack detection results and threat modeling results, using a large language model of bank transaction messages; the large language model of bank transaction messages is obtained by training a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies.

[0006] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned bank transaction message attack processing method.

[0007] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned bank transaction message attack processing method.

[0008] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the aforementioned bank transaction message attack processing method.

[0009] In this embodiment of the invention, bank transaction message data is acquired, and a first-pulse time encoding method is used to encode the bank transaction message data into a bank transaction message pulse sequence. The bank transaction message pulse sequence is input into an attack detection model to obtain an attack detection result. The attack detection result includes attack type, attack severity, and abnormal message information. The attack detection model is obtained by training a spiking neural network based on historical bank transaction message pulse sequences. Threat modeling is performed based on the attack detection result to obtain a threat modeling result. The threat modeling result includes attack path, attack intent, and prediction information of subsequent attack actions. Based on the attack detection result and the threat modeling result, a defense strategy is determined through a bank transaction message large language model. The bank transaction message large language model is obtained by training a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies. This embodiment of the invention captures temporal correlation anomalies in transaction messages through a spiking neural network using first-pulse time encoding, then parses the attack semantics to complete threat modeling, and determines the defense strategy through a bank transaction message large language model. This solves the problems of high false negative rate and large response delay in existing technologies, and can achieve efficient transaction message attack response, accurately identify hidden message attacks, and parse attack intent. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a flowchart of the bank transaction message attack handling method in an embodiment of the present invention; Figure 2 This is a specific example diagram illustrating how bank transaction message data is encoded into a bank transaction message pulse sequence in an embodiment of the present invention; Figure 3 This is a specific example diagram illustrating the determination of threat modeling results in an embodiment of the present invention; Figure 4 This is a specific example diagram illustrating the determination of defense strategies corresponding to different attack types in an embodiment of the present invention; Figure 5 This is a structural example diagram of the bank transaction message attack processing device in an embodiment of the present invention; Figure 6 This is a specific example diagram of the structure of the bank transaction message attack processing device in an embodiment of the present invention; Figure 7 This is a structural diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0012] The acquisition, transmission, storage, use, and processing of data in the technical solution of this invention all comply with relevant regulations.

[0013] It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of the present invention. However, they do not mean that the applicant has used or necessarily used the solution.

[0014] As mentioned earlier, in the existing technology, traditional defense methods based on rule matching are difficult to capture time-series correlation anomalies, have a high false negative rate and a large response delay, and are difficult to effectively deal with increasingly complex bank transaction message attacks.

[0015] To address this issue, the inventors considered that Spiking Neural Networks (SNNs) have the advantages of time-series encoding and fast response, which can accurately capture message timing anomalies. Large language models can determine defense strategies based on attack semantics and threat modeling results. The collaboration between the two can complement each other's shortcomings and meet the needs of bank transaction message protection in all scenarios. Therefore, this application proposes a bank transaction message attack processing method based on the collaboration of SNN and large model.

[0016] Figure 1 This is a flowchart of the bank transaction message attack handling method in an embodiment of the present invention, as shown below. Figure 1 As shown, the bank transaction message attack handling method includes: Step 101: Obtain bank transaction message data and encode the bank transaction message data into a bank transaction message pulse sequence using the first pulse time encoding method; Step 102: Input the bank transaction message pulse sequence into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity, and abnormal message information; the attack detection model is obtained by training a spiking neural network based on the bank's historical transaction message pulse sequence. Step 103: Perform threat modeling based on the attack detection results to obtain threat modeling results; the threat modeling results include attack path, attack intent, and prediction information of subsequent attack actions; Step 104: Based on the attack detection results and threat modeling results, determine the defense strategy through the bank transaction message big language model; the bank transaction message big language model is obtained by training a general big language model based on historical attack detection results, historical threat modeling results and historical defense strategies.

[0017] Depend on Figure 1 As shown in the process, in this embodiment of the invention, bank transaction message data is acquired, and the first pulse time encoding method is used to encode the bank transaction message data into a bank transaction message pulse sequence; the bank transaction message pulse sequence is input into an attack detection model to obtain an attack detection result; the attack detection result includes attack type, attack severity, and abnormal message information; the attack detection model is obtained by training a spiking neural network based on historical bank transaction message pulse sequences; threat modeling is performed based on the attack detection result to obtain a threat modeling result; the threat modeling result includes attack path, attack intent, and prediction information of subsequent attack actions; based on the attack detection result and the threat modeling result, a defense strategy is determined through a bank transaction message large language model; the bank transaction message large language model is obtained by training a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies.

[0018] Compared to existing technologies that rely solely on rule matching and struggle to capture temporally correlated anomalies, this approach encodes bank transaction message data into pulse sequences, utilizes a trained spiking neural network to obtain attack detection results, analyzes attack semantics to complete threat modeling, and determines defense strategies using a large language model of bank transaction messages. This enables real-time and accurate detection, in-depth threat analysis, and proactive defense against bank transaction message attacks, thereby improving the accuracy and response efficiency of bank transaction message attack detection. It also enables attack path reconstruction, intent analysis, and precise defense, ensuring the security of bank transaction messages.

[0019] Figure 2 This is a specific example diagram illustrating how bank transaction message data is encoded into a bank transaction message pulse sequence in an embodiment of the present invention. Figure 2 As shown, to obtain bank transaction message data, the first pulse time encoding method is used to encode the bank transaction message data into a bank transaction message pulse sequence, which may include: Step 201: Based on the bank transaction message data, determine the timing characteristics and content characteristics of the bank transaction message; the timing characteristics include the message sending time and message circulation duration; Step 202: Using the first pulse time coding method, the timing features are converted into timing pulse signals, and the content features are converted into content pulse signals; Step 203: Merge the timing pulse signal and the content pulse signal to obtain the bank transaction message pulse sequence.

[0020] In a specific embodiment, bank transaction message data is obtained, and the first pulse time encoding method is used to encode the bank transaction message data into a bank transaction message pulse sequence: Based on bank transaction message data, determine the timing and content characteristics of the bank transaction messages: The system acquires real-time and historical transaction message data in the ISO8583 standard format from banks. After data cleaning, standardization verification, and sensitive information desensitization, it extracts time-series and content features. The time-series features include message sending time, message flow duration of request-response-confirmation, and message sending interval. The content features include core message field features such as transaction code, transaction amount, terminal ID, field length, field value range, and field logical relationships.

[0021] The first pulse time coding method is used to convert the timing features into timing pulse signals and the content features into content pulse signals. Based on the Time to First Spike (TTFS) encoding rule, the message sending time and circulation duration are mapped to the pulse trigger time, and the message sending interval is converted into the pulse frequency to form a time-series pulse signal. The normal transaction time sequence is a fixed regular pulse, while the replay and abnormal injection attack time sequence is an abnormal and disordered pulse. The transaction code and terminal ID are mapped to the pulse phase, the amount value is mapped to the number of pulses, and field misalignment, tampering, and length deviation are mapped to the pulse phase offset to form a content pulse signal. The encoding threshold and pulse weight are optimized by the large model to improve the identification of abnormal features.

[0022] By combining the timing pulse signal and the content pulse signal, a bank transaction message pulse sequence is obtained: An attention mechanism is used to fuse the features of temporal pulse signals and content pulse signals, enhance the pulse features corresponding to abnormal time sequences and abnormal fields, remove redundant pulse information, and generate bank transaction message pulse sequences with uniform dimensions that are adapted to the input of spiking neural networks, providing standard input data for subsequent attack detection.

[0023] In step 102, the bank transaction message pulse sequence is input into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity and abnormal message information; the attack detection model is obtained by training a spiking neural network based on the bank's historical transaction message pulse sequence.

[0024] In a specific embodiment, the pulse sequence of bank transaction messages is input into the attack detection model to obtain attack detection results containing attack type, attack severity, and abnormal message information. The attack detection model is a spiking neural network trained based on the pulse sequence of historical bank transaction messages, as detailed below: Construction and pre-training of attack detection models: The attack detection model adopts a three-layer SNN architecture adapted to the pulse sequence processing of transaction messages: the input layer has 1024 neurons, corresponding to the dimension of the fused bank transaction message pulse sequence; the hidden layer uses 512 LIF neurons to simulate the pulse firing characteristics of biological neurons, and the activation function is an improved version of the ReLU function adapted to pulse timing coding; the output layer has 6 neurons, corresponding to "normal messages" and 5 typical attack messages, such as message tampering, message forgery, replay attack, anomaly injection, and field misalignment, and the output is the recognition probability of each type of attack.

[0025] The model training adopts a three-layer collaborative model of supervised training + unsupervised learning + continuous learning, with large models providing full-process optimization assistance. Supervised training phase: The Temp-BP time-series backpropagation algorithm is adopted, based on a dataset of 1.2 million labeled historical transaction message pulse sequences, including 1.08 million normal messages and 120,000 attack messages; the model is trained, and the large model assists the SNN in optimizing synaptic weights by inputting the complex features of the messages it extracts, while also optimizing the training hyperparameters; Unsupervised learning stage: Utilizing the Spike-Timing-Dependent Plasticity (STDP) mechanism of SNN, the model autonomously learns the spike timing and content patterns of normal transaction messages. When an abnormal spike sequence deviating from the normal pattern is detected, an alarm is automatically triggered. The large model performs in-depth analysis on the abnormal sequence, determines the approximate type of unknown attack and the core of the anomaly, and generates temporary labels, which are fed back to the SNN to supplement the training dataset. Continuous learning phase: The large model captures real-time updates of message formats and the latest attack alerts from the bank's transaction system, extracts core features of new attacks, and guides the SNN to adapt to new attacks and new message formats by fine-tuning synaptic weights, without the need for full retraining.

[0026] Real-time attack detection execution: The bank transaction message pulse sequence generated in step 101 is input into the trained SNN attack detection model. The model analyzes the temporal pattern and content characteristics of the pulse sequence through the pulse firing and transmission process of LIF neurons, matches the attack type-pulse feature correspondence database, and identifies unknown abnormal pulse sequences through unsupervised learning to complete real-time attack detection of transaction messages.

[0027] Output attack detection results: The model outputs standardized attack detection results, which include: attack type, such as normal / packet tampering / packet forgery / replay attack / abnormal injection / field misalignment; attack severity, such as general / high / critical / urgent; and abnormal packet information, such as abnormal field position, abnormal timing characteristics, and original packet unique identifier.

[0028] Figure 3 This is a specific example diagram illustrating the determination of threat modeling results in an embodiment of the present invention, such as... Figure 3 As shown, threat modeling based on attack detection results yields threat modeling results, which may include: Step 301: Based on the abnormal message information in the attack detection results, reconstruct the attack path; Step 302: Based on the attack type and severity in the attack detection results, analyze the attack intent; Step 303: Based on the attack path and attack intent, predict the actions that may be performed after the attack to obtain the attack subsequent action prediction information.

[0029] In a specific embodiment, threat modeling is performed based on the attack detection results to obtain a threat modeling result that includes attack path, attack intent, and prediction information of subsequent attack actions. The threat modeling result includes attack path, attack intent, and prediction information of subsequent attack actions. The specific process is as follows: Based on the abnormal packet information in the attack detection results, the attack path can be reconstructed: Based on the abnormal message information output by the SNN attack detection model, the standard flow knowledge base of the bank transaction chain is retrieved. Combined with the attack node characteristics corresponding to the abnormal pulse characteristics, the execution chain of the attack is traced node by node to restore the complete path of the attack from initiation to detection.

[0030] For example, when the SNN detects a continuous sequence of "abnormal pulse in terminal ID field → abnormal pulse in transaction code → sudden change in the number of pulses in amount field", the attack path can be reconstructed as "attacker forges legitimate terminal ID → sends fake transaction request through illegal terminal → transaction gateway forwards to core system → attacker tampers with transaction amount field"; when the feature of "repeatedly issuing historical message pulse sequence" is detected, the attack path can be reconstructed as "attacker intercepts historical legitimate transaction messages → bypasses authentication → repeatedly sends to transaction gateway".

[0031] Based on the attack type and severity in the attack detection results, the attack intent can be analyzed: Based on the attack type, attack severity, and the reconstructed attack path, combined with the mapping relationship of the bank's core assets, the core intent of the attack is analyzed through logical reasoning, and the level of harm of the attack is clarified.

[0032] Specifically: If the attack type is message tampering and the abnormal field is transaction amount, the attack intent is analyzed as "tampering with transaction amount to steal bank or customer funds", and the harm level is determined to be severe. If the attack type is message forgery and the abnormal fields are terminal ID and account, the attack intent is analyzed as "forging a legitimate identity to obtain illegal transaction access permissions", and the harm level is determined to be high. If the attack type is a replay attack, the attack intent is analyzed as "exploiting vulnerabilities in historical legitimate packets to complete unauthorized illegal transactions", and the harm level is determined to be severe. If the attack type is an abnormal injection attack, the attack intent is analyzed as "inserting illegal messages to disrupt the transaction sequence and interfere with the normal operation of the transaction system", and the hazard level is determined to be urgent. If the attack type is a field misalignment attack, and the attack intent is analyzed as "disrupting message parsing logic, causing transaction data corruption or system failure", the severity level is determined to be high.

[0033] Based on the attack path and attack intent, predict the possible subsequent actions of the attack to obtain the following attack action prediction information: By combining historical attack behavior evolution patterns and a database of typical follow-up actions of similar attacks, and based on the reconstructed attack paths and analyzed attack intentions, we can infer the attacker's next possible action and its probability of occurrence, and generate attack follow-up action prediction information.

[0034] For example: Regarding the attack of "tampering with the amount of a single transaction", the predicted subsequent action is "initiating a batch of transactions with the same amount to tamper with, attempting to transfer illegally obtained funds", with a probability of 92%; Regarding the attack of "initiating transactions by forging terminal IDs", the predicted subsequent actions are "batch generation of forged terminal IDs and initiation of concurrent transactions by multiple accounts", with an 87% probability of occurrence; Regarding the "replay attack," the predicted follow-up actions are "expanding the time range of replaying messages and attempting to attack interfaces of different transaction types," with an 83% probability of occurrence. Regarding "abnormal injection attacks," the predicted follow-up actions are "increasing the frequency of injection messages and attempting to inject malicious code," with a probability of 79%.

[0035] By integrating the above-mentioned attack paths, attack intentions, and predictions of subsequent attack actions, a complete threat modeling result is formed, providing a basis for the formulation of subsequent defense strategies.

[0036] In this embodiment, based on the attack detection results and threat modeling results, a defense strategy is determined using a large language model of bank transaction messages, which may include: By using a large language model of bank transaction messages, and based on threat modeling results and attack detection results, defense strategies corresponding to different attack types are determined; the attack types include message tampering attacks, replay attacks, and message forgery attacks.

[0037] Figure 4 This is a specific example diagram illustrating the determination of defense strategies corresponding to different attack types in an embodiment of the present invention, such as... Figure 4 As shown, determining the defense strategies corresponding to different attack types can include: Step 401: If the attack type is a message tampering attack, determine the defense strategy as blocking the transmission of the message and generating an abnormal alarm message; Step 402: If the attack type is a replay attack, determine the defense strategy as intercepting duplicate packets and recording the attack source information; Step 403: If the attack type is a message forgery attack, determine the defense strategy as rejecting the transaction request and freezing the corresponding terminal's transaction permissions.

[0038] In a specific embodiment, a defense strategy is determined based on the threat modeling results and attack detection results using a large language model of bank transaction messages. This large language model is trained on a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies. The large language model of bank transaction messages, combined with the attack type, generates a defense strategy adapted to the requirements of bank transactions. The specific process is as follows: If the attack type is a message tampering attack, the defense strategy is to block the transmission of the message and generate an abnormal alarm message: When the large model determines that the attack type is a message tampering attack, it immediately generates a message blocking instruction and sends it to the transaction gateway and firewall in real time to block the transmission of the abnormal message to the bank's core business system and prevent the execution of the tampered transaction instructions. At the same time, it generates standardized abnormal alarm information, clearly marking the location of abnormal fields, suspected tampered content, attack severity level and financial risk warning, and pushes it to the terminal of the bank's operation and maintenance personnel. The large model automatically records the original abnormal message data of the attack, attack time, blocking effect and other information throughout the entire process, and retains it after anonymization for subsequent model training and threat model optimization.

[0039] If the attack type is a replay attack, the defense strategy is to intercept duplicate packets and record the attack source information: When the large model determines that the attack type is a replay attack, it generates a duplicate message interception instruction and sends it to the transaction gateway to automatically intercept current and subsequent duplicate historical messages from the same attack source, while ensuring the normal flow of other normal transaction messages on the same terminal; it fully records the attack source's IP address, terminal unique identifier, time range of replay messages, transaction types involved, and other attack source characteristic information, and adds it to the bank's transaction system temporary restriction database.

[0040] If the attack type is a message forgery attack, the defense strategy is to reject the transaction request and freeze the corresponding terminal's transaction permissions: When the large-scale model determines that the attack type is a message forgery attack, it immediately generates a transaction rejection instruction, rejecting all transaction requests corresponding to the forged message and preventing illegal fund transfers. At the same time, it freezes the full-channel transaction permissions of the suspected illegal terminal, prohibiting the terminal from initiating any transaction operations before unfreezing. It generates an alarm message containing the forged terminal ID, forged core fields, and attack severity level and pushes it to the operation and maintenance personnel. The terminal's transaction permissions can only be restored after the operation and maintenance personnel complete the terminal's legitimacy verification and issue an unfreezing instruction. The large-scale model synchronizes the forged terminal's characteristic information to the bank's entire transaction protection system to achieve cross-branch defense.

[0041] In this embodiment, after determining the defense strategy based on the attack detection results and threat modeling results using the large language model of bank transaction messages, it may include: The attack detection model is optimized based on the pulse sequence of bank transaction messages and the attack detection results. Based on the attack detection results, threat modeling results, and defense strategies, the large language model of the bank transaction message is optimized.

[0042] In a specific embodiment, after determining the defense strategy based on the attack detection results and threat modeling results using the bank transaction message big language model, a continuous optimization process is executed for both the attack detection model and the bank transaction message big language model. This ensures that the two models always adapt to the dynamic changes in bank transaction message format updates, attack pattern evolution, and transaction system upgrades. The specific process is as follows: Based on the pulse sequence of bank transaction messages and the attack detection results, the attack detection model is optimized: The incremental learning mechanism of SNN is adopted to dynamically optimize the attack detection model based on the real-time generated bank transaction message pulse sequence and attack detection results, without the need for full retraining. The specific process is as follows: Attack Feature Mining and Problem Localization: Weekly batch analysis of full attack logs throughout the entire process, combined with corresponding bank transaction message pulse sequences, to mine the core pulse features, abnormal field features, and timing features of new message attacks. At the same time, it identifies cases of missed and false alarms in existing models, such as false alarms due to timing deviations caused by network fluctuations and missed alarms due to tampering with new fields, and generates model optimization suggestions.

[0043] SNN Incremental Training and Parameter Tuning: The extracted novel attack features and optimization suggestions are fed back to the SNN attack detection model. The SNN utilizes its own STDP synaptic plasticity mechanism to complete incremental training by fine-tuning the synaptic weights and impulse detection threshold.

[0044] Feature library and unsupervised module updates: Synchronously update the correspondence between attack type, pulse feature, and abnormal field / time series; adjust the judgment threshold of normal transaction message pulse mode in the SNN unsupervised learning module to improve the ability to identify unknown zero-day message attacks.

[0045] Based on the attack detection results, threat modeling results, and defense strategies, the large language model of the bank transaction message is optimized: Scenario knowledge base update: The bank transaction message big language model obtains real-time message format update information from the bank transaction system and the latest attack alarm data in the industry. It updates its own ISO8583 message format specification library, historical attack case library and bank transaction flow process knowledge base, and supplements the attack paths, attack intentions and typical follow-up action rules of new attacks.

[0046] Incremental model fine-tuning: Based on the newly added attack detection results, threat modeling results, and defense strategy execution effect data, the bank transaction message big language model is incrementally fine-tuned to optimize its message feature extraction, logical reasoning, attack intent parsing, and defense strategy generation capabilities.

[0047] Threat Model and Defense Strategy Optimization: The bank transaction message big language model is used to simulate and test the updated threat model, simulating mixed scenarios of multiple message attack types and new zero-day attack scenarios. Vulnerabilities in the threat model are discovered and optimization suggestions are generated. At the same time, based on the actual execution effect of the defense strategy, the defense level, blocking rules and database validity period for different attack types are adjusted to improve the accuracy of the defense strategy.

[0048] Through the aforementioned collaborative optimization mechanism, the model does not require frequent manual rule updates and can continuously adapt to the dynamic changes in bank transaction messages, maintaining optimal defense performance in the long term.

[0049] This invention also provides a bank transaction message attack processing device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the bank transaction message attack processing method, the implementation of this device can refer to the implementation of the bank transaction message attack processing method; repeated details will not be elaborated further.

[0050] Figure 5 This is a structural example diagram of the bank transaction message attack processing device in an embodiment of the present invention, such as... Figure 5 As shown, the bank transaction message attack processing device includes: The data acquisition module 501 is used to acquire bank transaction message data and uses the first pulse time encoding method to encode the bank transaction message data into a bank transaction message pulse sequence. The attack detection module 502 is used to input the pulse sequence of bank transaction messages into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity, and abnormal message information; the attack detection model is obtained by training a spiking neural network based on the pulse sequence of historical bank transaction messages. The threat modeling module 503 is used to perform threat modeling based on the attack detection results and obtain threat modeling results; the threat modeling results include attack path, attack intent and prediction information of subsequent attack actions. The defense strategy determination module 504 is used to determine the defense strategy based on the attack detection results and threat modeling results through the bank transaction message big language model; the bank transaction message big language model is obtained by training a general big language model based on historical attack detection results, historical threat modeling results and historical defense strategies.

[0051] In one embodiment, the data acquisition module 501 is specifically used for: Based on bank transaction message data, determine the timing and content characteristics of the bank transaction messages; the timing characteristics include the message sending time and message circulation duration. The timing features are converted into timing pulse signals and the content features are converted into content pulse signals using the first pulse time coding method. By fusing the timing pulse signal and the content pulse signal, a bank transaction message pulse sequence is obtained.

[0052] In one embodiment, the threat modeling module 503 is specifically used for: The attack path can be reconstructed based on the abnormal message information in the attack detection results; Based on the attack type and severity in the attack detection results, the attack intent is analyzed. Based on the attack path and attack intent, the possible subsequent actions of the attack are predicted, thus obtaining the prediction information of the subsequent attack actions.

[0053] In one embodiment, the defense strategy determination module 504 is specifically used for: By using a large language model of bank transaction messages, and based on threat modeling results and attack detection results, defense strategies corresponding to different attack types are determined; the attack types include message tampering attacks, replay attacks, and message forgery attacks.

[0054] In one embodiment, the defense strategy determination module 504 is specifically used for: If the attack type is a message tampering attack, the defense strategy is to block the transmission of the message and generate an abnormal alarm message. If the attack type is a replay attack, the defense strategy is to intercept duplicate packets and record the attack source information. If the attack type is a message forgery attack, the defense strategy is to reject the transaction request and freeze the corresponding terminal's transaction permissions.

[0055] Figure 6 This is a specific example diagram of the structure of the bank transaction message attack processing device in an embodiment of the present invention, as shown below. Figure 6 As shown in one embodiment, Figure 5 The bank transaction message attack processing device shown in the embodiment of the present invention may further include: an optimization module 601.

[0056] In one embodiment, the optimization module 601 is specifically used for: The attack detection model is optimized based on the pulse sequence of bank transaction messages and the attack detection results. Based on the attack detection results, threat modeling results, and defense strategies, the large language model of the bank transaction message is optimized.

[0057] Based on the aforementioned inventive concept, such as Figure 7 As shown, the present invention also proposes a computer device 700, including a memory 710, a processor 720, and a computer program 730 stored in the memory 710 and executable on the processor 720. When the processor 720 executes the computer program 730, it implements the aforementioned bank transaction message attack processing method.

[0058] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned bank transaction message attack processing method.

[0059] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the aforementioned bank transaction message attack processing method.

[0060] In this embodiment of the invention, bank transaction message data is acquired, and a first-pulse time encoding method is used to encode the bank transaction message data into a bank transaction message pulse sequence. The bank transaction message pulse sequence is input into an attack detection model to obtain an attack detection result. The attack detection result includes attack type, attack severity, and abnormal message information. The attack detection model is obtained by training a spiking neural network based on historical bank transaction message pulse sequences. Threat modeling is performed based on the attack detection result to obtain a threat modeling result. The threat modeling result includes attack path, attack intent, and prediction information of subsequent attack actions. Based on the attack detection result and the threat modeling result, a defense strategy is determined through a bank transaction message large language model. The bank transaction message large language model is obtained by training a general large language model based on historical attack detection results, historical threat modeling results, and historical defense strategies. This embodiment of the invention captures temporal correlation anomalies in transaction messages through a spiking neural network using first-pulse time encoding, then parses the attack semantics to complete threat modeling, and determines the defense strategy through a bank transaction message large language model. This solves the problems of high false negative rate and large response delay in existing technologies, and can achieve efficient transaction message attack response, accurately identify hidden message attacks, and parse attack intent.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for handling bank transaction message attacks, characterized in that, include: The bank transaction message data is obtained by using the first pulse time encoding method to encode the bank transaction message data into a bank transaction message pulse sequence; The bank transaction message pulse sequence is input into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity and abnormal message information. The attack detection model is obtained by training a spiking neural network based on the pulse sequence of historical bank transaction messages. Threat modeling is performed based on attack detection results to obtain threat modeling results; The threat modeling results include attack paths, attack intentions, and predictions of subsequent attack actions. Based on the attack detection results and threat modeling results, defense strategies are determined using a large language model of bank transaction messages. The aforementioned bank transaction message big language model is obtained by training a general big language model based on historical attack detection results, historical threat modeling results, and historical defense strategies.

2. The method as described in claim 1, characterized in that, The bank transaction message data is acquired and encoded into a bank transaction message pulse sequence using the first pulse time encoding method, including: Based on bank transaction message data, determine the timing and content characteristics of the bank transaction messages; the timing characteristics include the message sending time and message circulation duration. The timing features are converted into timing pulse signals and the content features are converted into content pulse signals using the first pulse time coding method. By fusing the timing pulse signal and the content pulse signal, a bank transaction message pulse sequence is obtained.

3. The method as described in claim 1, characterized in that, Threat modeling is performed based on attack detection results, yielding threat modeling results including: The attack path can be reconstructed based on the abnormal message information in the attack detection results; Based on the attack type and severity in the attack detection results, the attack intent is analyzed. Based on the attack path and attack intent, the possible subsequent actions of the attack are predicted, thus obtaining the prediction information of the subsequent attack actions.

4. The method as described in claim 1, characterized in that, Based on the attack detection results and threat modeling results, defense strategies are determined using a large language model of bank transaction messages, including: By using a large language model of bank transaction messages, and based on threat modeling results and attack detection results, defense strategies corresponding to different attack types are determined; the attack types include message tampering attacks, replay attacks, and message forgery attacks.

5. The method as described in claim 4, characterized in that, Determine the defense strategies corresponding to different attack types, including: If the attack type is a message tampering attack, the defense strategy is to block the transmission of the message and generate an abnormal alarm message. If the attack type is a replay attack, the defense strategy is to intercept duplicate packets and record the attack source information. If the attack type is a message forgery attack, the defense strategy is to reject the transaction request and freeze the corresponding terminal's transaction permissions.

6. The method as described in claim 1, characterized in that, After determining the defense strategy based on the attack detection results and threat modeling results using a large language model of bank transaction messages, the strategy includes: The attack detection model is optimized based on the pulse sequence of bank transaction messages and the attack detection results; Based on the attack detection results, threat modeling results, and defense strategies, the large language model of the bank transaction message is optimized.

7. A bank transaction message attack processing device, characterized in that, include: The data acquisition module is used to acquire bank transaction message data and uses the first pulse time encoding method to encode the bank transaction message data into a bank transaction message pulse sequence. The attack detection module is used to input the pulse sequence of bank transaction messages into the attack detection model to obtain the attack detection result; the attack detection result includes the attack type, attack severity, and abnormal message information. The attack detection model is obtained by training a spiking neural network based on the pulse sequence of historical bank transaction messages. The threat modeling module is used to perform threat modeling based on attack detection results and obtain the threat modeling results. The threat modeling results include attack paths, attack intentions, and predictions of subsequent attack actions. The defense strategy determination module is used to determine the defense strategy based on the attack detection results and threat modeling results, using a large language model of bank transaction messages. The aforementioned bank transaction message big language model is obtained by training a general big language model based on historical attack detection results, historical threat modeling results, and historical defense strategies.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images