Deserialization vulnerability detection method, device and equipment for machine learning model

Abstract

The invention provides a deserialization vulnerability detection method, device and equipment for a machine learning model, and the method comprises the steps: carrying out the dynamic tracking processing and static analysis processing of a loading process of a target machine learning model in an isolation environment, and determining a plurality of function call sequences of the model; matching the plurality of function call sequences based on the target machine learning model with the plurality of white list function call sequences, and identifying whether the target machine learning model has a function call sequence with a potential risk; if the function call sequence with the potential risk exists, vulnerability detection is conducted on the function call sequence with the potential risk, and whether vulnerability exists in the function call sequence with the potential risk or not is determined. Through dynamic tracking and static analysis of the machine learning model, whether a function call sequence with potential risks or a known vulnerability mode exists in the target machine learning model is checked, and serialization and deserialization vulnerabilities in the machine learning model can be accurately identified and verified.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to a method, device and equipment for detecting deserialization vulnerabilities of a machine learning model. Background Art

[0002] In the current cloud computing architecture, application layer common components play a vital role. They not only improve the deployment and maintenance efficiency of cloud services, but also greatly enrich the end-user experience. Although the introduction of cloud platform application layer common components brings convenience to development and operation and maintenance, it is also accompanied by the emergence of security issues. Taking machine learning models as an example, although its security issues such as adversarial attacks and data poisoning have attracted widespread attention, the potential backdoor logic vulnerabilities behind the model have not received enough attention. Once these vulnerabilities in machine learning models are maliciously exploited, they will not only cause logical anomalies, but may also trigger more serious security incidents, such as deserialization code execution. In response to this problem, although academia and industry have begun to study, including the deserialization backdoor vulnerability detection method proposed by AI security company Hidden Layer for models, and the fickling tool released by Trail of Bits, focusing on serialization security issues in Python Pickle files. However, the existing machine learning model vulnerability detection methods still have many challenges, including scalability, scenario adaptation capabilities, and the ability to detect call logic anomalies during the model deployment phase, so how to accurately determine the deserialization vulnerability of machine learning models has become a technical issue that cannot be underestimated. Summary of the invention

[0003] In view of this, the purpose of this application is to provide a deserialization vulnerability detection method, device and equipment for a machine learning model. By dynamically tracking and statically analyzing the machine learning model, it is possible to check whether there are potential risk function call sequences or known vulnerability patterns in the target machine learning model. This can accurately identify and verify serialization and deserialization vulnerabilities in the machine learning model, and timely discover and prevent possible security threats.

[0004] The present application embodiment provides a method for detecting a deserialization vulnerability of a machine learning model, and the method comprises:

[0005] Performing dynamic tracking and static analysis on the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model;

[0006] Based on matching multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences, identifying whether the target machine learning model has function call sequences with potential risks;

[0007] If there is a function call sequence with potential risks, a vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks.

[0008] In a possible implementation, the loading process of the target machine learning model is dynamically tracked and statically analyzed in an isolated environment to determine multiple function call sequences of the target machine learning model, including:

[0009] Loading a debugging tool into the target machine learning model, dynamically tracking the loading process of the target machine learning model in a sandbox environment based on the debugging tool, and determining function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model;

[0010] Static analysis is performed on the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model to determine multiple function call sequences of the target machine learning model.

[0011] In a possible implementation manner, for any function call sequence of the target machine learning model, the multiple function call sequences based on the target machine learning model are matched with multiple preset whitelist function call sequences to identify whether there is a function call sequence with potential risks in the target machine learning model, including:

[0012] Matching the function call sequence with multiple whitelist function call sequences, if there is a whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence does not have potential risks;

[0013] If there is no whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence is a function call sequence with potential risks for the target machine learning model.

[0014] In a possible implementation manner, if there is a function call sequence with potential risks, vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks, including:

[0015] Performing vulnerability detection on a function call sequence with potential risks of the target machine learning model based on a preset vulnerability feature, and if the function call sequence with potential risks has the vulnerability feature, marking the function call sequence with potential risks as a first identifier;

[0016] If the function call sequence with potential risks does not have the vulnerability feature, the function call sequence is marked as a second identifier.

[0017] In a possible implementation manner, after performing vulnerability detection on the function call sequence with potential risks of the target machine learning model and determining whether the function call sequence with potential risks has a vulnerability, the deserialization vulnerability detection method further includes:

[0018] Perform risk assessment, locate the vulnerability, and push repair suggestions for the function call sequence with potential risks that has the vulnerability, and generate a vulnerability detection report for the target machine learning model.

[0019] In a possible implementation, multiple whitelist function call sequences are determined by the following steps:

[0020] Get multiple standard function call sequences of multiple standard machine learning models;

[0021] Deduplication processing is performed on the plurality of standard function call sequences, and the plurality of standard function call sequences after deduplication processing are determined as a plurality of whitelist function call sequences.

[0022] In a possible implementation manner, after matching the multiple function call sequences based on the target machine learning model with the preset multiple whitelist function call sequences and identifying whether the target machine learning model has a function call sequence with potential risks, the deserialization vulnerability detection method further includes:

[0023] If there is no function call sequence with potential risks, it is determined that the target machine learning model has no security risks.

[0024] The embodiment of the present application also provides a deserialization vulnerability detection device for a machine learning model, the deserialization vulnerability detection device comprising:

[0025] A dynamic and static analysis module, used to perform dynamic tracking and static analysis on the loading process of the target machine learning model in an isolated environment, and determine multiple function call sequences of the target machine learning model;

[0026] A matching module, used to match multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether the target machine learning model has function call sequences with potential risks;

[0027] The risk detection module is used to perform vulnerability detection on the function call sequence with potential risks if there is one, and determine whether there is a vulnerability in the function call sequence with potential risks of the target machine learning model.

[0028] An embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the deserialization vulnerability detection method of the machine learning model as described above are performed.

[0029] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the deserialization vulnerability detection method of the machine learning model as described above are executed.

[0030] The embodiments of the present application provide a method, device and equipment for detecting deserialization vulnerabilities of a machine learning model. The method for detecting deserialization vulnerabilities includes: dynamically tracking and statically analyzing the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model; matching the multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether the target machine learning model has function call sequences with potential risks; if there are function call sequences with potential risks, vulnerability detection is performed on the function call sequences with potential risks to determine whether the function call sequences with potential risks have vulnerabilities. By dynamically tracking and statically analyzing the machine learning model to check whether there are function call sequences with potential risks or known vulnerability patterns in the target machine learning model, it is possible to accurately identify and verify serialization and deserialization vulnerabilities in the machine learning model, and timely discover and prevent possible security threats.

[0031] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A flowchart of a method for detecting a deserialization vulnerability of a machine learning model provided in an embodiment of the present application;

[0034] Figure 2 A schematic diagram of a deserialization vulnerability detection method for a machine learning model provided in an embodiment of the present application;

[0035] Figure 3 One of the structural schematic diagrams of a deserialization vulnerability detection device of a machine learning model provided in an embodiment of the present application;

[0036] Figure 4 A second structural diagram of a deserialization vulnerability detection device for a machine learning model provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0039] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0040] In order to enable those skilled in the art to use the contents of this application, the following implementation method is given in combination with the specific application scenario of "detecting deserialization vulnerabilities in machine learning models". For those skilled in the art, the general principles defined here can be applied to other embodiments and application scenarios without departing from the spirit and scope of this application.

[0041] The following methods, devices, electronic devices, or computer-readable storage media of the embodiments of the present application can be applied to any scenario where a deserialization vulnerability of a machine learning model needs to be detected. The embodiments of the present application are not limited to specific application scenarios. Any solution of a deserialization vulnerability detection method, device, and equipment using a machine learning model provided by the embodiments of the present application is within the protection scope of the present application.

[0042] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of computer network security technology.

[0043] Research has found that in the current cloud computing architecture, application layer common components play a vital role. They not only improve the deployment and maintenance efficiency of cloud services, but also greatly enrich the end-user experience. Although the introduction of cloud platform application layer common components brings convenience to development and operation and maintenance, it is also accompanied by the emergence of security issues. Taking machine learning models as an example, although its security issues such as adversarial attacks and data poisoning have attracted widespread attention, the potential backdoor logic vulnerabilities behind the model have not received enough attention. Once these vulnerabilities in machine learning models are maliciously exploited, they will not only cause logical anomalies, but may also trigger more serious security incidents, such as deserialization code execution. In response to this problem, although academia and industry have begun to study it, including the deserialization backdoor vulnerability detection method proposed by AI security company Hidden Layer, and the fickling tool released by Trail of Bits, focusing on serialization security issues in Python Pickle files. However, existing machine learning model vulnerability detection methods still face many challenges, including scalability, scenario adaptability, and the ability to detect call logic anomalies during the model deployment phase. Therefore, how to accurately determine the deserialization vulnerability of the machine learning model has become a technical issue that cannot be underestimated.

[0044] Based on this, an embodiment of the present application provides a deserialization vulnerability detection method for a machine learning model. By dynamically tracking and statically analyzing the machine learning model, it is checked whether there are function call sequences with potential risks or known vulnerability patterns in the target machine learning model. It can accurately identify and verify serialization and deserialization vulnerabilities in the machine learning model, and timely discover and prevent possible security threats.

[0045] See also Figure 1 , Figure 1 A flowchart of a method for detecting deserialization vulnerabilities of a machine learning model provided in an embodiment of the present application. Figure 1 As shown in , the deserialization vulnerability detection method provided by the embodiment of the present application includes:

[0046] S101: Dynamically track and statically analyze the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model.

[0047] In this step, the loading process of the target machine learning model is dynamically tracked and statically analyzed in an isolated environment to determine multiple function call sequences of the target machine learning model.

[0048] In a possible implementation, the loading process of the target machine learning model is dynamically tracked and statically analyzed in an isolated environment to determine multiple function call sequences of the target machine learning model, including:

[0049] A: Load the debugging tool into the target machine learning model, and dynamically track the loading process of the target machine learning model in a sandbox environment based on the debugging tool to determine the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model.

[0050] Here, the debugging tool is loaded into the target machine learning model, and the loading process of the target machine learning model is dynamically tracked in the sandbox environment according to the debugging tool to determine the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model.

[0051] Among them, an improved version of Python's debugging tool bdb is used to track the loading process of the target machine learning model in real time in an isolated environment, recording all function calls and their parameter passing in order to analyze and detect potential deserialization backdoor attacks.

[0052] B: Perform static analysis on the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model to determine multiple function call sequences of the target machine learning model.

[0053] Here, static parsing analysis is performed on the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model to determine multiple function call sequences of the target machine learning model.

[0054] Among them, the call sequence is extracted from the execution log after dynamic tracing processing, and then the information is analyzed and sorted to generate a detailed model call sequence. These call sequences include the functions and methods actually used by the model during execution, but no security analysis is performed at this time, laying the foundation for the next step of security analysis.

[0055] S102: Match multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether the target machine learning model has function call sequences with potential risks.

[0056] In this step, multiple function call sequences of the target machine learning model are matched with multiple preset whitelist function call sequences to identify whether the target machine learning model has function call sequences with potential risks.

[0057] Here, the function call sequences obtained by the dynamic tracking module and the static analysis module are compared with the safe function call sequences in the whitelist to identify and mark the function call sequences with potential risks that are not in the whitelist function call sequences, so as to evaluate the security of the model and ultimately determine whether the target machine learning model is at risk of deserialization backdoor attacks.

[0058] In a possible implementation, multiple whitelist function call sequences are determined by the following steps:

[0059] Acquire multiple standard function call sequences of multiple standard machine learning models; perform deduplication processing on the multiple standard function call sequences, and determine the multiple standard function call sequences after deduplication processing as multiple whitelist function call sequences.

[0060] Here, we collect standard model call data, analyze a large number of safe and non-malicious machine learning models, collect their function call sequences during model loading, conduct in-depth analysis on the collected function call sequences, screen out safe function call patterns, and generate a set of whitelist call sequences based on the analysis results of the previous step.

[0061] In a possible implementation manner, for any function call sequence of the target machine learning model, the multiple function call sequences based on the target machine learning model are matched with multiple preset whitelist function call sequences to identify whether there is a function call sequence with potential risks in the target machine learning model, including:

[0062] a: Match the function call sequence with multiple whitelist function call sequences. If there is a whitelist function call sequence that is consistent with the function call sequence among the multiple whitelist function call sequences, then there is no potential risk in the function call sequence.

[0063] Here, the function call sequence is matched with multiple whitelist function call sequences. If there is a whitelist function call sequence that is consistent with the function call sequence among the multiple whitelist function call sequences, then there is no potential risk in the function call sequence.

[0064] b: If there is no whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence is a function call sequence with potential risks for the target machine learning model.

[0065] Here, if there is no whitelist function call sequence consistent with the function call sequence among multiple whitelist function call sequences, then the function call sequence is a function call sequence with potential risks for the target machine learning model.

[0066] S103: If there is a function call sequence with potential risks, a vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks.

[0067] In this step, if there is a function call sequence with potential risks, vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks.

[0068] In a possible implementation manner, if there is a function call sequence with potential risks, vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks, including:

[0069] (1): Based on preset vulnerability features, vulnerability detection is performed on the function call sequence with potential risks of the target machine learning model. If the function call sequence with potential risks has the vulnerability features, the function call sequence with potential risks is marked as a first identifier.

[0070] Here, vulnerability detection is performed on the function call sequence with potential risks of the target machine learning model according to the preset vulnerability characteristics. If the function call sequence with potential risks has vulnerability characteristics, the function call sequence with potential risks is marked as a first identifier, wherein the first identifier is a malicious identifier.

[0071] (2): If the function call sequence with potential risks does not have the vulnerability feature, the function call sequence is marked as a second identifier.

[0072] Here, if the function call sequence with potential risks does not have vulnerability features, the function call sequence is marked as a second identifier, wherein the second identifier is a suspicious identifier.

[0073] After receiving the function call sequence, it is compared with the whitelist function call sequence. Through comparison, potential risk operations that do not conform to the whitelist function call sequence are identified. Using the existing security knowledge base and vulnerability characteristics, these potential risk operations are further analyzed to assess whether they pose an actual security threat.

[0074] In a possible implementation manner, after performing vulnerability detection on the function call sequence with potential risks of the target machine learning model and determining whether the function call sequence with potential risks has a vulnerability, the deserialization vulnerability detection method further includes:

[0075] Perform risk assessment, locate the vulnerability, and push repair suggestions for the function call sequence with potential risks that has the vulnerability, and generate a vulnerability detection report for the target machine learning model.

[0076] Here, risk assessment, vulnerability location, and repair suggestion push are performed on the function call sequence with potential risks, and a vulnerability detection report for the target machine learning model is generated.

[0077] In this solution, dynamic tracing and static parsing technology are used to build a whitelist, capture the call sequence of model execution, and compare it with the security whitelist to explore and evaluate the possible deserialization backdoor risks in the machine learning model, helping users improve model security analysis capabilities.

[0078] In a possible implementation manner, after matching the multiple function call sequences based on the target machine learning model with the preset multiple whitelist function call sequences and identifying whether the target machine learning model has a function call sequence with potential risks, the deserialization vulnerability detection method further includes:

[0079] If there is no function call sequence with potential risks, it is determined that the target machine learning model has no security risks.

[0080] Here, if there is no function call sequence with potential risks, it is determined that the target machine learning model has no security risks.

[0081] In this solution, the Python debugging tool (bdb) is used to obtain all function call sequences of the target machine learning model loading process, and the machine learning model is evaluated for security in combination with static code analysis technology. First, the loading process of the machine learning model is dynamically tracked by the bdb tool, and all relevant function calls and parameter passing conditions are recorded. Based on this, static code analysis technology is used to check whether there are potential security risks or known vulnerability patterns in the model code. By combining dynamic and static analysis results, this solution can accurately identify and verify serialization and deserialization vulnerabilities in machine learning models, and timely discover and prevent possible security threats. Compared with traditional security detection methods, the present invention has significant improvements in accuracy and efficiency, and is particularly suitable for complex machine learning models and deep learning frameworks. Users can use this system to perform comprehensive security detection and evaluation on machine learning models, effectively improving the security assurance capabilities of machine learning projects. The present invention realizes the automation and intelligence of machine learning model security detection, and provides new tools and methods for security research and practice in the field of machine learning.

[0082] For further information, see Figure 2 , Figure 2A schematic diagram of a deserialization vulnerability detection method for a machine learning model provided in an embodiment of the present application. Figure 2 As shown, the improved bdb debugging tool is inserted into the model loading, a Docker sandbox environment is created to load the target machine learning model and the logs captured in the process are recorded, the logs captured in the sandbox running environment are further parsed to generate a detailed function call sequence, and the target machine learning model is detected based on the function call sequence and the whitelist function call sequence to see if there is a security detection, if so, the target machine learning model is marked and reported to have a security risk, if not, the target machine learning model is marked and reported to have no security risk.

[0083] The embodiment of the present application provides a method for detecting deserialization vulnerabilities of a machine learning model, the method comprising: dynamically tracking and statically analyzing the loading process of a target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model; matching multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether there are function call sequences with potential risks in the target machine learning model; if there are function call sequences with potential risks, vulnerability detection is performed on the function call sequences with potential risks to determine whether there are vulnerabilities in the function call sequences with potential risks. By dynamically tracking and statically analyzing the machine learning model to check whether there are function call sequences with potential risks or known vulnerability patterns in the target machine learning model, it is possible to accurately identify and verify serialization and deserialization vulnerabilities in the machine learning model, and timely discover and prevent possible security threats.

[0084] See also Figure 3 , Figure 4 , Figure 3 One of the structural schematic diagrams of a deserialization vulnerability detection device of a machine learning model provided in an embodiment of the present application; Figure 4 The second structural diagram of a deserialization vulnerability detection device for a machine learning model provided in an embodiment of the present application. Figure 3 As shown in , the deserialization vulnerability detection device 300 includes:

[0085] A dynamic and static analysis module 310 is used to perform dynamic tracking and static analysis on the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model;

[0086] A matching module 320 is used to match multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether the target machine learning model has a function call sequence with potential risks;

[0087] The risk detection module 330 is used to perform vulnerability detection on the function call sequence with potential risks if there is one, and determine whether there is a vulnerability in the function call sequence with potential risks of the target machine learning model.

[0088] Furthermore, the dynamic and static analysis module 310 performs dynamic tracking processing and static analysis processing in an isolated environment during the loading process of the target machine learning model, and determines that multiple function call sequences of the target machine learning model are: the dynamic and static analysis module 310 is specifically used to:

[0089] Loading a debugging tool into the target machine learning model, dynamically tracking the loading process of the target machine learning model in a sandbox environment based on the debugging tool, and determining function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model;

[0090] Static analysis is performed on the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model to determine multiple function call sequences of the target machine learning model.

[0091] Further, when the matching module 320 is used to match the multiple function call sequences based on the target machine learning model with the preset multiple whitelist function call sequences for any function call sequence of the target machine learning model, and identifies whether there is a function call sequence with potential risks in the target machine learning model, the matching module 320 is specifically used to:

[0092] Matching the function call sequence with multiple whitelist function call sequences, if there is a whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence does not have potential risks;

[0093] If there is no whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence is a function call sequence with potential risks for the target machine learning model.

[0094] Further, when the risk detection module 330 is used for the function call sequence with potential risks, the risk detection module 330 performs vulnerability detection on the function call sequence with potential risks to determine whether the function call sequence with potential risks has a vulnerability. The risk detection module 330 is specifically used to:

[0095] Performing vulnerability detection on a function call sequence with potential risks of the target machine learning model based on a preset vulnerability feature, and if the function call sequence with potential risks has the vulnerability feature, marking the function call sequence with potential risks as a first identifier;

[0096] If the function call sequence with potential risks does not have the vulnerability feature, the function call sequence is marked as a second identifier.

[0097] Further, such as Figure 4 As shown, the deserialization vulnerability detection device 300 also includes a report generation module 340, and the report generation module 340 is used to:

[0098] Perform risk assessment, locate the vulnerability, and push repair suggestions for the function call sequence with potential risks that has the vulnerability, and generate a vulnerability detection report for the target machine learning model.

[0099] Further, such as Figure 4 As shown, the deserialization vulnerability detection device 300 also includes a whitelist construction module 350. The whitelist construction module 350 determines multiple whitelist function call sequences through the following steps:

[0100] Get multiple standard function call sequences of multiple standard machine learning models;

[0101] Deduplication processing is performed on the plurality of standard function call sequences, and the plurality of standard function call sequences after deduplication processing are determined as a plurality of whitelist function call sequences.

[0102] Further, such as Figure 4 As shown, the report generation module 340 is also used to:

[0103] If there is no function call sequence with potential risks, it is determined that the target machine learning model has no security risks.

[0104] The embodiment of the present application provides a deserialization vulnerability detection device for a machine learning model, and the deserialization vulnerability detection device includes: a dynamic and static analysis module, which is used to dynamically track and statically analyze the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model; a matching module, which is used to match the multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether there are function call sequences with potential risks in the target machine learning model; a risk detection module, which is used to perform vulnerability detection on the function call sequences with potential risks if there are function call sequences with potential risks, and determine whether there are vulnerabilities in the function call sequences with potential risks of the target machine learning model. By dynamically tracking and statically analyzing the machine learning model, it is possible to check whether there are function call sequences with potential risks or known vulnerability patterns in the target machine learning model, accurately identify and verify serialization and deserialization vulnerabilities in the machine learning model, and timely discover and prevent possible security threats.

[0105] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown in , the electronic device 500 includes a processor 510 , a memory 520 and a bus 530 .

[0106] The memory 520 stores machine-readable instructions executable by the processor 510. When the electronic device 500 is running, the processor 510 communicates with the memory 520 via the bus 530. When the machine-readable instructions are executed by the processor 510, the above-mentioned Figure 1 as well as Figure 2 The steps of the deserialization vulnerability detection method of the machine learning model in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0107] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 as well as Figure 2 The steps of the deserialization vulnerability detection method of the machine learning model in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0108] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0109] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0112] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0113] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting deserialization vulnerabilities of a machine learning model, characterized in that: The deserialization vulnerability detection method comprises: Performing dynamic tracking and static analysis on the loading process of the target machine learning model in an isolated environment to determine multiple function call sequences of the target machine learning model; Based on matching multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences, identifying whether the target machine learning model has function call sequences with potential risks; If there is a function call sequence with potential risks, a vulnerability detection is performed on the function call sequence with potential risks to determine whether there is a vulnerability in the function call sequence with potential risks.

2. The deserialization vulnerability detection method according to claim 1, characterized in that: The loading process of the target machine learning model is dynamically tracked and statically analyzed in an isolated environment to determine multiple function call sequences of the target machine learning model, including: Loading a debugging tool into the target machine learning model, dynamically tracking the loading process of the target machine learning model in a sandbox environment based on the debugging tool, and determining function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model; Static analysis is performed on the function call information, parameter passing information, object serialization information, and object deserialization information of the target machine learning model to determine multiple function call sequences of the target machine learning model.

3. The deserialization vulnerability detection method according to claim 1, characterized in that: For any function call sequence of the target machine learning model, the multiple function call sequences based on the target machine learning model are matched with multiple preset whitelist function call sequences to identify whether there is a function call sequence with potential risks in the target machine learning model, including: Matching the function call sequence with multiple whitelist function call sequences, if there is a whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence does not have potential risks; If there is no whitelist function call sequence consistent with the function call sequence among the multiple whitelist function call sequences, then the function call sequence is a function call sequence with potential risks for the target machine learning model.

4. The deserialization vulnerability detection method according to claim 1, characterized in that: If there is a function call sequence with potential risks, a vulnerability detection is performed on the function call sequence with potential risks to determine whether the function call sequence with potential risks has a vulnerability, including: Performing vulnerability detection on a function call sequence with potential risks of the target machine learning model based on a preset vulnerability feature, and if the function call sequence with potential risks has the vulnerability feature, marking the function call sequence with potential risks as a first identifier; If the function call sequence with potential risks does not have the vulnerability feature, the function call sequence is marked as a second identifier.

5. The deserialization vulnerability detection method according to claim 1, characterized in that: After performing vulnerability detection on the function call sequence with potential risks of the target machine learning model and determining whether the function call sequence with potential risks has a vulnerability, the deserialization vulnerability detection method further includes: Perform risk assessment, locate the vulnerability, and push repair suggestions for the function call sequence with potential risks that has the vulnerability, and generate a vulnerability detection report for the target machine learning model.

6. The deserialization vulnerability detection method according to claim 1, characterized in that: Multiple whitelist function call sequences are determined through the following steps: Get multiple standard function call sequences of multiple standard machine learning models; Deduplication processing is performed on the plurality of standard function call sequences, and the plurality of standard function call sequences after deduplication processing are determined as a plurality of whitelist function call sequences.

7. The deserialization vulnerability detection method according to claim 1, characterized in that: After matching the multiple function call sequences based on the target machine learning model with the preset multiple whitelist function call sequences to identify whether the target machine learning model has a function call sequence with potential risks, the deserialization vulnerability detection method further includes: If there is no function call sequence with potential risks, it is determined that the target machine learning model has no security risks.

8. A deserialization vulnerability detection device for a machine learning model, characterized in that: The deserialization vulnerability detection device comprises: A dynamic and static analysis module, used to perform dynamic tracking and static analysis on the loading process of the target machine learning model in an isolated environment, and determine multiple function call sequences of the target machine learning model; A matching module, used to match multiple function call sequences of the target machine learning model with multiple preset whitelist function call sequences to identify whether the target machine learning model has function call sequences with potential risks; The risk detection module is used to perform vulnerability detection on the function call sequence with potential risks if there is one, and determine whether there is a vulnerability in the function call sequence with potential risks of the target machine learning model.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the deserialization vulnerability detection method of the machine learning model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the deserialization vulnerability detection method of the machine learning model as described in any one of claims 1 to 7 are executed.

Images