A Large Model Security Protection Method and Its System

Abstract

The embodiments of this specification disclose a large model security protection method and its system. Among them, a large model security protection method includes capturing the request and response traffic in the traffic entering and leaving the large model, analyzing the request through the learning model to generate a first request and / or a second request, the learning model searching for the corresponding response traffic of the first request and / or the second request, the response traffic including first data or second data, and using the pre-trained learning model to analyze the first data or the second data to determine the attack method. Through real-time monitoring of traffic and intelligent analysis using machine learning algorithms, the present invention can accurately identify abnormal behaviors and potential threats, dynamically adjust the protection strategy according to the results of intelligent analysis, improve the adaptability and effectiveness of security protection, provide comprehensive protection measures for various security problems faced by large models, and ensure the secure deployment and application of large models.

Description

Technical Field

[0001] Multiple embodiments of this specification relate to the technical field of large model security protection, and specifically relate to a large model security protection method and its system. Background Art

[0002] Artificial intelligence large models, referred to as large models for short, are a type of artificial intelligence models with a large number of parameters constructed by artificial neural networks. The artificial intelligence large model is an emerging concept that has emerged in the past decade. It usually first conducts pre-training on a large amount of data through self-supervised learning or semi-supervised learning, and then further optimizes its performance and capabilities through methods such as instruction tuning and human alignment. Large models have characteristics such as a large number of parameters, large training data, and large computing resources, and have the capabilities to solve general tasks, follow human instructions, and perform complex reasoning. The main categories of artificial intelligence large models include: large language models, vision large models, multi-modal large models, and basic science large models, etc. Currently, large models have been widely applied in multiple fields, including search engines, intelligent agents, related vertical industries, and basic science, etc., promoting the intelligent development of various industries.

[0003] During the deployment and application process of large models, the following problems may be involved in the training and application process of large models. First, sensitive data may be involved in the training and application process of large models, posing a risk of data leakage. Second, the intellectual property rights of large models are easily illegally copied or misused, resulting in economic losses. Third, attackers manipulate the model output through carefully designed prompts, causing the model to generate harmful or misleading content. Fourth, the software supply chain on which large models depend may have vulnerabilities, resulting in security risks. Fifth, attackers cause the large model service to be unavailable through a large number of requests, affecting normal business. Summary of the Invention

[0004] In a first aspect, an embodiment of this specification provides a large model security protection method, including:

[0005] Capturing the request and response traffic in the traffic entering and leaving the large model;

[0006] Analyzing the request through a learning model to generate a first request and / or a second request;

[0007] The learning model searches for the response traffic corresponding to the first request and / or the second request, and the response traffic includes first data or second data;

[0008] Analyzing the first data and the second data using the pre-trained learning model to determine the attack method;

[0009] Among them, for conventional attack methods, the learning model executes a predetermined protection strategy to protect the large model;

[0010] Among them, the new attack method collects historical normal data associated with the response traffic through the pre-trained learning model and trains the learning model through a learning method;

[0011] The trained learning model analyzes the response traffic again and dynamically adjusts the protection strategy to protect the large model.

[0012] Furthermore, the learning method of the learning model includes:

[0013] An encoder that obtains encoder features by passing the historical normal data through the encoder;

[0014] A decoder that obtains reconstructed data by passing the encoder features through the decoder, thereby completing the training of the model;

[0015] Calculate the reconstructed error E by the Euclidean norm of the reconstructed data;

[0016] Calculate the error value Eth according to the response traffic by the trained learning model;

[0017] When the reconstructed error E Eth, it is determined that the response traffic is a conventional attack method;

[0018] When the reconstructed error E Eth, it is determined that the response traffic is a new attack method.

[0019] Furthermore, it also includes extracting the features of the response traffic and calculating the danger coefficient Sc according to the features of the response traffic;

[0020] Quickly determine whether the response traffic is the abnormal data according to the danger coefficient Sc through the risk coefficient table;

[0021] Among them, both the first data and the second data are the abnormal data;

[0022] Correspond the calculated danger coefficient Sc to the equivalent data in the risk coefficient table, generate adversarial sample data through the adversarial attack method with the equivalent data, and re-train the learning model with the adversarial sample data, and use the re-trained learning model to analyze the response data again.

[0023] Furthermore, for at least two of the new attack methods, calculate and judge the risk coefficient of each new attack method through the learning model, judge the risk level of the risk coefficient according to the risk coefficient table, and start different dynamic adjustment protection strategies in sequence according to the risk level to protect the large model.

[0024] Furthermore, the method for re-training the learning model includes:

[0025] Set a threshold value;

[0026] There are several pieces of adversarial sample data, and the adversarial sample data greater than the threshold value is removed through an anomaly detection algorithm;

[0027] Retrain the learning model with the remaining adversarial sample data;

[0028] Identify the sensitive features of the response data through the retrained learning model, calculate the weighted vector CE, and improve the calculation accuracy of the risk coefficient Sc through the weighted vector CE.

[0029] Furthermore, the features of the response traffic include time window statistical features, protocol features, traffic distribution features, and sensitive features;

[0030] Extract the features of the response traffic to the retrieval platform, output several equivalent features through the retrieval platform, and summarize the several equivalent features into equivalent data;

[0031] The equivalent features not recorded in the risk coefficient table are incorporated into the risk coefficient table to generate new equivalent data, and adversarial sample data is generated through an adversarial attack method according to the new equivalent data to train the learning model.

[0032] Furthermore, the weighted vector CE is calculated by calculating the number of correctly filtered sensitive words YP, the number of correctly retained non-sensitive words YN, the number of non-sensitive words misfiltered QP, and the number of missed sensitive words QN;

[0033] It also includes 、 and Similarity, and assist in calculating the risk coefficient Sc through the 、 and Similarity;

[0034] Among them, the and are weight coefficients in the response traffic;

[0035] Among them, the Similarity is the proportion of sensitive features in the response traffic.

[0036] Furthermore, the protection of the dynamic adjustment of the protection strategy includes:

[0037] Filter malicious proposed words, inject the sensitive features of the second data, and when the learning model after training identifies that the proposed words have attacks, the learning model filters the malicious proposed words;

[0038] Control the flow limit. When the requesting end requests to obtain the second data, the learning model monitors the IP of the requesting end and limits the broadband network speed of the IP of the requesting end;

[0039] Limit the current and ban the IP. The learning model identifies denial-of-service attacks and uses the learning model to limit the current or ban the source IP of the attack to protect the large model;

[0040] Encrypt the data. When the requesting end requests the second data, the learning model encrypts or desensitizes the second data to protect the large model.

[0041] Furthermore, record all the dynamically adjusted protection policies and security events;

[0042] Import all the security events and dynamically adjusted protection policies into the user interface;

[0043] View the security events and the dynamically adjusted protection policies through the user interface.

[0044] In a second aspect, an embodiment of the present specification provides a large model security protection system, including a traffic detection module, an intelligent analysis module, a dynamic protection policy module, a log module, and a user interface module;

[0045] The traffic detection module is deployed at the network entrance, captures all traffic data entering and leaving the large model, and transmits the captured traffic data to the intelligent analysis module;

[0046] The intelligent analysis module analyzes the request and response traffic through a learning model, identifies abnormal behaviors and potential risks of the request and response traffic, and obtains an analysis result;

[0047] The dynamic protection policy module dynamically adjusts the protection policy according to the analysis result;

[0048] Store the dynamically adjusted protection policy, abnormal behavior, and potential data risks in the log module;

[0049] The user interface module is used to read all the dynamically adjusted protection policies, abnormal behaviors, and potential data risks in the log module.

[0050] The beneficial effects brought by the technical solutions provided in some embodiments of the present specification at least include:

[0051] In multiple embodiments of the present specification, a large model security protection method and system provided can accurately identify abnormal behaviors and potential threats by real-time monitoring of traffic and intelligent analysis using machine learning algorithms, dynamically adjust the protection policy according to the intelligent analysis result, improve the adaptability and effectiveness of security protection, provide comprehensive protection measures for various security problems faced by the large model, and ensure the safe deployment and application of the large model.

[0052] Other features and advantages of multiple embodiments of the present specification will be further revealed in the following specific implementation manners and drawings. Description of the Drawings

[0053] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings required for use in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of this specification. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on these drawings.

[0054] Figure 1 Schematic diagram of the security protection method architecture provided for the embodiments of this specification.

[0055] Figure 2 Schematic diagram of the security protection system architecture provided for the embodiments of this specification.

[0056] Figure 3 Schematic diagram of the data processing program provided for the embodiments of this specification.

[0057] Figure 4 Schematic diagram of the model training program provided for the embodiments of this specification.

[0058] Figure 5 Schematic diagram of the model detection program provided for the embodiments of this specification.

[0059] Figure 6 Schematic diagram of the alarm program provided for the embodiments of this specification. Detailed implementation manners

[0060] The technical solutions in the embodiments of this specification will be explained and illustrated below with reference to the accompanying drawings of the embodiments of this specification. However, the following embodiments are only the preferred embodiments of this specification, not all of them. Based on the embodiments in the implementation manners, other embodiments obtained by those of ordinary skill in the art without creative efforts all fall within the protection scope of this specification.

[0061] The terms "first", "second", "third", etc. in the specification, claims and the above accompanying drawings of this specification are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally further includes steps or units not listed, or optionally further includes other steps or units inherent to these processes, methods, products or devices.

[0062] In the following description, terms indicating orientation or positional relationships such as "inner", "outer", "upper", "lower", "left", "right", etc. are only for the convenience of describing embodiments and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this specification.

[0063] The data involved in this application are all information and data authorized by users or fully authorized by all parties, and the collection of relevant data complies with the relevant laws, regulations and standards of relevant countries and regions.

[0064] Embodiment 1

[0065] Please refer to Figures 1-6 , wherein a large model security protection method includes:

[0066] Capture the request and response traffic in the traffic entering and leaving the large model;

[0067] Analyze the request through a learning model to generate a first request and / or a second request;

[0068] The learning model searches for the response traffic corresponding to the first request or the second request, and the response traffic includes first data or second data;

[0069] Use a pre-trained learning model to analyze the first data and the second data to determine the attack method;

[0070] Among them, for conventional attack methods, a predetermined protection strategy is executed through the learning model to protect the large model;

[0071] Among them, for new attack methods, the pre-trained learning model collects historical normal data associated with the response traffic and trains the learning model through a learning method;

[0072] Use the trained learning model to analyze the response traffic again and dynamically adjust the protection strategy to protect the large model.

[0073] Capture the request and the matching response traffic in the traffic entering and leaving the large model, analyze the request through the learning model to generate the corresponding number of first requests or / and second requests, and then use the learning model to search for the corresponding response traffic according to the first request or / and the second request. The learning model analyzes and determines that the response traffic is the first data or the second data according to the algorithm;

[0074] According to Figure 1 shown, the first data is known abnormal model data, and the second data is suspected risk model data;

[0075] Among them, the learning model uses a statistics-based threshold method to determine that the response traffic is the first data or the second data;

[0076] Among them, the standard deviation formula in the threshold method is:

[0077] ;

[0078] Subsequently, a multiple k is set, and the upper threshold U = , and the lower threshold L ;

[0079] When the response traffic U or the response traffic , it is determined that the response data is the first data, and the first data is the known abnormal data;

[0080] When the response traffic U or the response traffic , it is determined that the response data is the second data, and the second data is the suspected risk data;

[0081] Furthermore, features are extracted from the response traffic through a learning model. The features of the response traffic include time window statistical features, protocol features, traffic distribution features, and sensitive features;

[0082] Among them, the time window statistical features include traffic rate, number of data packets, and number of bytes;

[0083] Among them, the protocol features include TCP ratio, UDP ratio, and number of ICMP requests;

[0084] Among them, the traffic distribution features include IP source address and target port distribution;

[0085] Based on this, it is determined whether there is sensitive data by extracting the above features. When sensitive features appear, they are marked through the learning model to reduce the risk of data leakage.

[0086] According to Figure 3 shown, the learning model uses a detection model to perform anomaly detection on the features of the response traffic to generate the following results:

[0087] Judge whether the first data is a new attack or a conventional attack;

[0088] Judge whether the second data is a new attack or a conventional attack;

[0089] It should be particularly noted that the detection model includes Isolation Forest, Autoencoder, Support Vector Machine, etc.;

[0090] When it is a conventional attack, the learning model uses a preset protection strategy to protect the large model;

[0091] When it comes to a new type of attack, the learning model collects historical normal data associated with response traffic, cleans and formats the historical normal data, trains the learning model with the processed historical normal data through a learning method, analyzes the response traffic again through the trained learning model to generate an analysis result, and dynamically adjusts the protection strategy according to the analysis result to protect the large model through the dynamically adjusted protection strategy;

[0092] The dynamic protection strategy automatically adjusts the protection strategy according to the result obtained by the learning model. For example:

[0093] Result 1: When a prompt injection attack is detected, malicious prompts are automatically filtered;

[0094] Result 2: When a denial-of-service attack is detected, the traffic is automatically throttled or the attacking source IP is blocked;

[0095] Result 3: When a risk of sensitive data leakage is detected, the data is automatically encrypted or desensitized;

[0096] Result 4: Key words and data are extracted and automatically encrypted or deleted;

[0097] Result 5: When a suspected risk is detected, key monitoring is carried out and the broadband network speed is throttled;

[0098] And determine the IP address. When it is determined that there is a leakage risk, determine the IP address of the requester, and prohibit requests from attackers with the same IP address or the same request, so as to avoid multiple requests attacking the large model simultaneously or successively;

[0099] To sum up, by using the learning model to monitor traffic in real time and using the detection algorithm to extract features for anomaly detection and intelligent analysis, abnormal behaviors and potential threats can be accurately identified. The protection strategy is dynamically adjusted according to the intelligent analysis result, improving the adaptability and effectiveness of security protection. In this way, various security problems faced by the large model are handled, comprehensive protection measures are provided, and the safe deployment and application of the large model are ensured;

[0100] It should be specially noted that according to Figure 5 as shown, a sliding time window is used to process the response traffic in real time, and features are extracted and input into the detection model to detect and determine the attack method;

[0101] Among them, the learning methods of the learning model include:

[0102] Encoder: The historical normal data is passed through the encoder to obtain the encoder feature h, and the calculation formula is h = f(x), where f is the encoder function;

[0103] Decoder: The encoded feature h is input into the decoder to obtain = g(h), where g is the decoder function, and the training and learning of the model are completed;

[0104] The reconstruction error E is obtained by calculating the reconstructed data through the Euclidean norm, and the calculation formula is ;

[0105] The error value Eth is calculated based on the response traffic by the trained learning model;

[0106] When the reconstruction error E Eth, it is determined that the response traffic is a conventional attack method;

[0107] When the reconstruction error E Eth, it is determined that the response traffic is a new attack method;

[0108] For example, at the traffic data t at a certain moment, the input is xt, the hidden state is ht, and the traffic state is Ct;

[0109] The input gate it = (Wixxt + Wihht-1 + bi);

[0110] The forget gate ft = (Wfxxt + Wfhht-1 + bf);

[0111] The output gate ot = (Woxxt + Wohht-1 + bo);

[0112] The traffic state t = tanh(Wcxxt + Wchht-1 + bc);

[0113] The traffic state update Ct = ft ⊙ Ct-1 + it ⊙ t;

[0114] The hidden state update ht = ot ⊙ tanh(Ct);

[0115] The predicted value t = Wyxxt + by, assuming that the output layer is a simple linear layer;

[0116] Calculate the error et between the predicted value t and the actual value yt, et = ∣yt - t∣;

[0117] When the et error threshold Eth, it is determined that the response traffic is a conventional attack method;

[0118] When the et error threshold Eth, it is determined that the response traffic is a new attack method;

[0119] It also includes recording all dynamically adjusted protection policies and security events;

[0120] Import all security events and dynamically adjusted protection policies into the user interface;

[0121] View the security events and the dynamically adjusted protection policies through the user interface.

[0122] Embodiment 2

[0123] This embodiment is an improvement based on Embodiment 1. Specifically, please refer to Figures 1-6 , and further includes extracting the characteristics of the response traffic, and calculating the risk coefficient Sc according to the characteristics of the response traffic;

[0124] The calculation formula of the risk coefficient Sc is:

[0125] ;

[0126] Through , and Similarity to assist in calculating the risk coefficient Sc;

[0127] Wherein, and are the weight coefficients in the response traffic;

[0128] Wherein, Similarity is the proportion of sensitive features in the response traffic;

[0129] The weighted vector CE is calculated by combining the correctly filtered sensitive features YP, the correctly retained non-sensitive features YN, the number QP of non-sensitive features mis-filtered, and the number QN of missed sensitive features. The formula is:

[0130] ;

[0131] Quickly determine whether the response traffic is a conventional attack method or a new attack method according to the risk coefficient Sc;

[0132] Correspond the calculated risk coefficient Sc to the equivalent data in the risk coefficient table, generate adversarial sample data through the adversarial attack method with the equivalent data, retrain the learning model with the adversarial sample data, and use the retrained learning model to analyze the response data again;

[0133] It should be noted specifically that the weight coefficient and the weight coefficient The calculation formula is,

[0134] ;

[0135] ;

[0136] Among them, is the number of occurrences of sensitive words;

[0137] o c is the frequency of the same sensitive word;

[0138] is the risk weight of the sensitive word;

[0139] Record the number of occurrences of sensitive words through the learning model , and calculate the risk weight by combining the self-built random forest model with historical normal data ;

[0140] By calculating the weight coefficient and the weight coefficient This can more accurately assist the learning model to judge the risk coefficient Sc of the feature word. Secondly, the weight coefficient and the weight coefficient are imported into the intelligent analysis module to improve the accuracy of the analysis;

[0141] The calculation formula of the feature word ratio Similarity is

[0142] Similarity ;

[0143] By calculating the response traffic feature word ratio Similarity, input the full text feature ratio Similarity into the dynamic protection strategy to assist in calculating and judging the risk coefficient Sc;

[0144] Calculate and judge the risk coefficient of each new attack method through the learning model, judge the risk level of the risk coefficient according to the risk coefficient table, and start different dynamic adjustment protection strategies in sequence according to the risk level to protect the large model;

[0145] Among them, the methods for retraining the learning model include:

[0146] Set the threshold;

[0147] There are several pieces of adversarial sample data, and the adversarial sample data greater than the threshold are removed through the anomaly detection algorithm;

[0148] Among them, the decision tree calculation model is selected for the anomaly detection algorithm to remove the adversarial sample data greater than the threshold;

[0149] Retrain the learning model with the remaining adversarial sample data;

[0150] Extract the features of the response traffic to the retrieval platform, output several equivalent features through the retrieval platform, and summarize the several equivalent features into equivalent data;

[0151] Equivalent features not recorded in the risk coefficient table will be incorporated into the risk coefficient table to generate new equivalent data. Based on the new equivalent data, adversarial sample data will be generated through adversarial attack methods to train the learning model.

[0152] Set a danger level table. Determine the danger level based on the danger coefficient Sc, and determine whether it is necessary to identify the request or response data as abnormal according to the danger level.

[0153] The danger coefficients 1 - 4 in the danger level table are third-level dangers, the danger coefficients 5 - 8 are second-level dangers, and danger coefficients above 8 are first-level dangers;

[0154] For the cooperation judgment of the danger level and the dynamic protection strategy, the response data is determined as the second data, and the type of attack method is known;

[0155] Intelligently analyze the danger coefficient Sc and the determined danger level to assist in judging whether the request or response data is abnormal, improve the judgment accuracy, and reduce the possibility of misjudgment. When it is judged as abnormal, import the judged data at this time into the learning model, and record the dangerous data therein through the learning model to enhance the judgment ability of the learning model;

[0156] Set up a sensitive word library. The sensitive word library contains sensitive words and the semantic environments associated with the sensitive words. The detected words are judged whether they are sensitive words according to the sensitive word library.

[0157] Furthermore, remove the symbols near the detected words and retain the words to reduce the influence of the symbols on the judgment accuracy of the learning model;

[0158] To improve the detection accuracy and reduce the possibility of missed detection or requests being deliberately disguised, the detected words include but are not limited to Chinese pinyin, foreign pinyin, foreign language translations, homophonic words, foreign language homophonic words, antonyms and words, foreign language antonyms and words, synonyms and words, foreign language synonyms and words, inverted words, foreign language inverted words;

[0159] Among them, Chinese pinyin also includes the lack or addition of front nasal sounds, back nasal sounds, retroflex sounds, flat tongue sounds, etc.;

[0160] The foreign language spelling is the pinyin of the detected words spelled in foreign language letters. The foreign language includes major languages and minor languages;

[0161] Among them, the inverted words are deliberately disguised as normal words, and the characters of the normal words are reversed to avoid detection;

[0162] Analyze the detected words through a learning model to adjust Chinese pinyin, foreign pinyin, foreign language translations, homophones, foreign homophones, antonyms of Chinese characters and words, antonyms of foreign characters and words, synonyms of Chinese characters and words, synonyms of foreign characters and words, inverted words, foreign inverted words, etc. into real words, so as to accurately judge whether there is dangerous data;

[0163] Furthermore, due to the different application scenarios of the detected words, the detected words may be aggressive or non - aggressive. The specific operation is to search for the application scenarios of the detected words, import the detected words into various different application scenarios and compare and analyze them with the context - related data in the response traffic, so as to judge whether the real words and the context - related data are aggressive through the learning model, and thus accurately adjust the protection strategy to achieve a better dynamic protection strategy;

[0164] Extract key words. When it is detected that the words in the output data are dangerous, automatically encrypt or delete the dangerous words.

[0165] The present invention also provides a large - model security protection system, including a traffic detection module, an intelligent analysis module, and a dynamic protection strategy module;

[0166] The traffic detection module is deployed at the network entrance, captures all traffic data entering and leaving the large model, and transmits the captured traffic data to the intelligent analysis module;

[0167] The intelligent analysis module is located within the learning model, and thus analyzes the input and output traffic data through a learning algorithm to identify abnormal behaviors and potential dangers;

[0168] The dynamic protection strategy module dynamically adjusts the protection strategy according to the results identified by the intelligent analysis module.

[0169] Among them, the abnormal modes include prompt - word injection attacks, denial - of - service attacks, sensitive data leakage risks, etc.;

[0170] Furthermore, the intelligent analysis module utilizes the automatic learning ability of the learning model to automatically learn new attack methods, automatically mark the risk levels, and when the normal traffic load is too high, automatically learn the protection strategy, form disposal rules, and transmit the analysis results to the dynamic protection strategy module;

[0171] It should be particularly noted that the dynamic protection strategy module automatically adjusts the protection strategy according to the results of the intelligent analysis module.

[0172] The above is only the preferred implementation mode of the present invention. It should be pointed out that for those of ordinary skill in the art of this technology, without departing from the technical principle of the present invention, several improvements and refinements can still be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A security protection method for large models, characterized in that, Including: Capturing request and response traffic in the traffic flowing in and out of the large model; Analyzing the request through the learning model to generate a first request and / or a second request; The learning model searches for the response traffic corresponding to the first request and / or the second request, and the response traffic includes first data or second data; Using the pre-trained learning model to analyze the first data or the second data to determine the attack method; Among them, for the conventional attack method, the pre-determined protection strategy is executed through the learning model to protect the large model; Among them, for the new attack method, the pre-trained learning model collects historical normal data associated with the response traffic and trains the learning model through a learning method; Protecting the large model by analyzing the response traffic again through the trained learning model and dynamically adjusting the protection strategy; The learning method of the learning model includes: An encoder that obtains encoder features by passing the historical normal data through the encoder; A decoder that obtains reconstructed data by passing the encoder features through the decoder to complete the training of the learning model; Calculating the reconstructed data through the Euclidean norm to obtain a reconstruction error E; Calculating an error value Eth according to the response traffic through the trained learning model; When the reconstruction error E is less than Eth, it is determined that the response traffic is a conventional attack method; When the reconstruction error E is less than Eth, it is determined that the response traffic is a new type of attack method.

2. The large model security protection method according to claim 1, wherein: It also includes extracting the features of the response traffic and calculating a danger coefficient Sc according to the features of the response traffic; Quickly determining whether the response traffic is a conventional attack method or a new attack method according to the danger coefficient Sc through a risk coefficient table; Corresponding the calculated danger coefficient Sc to the equivalent data in the risk coefficient table, generating adversarial sample data through the adversarial attack method with the equivalent data, and re-training the learning model with the adversarial sample data, and using the re-trained learning model to analyze the response data again.

3. The large model security protection method according to claim 2, characterized in that: Calculating and judging the risk coefficient of each of at least two new attack methods through the learning model, judging the risk level of the risk coefficient Sc according to the risk coefficient table, and sequentially starting different dynamic adjustment protection strategies according to the risk level to protect the large model.

4. The large model security protection method according to claim 2, characterized in that The method for re-training the learning model includes: Setting a threshold; There are several pieces of the adversarial sample data, and the adversarial sample data greater than the threshold is removed through an anomaly detection algorithm; Re-training the learning model with the remaining adversarial sample data; Identifying the sensitive features of the response data through the re-trained learning model and calculating a weighted vector CE, and improving the calculation accuracy of the danger coefficient Sc through the weighted vector CE.

5. The large model security protection method according to claim 2, wherein: The features of the response traffic include time window statistical features, protocol features, traffic distribution features, and sensitive features; Extracting the features of the response traffic to a retrieval platform, and outputting several equivalent features through the retrieval platform, and summarizing the several equivalent features into equivalent data; The equivalent features not recorded in the risk coefficient table will be incorporated into the risk coefficient table to generate new equivalent data, and adversarial sample data is generated through the adversarial attack method according to the new equivalent data to train the learning model.

6. The large model security protection method according to claim 4, characterized in that: Calculating the weighted vector CE by calculating the number of correctly filtered sensitive words YP, the number of correctly retained non-sensitive words YN, the number of non-sensitive words mis-filtered QP, and the number of missed sensitive words QN; It also includes , and Similarity, and calculates the risk coefficient Sc through the , and Similarity for assistance; Among them, the and are weight coefficients in the response traffic; Among them, the Similarity is the proportion of sensitive features in the response traffic.

7. The large model security protection method according to claim 1, characterized in that, The protection of the dynamically adjusted protection policy includes: Filter malicious proposed words, inject sensitive features of the second data, and when the learning model after training identifies that the proposed words have an attack, the learning model filters malicious proposed words; Control flow limiting. When the requesting end requests to obtain the second data, the learning model monitors the IP of the requesting end and limits the broadband network speed of the IP of the requesting end; Limit and ban IP addresses. When the learning model identifies a denial-of-service attack, the learning model uses flow limiting or bans the source IP address of the attack to protect the large model; Encrypt data. When the requesting end requests the second data, the learning model encrypts or desensitizes the second data to protect the large model.

8. The large model security protection method according to claim 1, characterized in that: Record all the dynamically adjusted protection policies and security events; Import all the security events and dynamically adjusted protection policies into the user interface; View the security events and the dynamically adjusted protection policies through the user interface.

Images