Multimodal poison attack defense methods and systems

Abstract

Embodiments of the present application provide a multi-modal poisoning attack defense method and system, wherein the multi-modal poisoning attack defense method comprises: obtaining a preprocessed data set; determining fusion features corresponding to the preprocessed data set; performing feature reconstruction on the fusion features to determine reconstructed features; performing quality evaluation on the reconstructed features to determine fusion feature confidence; obtaining historical attack samples; inputting the historical attack samples and the preprocessed data set into a generative adversarial network to determine attack mode matching confidence; determining a security confidence parameter according to the fusion feature confidence and the attack mode matching confidence; and triggering a defense action according to the security confidence parameter. Through the scheme of the present application, the way of determining the security confidence according to the fusion feature confidence and the attack mode matching confidence realizes the balance between comprehensive defense and dynamic adaptability, and improves the security of the bank business system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a multi-modal poisoning attack defense method and system. BACKGROUND

[0002] At present, with the wide application of artificial intelligence, various industries access artificial intelligence into customer service systems to improve the efficiency of serving customers, but there may be poisoning attack data of attackers in various modal data such as voice, text, image and user behavior. The existing technology for poisoning attack defense through artificial intelligence can only be directed to a single modal data set, while in actual work or use scenarios, the use data of each participant contains multiple modalities, and hidden attacks are constructed through the correlation between multi-modal data, and voice poisoning, text and image poisoning and behavior poisoning are implemented. The existing single modal defense method is difficult to cope with hidden instructions and cross-modal attack chains in multi-modal data. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a multi-modal poisoning attack defense method and system, which can solve the problem that the single modal defense method is difficult to cope with hidden instructions and cross-modal attack chains in multi-modal data.

[0004] Therefore, the embodiments of the first aspect of the present application provide a multi-modal poisoning attack defense method.

[0005] The embodiments of the second aspect of the present application provide a multi-modal poisoning attack defense system.

[0006] In order to achieve the above-mentioned purpose, the embodiments of the first aspect of the present application provide a multi-modal poisoning attack defense method, comprising: acquiring a pre-processed data set; determining a fusion feature corresponding to the pre-processed data set; performing feature reconstruction on the fusion feature to determine a reconstructed feature; performing quality evaluation on the reconstructed feature to determine a fusion feature confidence; acquiring a historical attack sample; inputting the historical attack sample and the pre-processed data set into a generative adversarial network to determine an attack mode matching confidence; determining a security confidence parameter according to the fusion feature confidence and the attack mode matching confidence; and triggering a defense action according to the security confidence parameter.

[0007] The multi-modal poisoning attack defense method provided by the application fuses features of pre-processed data sets including multi-modal data, and reconstructs the fused features to determine the reconstructed features corresponding to the pre-processed data sets, and combines the federal knowledge cooperation and dynamic response mechanism to build a full-process defense system from multi-modal data preprocessing to attack interception and triggering of defense actions. The multi-modal poisoning attack defense method also combines a generative adversarial network, wherein the generator in the generative adversarial network outputs a poisoning attack sample, the discriminator in the generative adversarial network processes multi-modal features through a double-branch network, fuses branch information of a user branch and an attack branch through a cross-branch attention mechanism to determine a cross-modal attention parameter of the user feature and the attack sample feature, determines an attack mode matching confidence according to the cross-modal attention parameter, and the smaller the value corresponding to the attack mode matching confidence is, the more similar the user data feature and the poisoning attack sample are. Finally, a security confidence parameter is determined according to the attack mode matching confidence and the fused feature confidence to trigger the corresponding defense action of the system.

[0008] In the above technical solution, the pre-processed data set is obtained by: collecting a user original data set, the user original data set including voice data, image data, text data and behavior data; determining a denoised data set corresponding to the user original data set; determining a plurality of modal features in the denoised data set, the modal features including a voice modal corresponding to the voice data, an image modal corresponding to the image data, a text modal corresponding to the text data, and a behavior modal corresponding to the behavior data; mapping the voice modal, the image modal, the text modal and the behavior modal to the same latitude, and performing time alignment to determine the pre-processed data set.

[0009] In this solution, the original data set of the user in the business scenario is collected, the original data set including voice data, image data, text data and behavior data of the user, and the plurality of data in the original data set all correspond to the same business process. The original data set of the user is denoised to remove abnormal signals or private information in the plurality of data to generate a denoised data set, thereby improving the data quality, reducing the interference of noise on subsequent feature extraction and model training, and improving the operation efficiency. A plurality of modal features in the denoised data set are determined to retain key information required for attack detection, and the plurality of modalities are mapped to the same latitude and time-aligned to eliminate dimensional differences, so that different modal features can be fused and compared in the same spatial dimension to improve the attack detection accuracy and real-time performance.

[0010] In any of the above technical solutions, the denoised data set corresponding to the user original data set is determined, including: determining sensitive features in the user original data set, and marking a plurality of sensitive features; respectively stripping the marked sensitive features in the voice data, the image data, the text data and the behavior data to determine the denoised data set.

[0011] In the scheme, before extracting features of different modalities, a denoising data set is determined. The various data in the denoising data set are data that have completed sensitive feature stripping. Since a poisoning attack will use sensitive information to attack users, the sensitive features in the original data set of the user are stripped in the preprocessing stage, eliminating the tampering entry that can be used by the attacker, ensuring the effectiveness of the defense system while protecting the privacy of the user; by retaining the desensitized high-order features, the accuracy of the data in the subsequent multi-modal fusion and attack detection process is ensured.

[0012] In any of the above technical solutions, optionally, the fusion features corresponding to the preprocessed data set are determined, including: obtaining a learning parameter matrix; determining a feature matrix corresponding to the preprocessed data set according to the learning parameter matrix; performing multi-head attention mechanism calculation on the feature matrix to determine the fusion features.

[0013] In the scheme, the dependency between multiple modalities is captured through the multi-head attention mechanism, the features of each modality are converted into query matrices, key matrices and value matrices, and cross-modal attention weights are calculated, and the multiple modality features are fused by combining residual connection and layer normalization to determine the fusion features.

[0014] In any of the above technical solutions, optionally, the quality of the reconstructed features is evaluated to determine the fusion feature confidence, including: performing reconstruction error analysis on the reconstructed features to determine a reconstruction error analysis parameter; determining a reconstruction quality parameter according to the reconstruction error analysis parameter; determining mutual information corresponding to the modality features and the fusion features; determining a modality consistency parameter according to the mutual information; and determining the fusion feature confidence according to the modality consistency parameter and the reconstruction quality parameter.

[0015] In the scheme, the generator in the generative adversarial network is used to reconstruct the fusion features, and the reconstruction error analysis parameter between the fusion features and the reconstructed features is calculated, and the reconstruction error analysis parameter is converted into a quality score, i.e., a reconstruction quality parameter, through a function model. By determining the reconstruction error analysis parameter and the reconstruction quality parameter, abnormal detection is performed. Normal data is in accordance with the natural distribution because of the real user operation, so the reconstruction error of the normal data is small, while the attack data has a reconstruction error value greater than the average value because the data is generated twice. By using the reconstruction error analysis parameter and the reconstruction quality parameter to identify synthetic or tampered parameters, the robustness of user anomaly detection is improved.

[0016] In any of the above technical solutions, optionally, the attack mode matching confidence is determined, including: receiving a historical attack sample through a generator in a generative adversarial network; generating a poisoning attack sample according to the historical attack sample; processing modal features through a discriminator in the generative adversarial network using a double-branch network architecture, the double-branch network architecture including a first branch corresponding to a preprocessed data set and a second branch corresponding to the poisoning attack sample; determining a user feature query matrix according to the first branch; determining a poisoning attack sample feature key-value matrix and a poisoning attack sample feature value matrix according to the second branch; determining a cross-modal attention parameter according to the user feature query matrix, the poisoning attack sample feature key-value matrix, and the poisoning attack sample feature value matrix; and determining the attack mode matching confidence according to the cross-modal attention parameter.

[0017] In the present solution, the generative adversarial network and the cross-modal attention mechanism are combined to detect multi-modal poisoning attacks and determine the matching confidence between the user original data set and the poisoning attack sample, i.e., the attack mode matching confidence.

[0018] In any of the above technical solutions, optionally, the defense action is triggered according to the security confidence parameter, including: obtaining a defense response strategy;

[0019] determining a risk level according to the security confidence parameter; and determining the defense action according to the risk level and the defense response strategy.

[0020] In the present solution, the original data set input by the user is dynamically responded based on the defense response strategy, the corresponding interval is determined through the security confidence parameter, the risk level corresponding to the user original data set is determined through the confidence interval, and the defense action is responded according to the risk level and the preset parameter in the defense response strategy. The defense response strategy includes the risk level, the confidence interval, the action triggering condition, and the defense action. The risk level corresponding to the user original data is determined through the value of the security confidence, and the defense action is made for the risk level.

[0021] In any of the above technical solutions, optionally, the multi-modal poisoning attack defense method further includes: determining a six-stage dialogue process based on a hidden Markov model; determining an abnormal state in a preprocessed data set processing process according to the six-stage dialogue process; and triggering the defense action when the abnormal state is detected.

[0022] In the scheme, a dynamic conversation state machine (Deep Structured Semantic Model, DSSM) is constructed based on a Hidden Markov Model (HMM) to form a six-stage conversation process. The six-stage conversation process includes an identity verification stage, a business handling stage, a confirmation stage, an execution stage and an end stage. The DSSM is used to calculate the abnormal probability of state transition in real time. When illegal jump is detected, a fuse mechanism is triggered and the attack path is traced back.

[0023] The second aspect of the embodiment of the application provides a multi-modal poisoning attack defense system, which comprises: a dynamic response module, configured to obtain a preprocessed data set; a feature fusion module, configured to determine fusion features corresponding to the preprocessed data set; to perform feature reconstruction on the fusion features to determine reconstructed features; to perform quality evaluation on the reconstructed features to determine fusion feature confidence; a federal defense module, configured to obtain historical attack samples; inputting the historical attack samples and the preprocessed data set into a generative adversarial network to determine attack mode matching confidence; determining a security confidence parameter according to the fusion feature confidence and the attack mode matching confidence; and a security defense module, configured to trigger a defense action according to the security confidence parameter.

[0024] The multi-modal poisoning attack defense system provided by the application implements a multi-modal poisoning attack defense method, fuses and reconstructs multi-modal features in user data to determine fusion feature confidence, analyzes multi-modal poisoning attack samples and user multi-modal features by combining a generative adversarial network comprising a double-branch network architecture to determine attack mode matching confidence, and finally determines security confidence according to fusion feature confidence and attack mode matching confidence, thereby achieving a balance between comprehensive defense and dynamic adaptability and improving the accuracy and robustness of multi-modal data poisoning defense.

[0025] In any of the above technical solutions, the multi-modal poisoning attack defense system further comprises a perception defense module, configured to determine a six-stage conversation process based on a Hidden Markov Model, determine an abnormal state in the preprocessed data set processing process according to the six-stage conversation process, and trigger the defense action when the abnormal state is detected.

[0026] Additional aspects and advantages of the technical solutions of the application will become apparent from the following description section or will be appreciated by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 A flowchart of a multi-modal poisoning attack defense method according to an embodiment of the application is shown;

[0028] Figure 2Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0029] Figure 3 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0030] Figure 4 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0031] Figure 5 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0032] Figure 6 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0033] Figure 7 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0034] Figure 8 Part flow diagram of a multi-modal poisoning attack defense method according to an embodiment of the present application is shown;

[0035] Figure 9 Structure schematic block diagram of a multi-modal poisoning attack defense system according to an embodiment of the present application is shown.

[0036] Wherein, Figure 9 The correspondence between the reference signs and the component names in the accompanying drawings is as follows:

[0037] 900: multi-modal poisoning attack defense system; 902: dynamic response module; 904: feature fusion module; 906: federal defense module; 908: security defense module; 910: perception defense module. DETAILED DESCRIPTION

[0038] In order to more clearly understand the above-mentioned purposes, features and advantages of the embodiments of the present application, the embodiments of the present application are further described in detail below in combination with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0039] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, however, embodiments of the present application can also be implemented in other ways different from those described herein, therefore, the scope of protection of the present application is not limited to the specific embodiments disclosed below.

[0040] The following will be described in combination with the accompanyingFigures 1 to 9 The multi-modal poisoning attack defense method and system provided by the embodiments of the application are described in detail through specific embodiments and application scenarios.

[0041] The embodiments provide a multi-modal poisoning attack defense method, as shown in the figure, the multi-modal poisoning attack defense method comprises: Figure 1

[0042] Step S100: Obtain a pre-processed data set;

[0043] Step S102: Determine a fusion feature corresponding to the pre-processed data set;

[0044] Step S104: Perform feature reconstruction on the fusion feature to determine a reconstructed feature;

[0045] Step S106: Perform quality evaluation on the reconstructed feature to determine a fusion feature confidence;

[0046] Step S108: Obtain a historical attack sample;

[0047] Step S110: Input the historical attack sample and the pre-processed data set into a generative adversarial network to determine an attack mode matching confidence;

[0048] Step S112: Determine a security confidence parameter according to the fusion feature confidence and the attack mode matching confidence;

[0049] Step S114: Trigger a defense action according to the security confidence parameter.

[0050] According to the multi-modal poisoning attack defense method provided by the application, the pre-processed data set including multi-modal data is subjected to feature fusion, and the fusion feature generated after fusion is subjected to feature reconstruction to determine the reconstructed feature corresponding to the pre-processed data set. In combination with the federal knowledge collaboration and dynamic response mechanism, a full-process defense system from multi-modal data preprocessing to attack interception and triggering of defense actions is constructed. The multi-modal poisoning attack defense method also combines a generative adversarial network, wherein the generator in the generative adversarial network outputs a poisoning attack sample, the discriminator in the generative adversarial network processes multi-modal features through a double-branch network, fuses two branch information of a user branch and an attack branch through a cross-branch attention mechanism to determine a cross-modal attention parameter of the user feature and the attack sample feature, determines an attack mode matching confidence according to the cross-modal attention parameter, and the smaller the value corresponding to the attack mode matching confidence is, the more similar the user data feature and the poisoning attack sample are. Finally, a security confidence parameter is determined according to the attack mode matching confidence and the fusion feature confidence to trigger the corresponding defense action of the system.

[0051] ​Understandably, the multi-modal poisoning attack defense method provided by the application determines the fusion feature confidence by fusing and reconstructing the multi-modal features in the user data; analyzes the multi-modal poisoning attack samples and user multi-modal features by combining the generative adversarial network including the double-branch network architecture, and determines the attack mode matching confidence; and finally determines the security confidence according to the fusion feature confidence and the attack mode matching confidence, which realizes the balance between comprehensive defense and dynamic adaptability, and improves the accuracy and robustness of multi-modal data poisoning defense. The way of determining the attack mode only by the similarity between the single-modal feature and the historical attack sample has limitations and cannot detect cross-modal data. The application is aimed at this problem, fuses and reconstructs the multi-modal data of the user, and performs consistency analysis and quality evaluation on the reconstructed features to determine the fusion feature confidence, and determines the final security confidence through the fusion feature confidence and the attack mode matching confidence. Through the multi-analysis of user multi-modal data, the attack mode matching cannot cover unknown attacks and complex forgery scenes, and the generalization ability and robustness of the system are improved.

[0052] And, since the security confidence is obtained by combining the double confidence, the security confidence takes into account the rapid interception of known attacks and the active discovery of unknown threats, and at the same time, through dynamic weight adaptation to different business scenarios, the security of the multi-modal poisoning attack defense is improved.

[0053] Further, since the fusion feature confidence is obtained by fusing and reconstructing the multi-modal features again, it can adapt to various use scenarios, and the generalization ability and application range of the multi-modal poisoning attack defense method are improved.

[0054] Specifically, in the data collection phase, the system collects the original multi-modal data of the user through the data sandbox mechanism and performs preprocessing to improve the robustness in the data processing process and protect the information security and privacy of the user. In the process of fusing the features in the preprocessed data set, the system introduces a multi-head attention mechanism to convert the multi-modal features of the user into query, key, and value matrices, dynamically calculates the cross-modal correlation weight, generates fusion features through residual connection and layer normalization, improves the complementarity and consistency of multi-modal data, and suppresses noise interference.

[0055] Exemplarily, the original data corresponding to the preprocessed data set in the multi-modal poisoning attack defense method comes from multiple data interfaces such as bank automatic teller machines, counters, intelligent terminals, mobile phone banking mobile software, and web banking application programming interfaces (APIs). For example, user operation video streams, touch screen interaction behaviors, and user voice instructions of the bank automatic teller machine port; certificate scanning information, user facial feature data, and user signature data in the user identity authentication process of the counter terminal.

[0056] Specifically, the formula used to determine the security confidence parameter according to the fusion feature confidence and the attack pattern matching confidence is as follows:

[0057] C = μ × C fusion + (1-μ) × C pattern ;

[0058] Wherein, C is the security confidence parameter, μ is the first balance parameter, C fusion is the fusion feature confidence, and C pattern is the attack pattern matching confidence.

[0059] Optionally, the default value of the first balance parameter is 0.6, the system is provided with a risk threshold, and the risk parameter is detected in real time through the multi-modal poisoning attack defense system. When the risk parameter is higher than the risk threshold, it is determined that the business scene is a high-risk scene, and the first balance parameter is automatically adjusted to 0.4. Under the balance parameter setting, it is inclined to attack pattern matching, which is used to find poisoning data in the business scene; when the risk parameter is lower than the risk threshold, it is determined that the business scene is a low-risk scene, and the first balance parameter is automatically adjusted to 0.7. Under the balance parameter setting, it is inclined to fusion feature analysis, which is used to protect user data security.

[0060] In some embodiments, as shown in Figure 2 , step S100: acquiring a preprocessed data set, comprising:

[0061] Step S1002: collecting a user original data set, the user original data set comprising voice data, image data, text data and behavior data;

[0062] Step S1004: determining a denoised data set corresponding to the user original data set;

[0063] Step S1006: determining a plurality of modal features in the denoised data set, the modal features comprising a voice modal corresponding to the voice data, an image modal corresponding to the image data, a text modal corresponding to the text data, and a behavior modal corresponding to the behavior data;

[0064] Step S1008: mapping the voice modal, the image modal, the text modal and the behavior modal to the same latitude and performing time sequence alignment to determine the preprocessed data set.

[0065] In this embodiment, the original data set of the user in the business scenario is collected, and the original data set includes voice data, image data, text data and behavior data of the user. Multiple data in the original data set correspond to the same business process. By denoising the original data set of the user, abnormal signals or private information in multiple data are removed to generate a denoised data set, thereby improving data quality, reducing noise interference on subsequent feature extraction and model training, and improving operation efficiency. Multiple modal features in the denoised data set are determined, key information required for attack detection is retained, and multiple modalities are mapped to the same latitude and time sequence aligned to eliminate dimensional differences, so that different modal features can be fused and compared in the same spatial dimension, improving attack detection accuracy and real-time performance.

[0066] Specifically, after obtaining the denoised data set, multiple data in the denoised data set need to be extracted by corresponding neural network architectures.

[0067] The extraction method of the voice modality includes: determining 13-dimensional Mel-Frequency Cepstral Coefficients (MFCC) of the voice data in the denoised data set, which is used to represent the vocal characteristics of the voice; extracting 128-dimensional voiceprint vectors in the MFCC through a convolutional neural network model ResNet-50, and taking the 128-dimensional voiceprint vectors as the voice modality;

[0068] The extraction method of the image modality includes: extracting 2048-dimensional convolution layer features of the image data through a residual network (Residual Network, ResNet); calculating a living body probability in the 2048-dimensional convolution layer features through a three-dimensional (Three Dimensions, 3D) structured light analysis; and determining the convolution layer features with the living body probability exceeding a corresponding preset threshold as the image modality;

[0069] The extraction method of the text modality includes: obtaining 768-dimensional semantic vectors through a Bidirectional Encoder Representations from Transformers (BERT) pre-training model; outputting a sentiment polarity score based on a Robustly Optimized BERT Pretraining Approach (RoBERTa) model; and determining the semantic vectors with the sentiment polarity score exceeding a corresponding preset threshold as the text modality;

[0070] The extraction manner of the behavior mode comprises: acquiring a user click heat map; converting the user click heat map into a 128-dimensional action mode vector through long short-term memory (LSTM) encoding, and taking the 128-dimensional action mode vector as the action mode.

[0071] Exemplarily, the user click heat map is a 100*100 pixel heat map.

[0072] Further, after determining the voice mode, the text mode, the image mode and the behavior mode, the method further comprises: performing feature standardization processing on the voice mode, the text mode, the image mode and the behavior mode to determine a standardized feature set. The formula of the standardized feature set is:

[0073] F' = {f'1, f'2, f'3, f'4};

[0074] Wherein, F' is the standardized feature set, f'1 is the standardized voice mode feature, f'2 is the standardized text mode feature, f'3 is the standardized image mode feature, and f'4 is the standardized behavior mode feature.

[0075] f' i = LayerNorm (FC (f i ));

[0076] Wherein, f' i is any standardized feature, LayerNorm is layer normalization, FC is a full connection layer, and f i is any mode.

[0077] Through the standardization processing, the multiple mode features are mapped to the same latitude, and the feature scale difference is eliminated through the layer normalization; through the processing manner of the full connection layer on the single mode, the single mode feature dimension reduction / dimension increase conversion is completed.

[0078] Further, the multi-modal time sequence alignment adopts a dynamic time warping (DTW) algorithm to synchronize timestamps between multiple modes, and calculates an alignment cost matrix:

[0079] D(i,j) = max(D(i-1,j), D(i,j-1), D(i-1,j-1));

[0080] wherein i represents the modality index of the first time series, j represents the modality index of the second time series, D(i, j) is the minimum accumulated alignment cost from the starting point (1, 1) to the current point (i, j) of the sequence, D(i-1, j) is the accumulated cost from (i-1, j) to (i, j), D(i, j-1) is the accumulated cost from (i, j-1) to (i, j), and D(i-1, j-1) is the accumulated cost from (i-1, j-1) to (i, j).

[0081] By aligning the timestamp between the standardized modalities through the alignment cost matrix D, since multiple data in the original data set correspond to the same business process, the standardized modalities are further aligned by aligning the timestamps, thereby improving the data accuracy of the user data set.

[0082] Exemplarily, the voice data is a voice prompt received by the user when completing the mobile phone online banking API payment, the image data is a prompt image or a user face image received by the user when completing the online banking API payment, the text data is related text information displayed on the mobile terminal when the user completes the online banking API payment, and the behavior data is a screen touch instruction received by the mobile terminal in the online banking API payment operation process.

[0083] In some embodiments, optionally, as shown in Figure 3 Step S1004: determining a denoised data set corresponding to the user original data set, comprising:

[0084] Step S10042: determining sensitive features in the user original data set, and marking the sensitive features.

[0085] Step S10044: stripping the marked sensitive features in the voice data, the image data, the text data, and the behavior data respectively, and determining a denoised data set.

[0086] In this embodiment, the denoised data set is determined before the features of different modalities are extracted. The multiple data in the denoised data set are data after the sensitive feature stripping. Since the poisoning attack will use sensitive information to attack the user, the sensitive features in the user original data set are stripped in the preprocessing stage, and the tampering entry that can be used by the attacker is eliminated, thereby protecting the user privacy and ensuring the effectiveness of the defense system; by retaining the high-order features after desensitization, the data accuracy in the subsequent multi-modal fusion and attack detection process is ensured.

[0087] Further, by determining the denoised data set by stripping the sensitive features, the limitations of the user original data set are eliminated, and the adaptability of the multi-modal poisoning attack defense method to different business scenarios is improved.

[0088] Specifically, the sensitive features in the original user data set are labeled first, the sensitive features in the voice data include user identity features, conversation environment features and user voice emotion features, the sensitive features in the image data include face key points, face expression features and skin color features, the sensitive features in the text data include personal identity information, account information and password information, and the sensitive features in the behavior data include precise location information, device unique identifier and input mode features.

[0089] After the sensitive feature labeling is completed, the labeled features are stripped. Each sensitive feature corresponds to a blurring or replacement method, and the sensitive features are converted into blurred data through the blurring method, or the sensitive features are replaced with general parameters through the replacement method.

[0090] Exemplarily, the sensitive feature stripping in the preprocessing stage includes:

[0091] Voice data stripping: adding random noise to the user voice emotion features through the spectrum perturbation technology;

[0092] Image data stripping: performing pixel random offset on the face key points in the face data to determine a key point offset layer; performing Gaussian blur processing on the key point offset layer to determine a data stripping layer, and taking the data stripping layer as new face image data;

[0093] Text data stripping: obtaining a general marker; replacing the sensitive features in the text data with the general marker through the entity replacement technology;

[0094] Behavior data stripping: determining the information granularity parameter of the sensitive features in the behavior data; reducing the information granularity parameter. For example, obtaining the precise location information and determining the user precise location information granularity parameter; reducing the user precise location information granularity parameter, which aims to convert the user location precise coordinates into regional range data.

[0095] It can be understood that, by stripping the sensitive features of the user in the original user data set, the safety of the user information is ensured, and the data security and privacy of the user in the bank related business scene are improved.

[0096] In some embodiments, optionally, as shown in Figure 4 Step S102: determining the fusion features corresponding to the preprocessed data set, including:

[0097] Step S1022: obtaining a learning parameter matrix;

[0098] Step S1024: determining a feature matrix corresponding to the preprocessed data set according to the learning parameter matrix;

[0099] Step S1026: Multi-head attention mechanism calculation is performed on the feature matrix to determine the fusion feature.

[0100] In this embodiment, the dependency relationship between the multiple modalities is captured through the multi-head attention mechanism, the modal feature is converted into a query matrix, a key matrix and a value matrix, and the cross-modal attention weight is calculated. The residual connection and layer normalization are combined to fuse the multiple modal features to determine the fusion feature.

[0101] Understandably, by integrating the heterogeneous data of the voice feature, the image feature, the text feature and the behavior feature, the noise interference of a single modality is further eliminated. Through the multiple modal feature fusion mode, the feature expression capability is improved, the fusion feature has a composite meaning, the problem of insufficient representation of a single feature modality to a complex mode is solved, and through the multiple modal feature fusion mode, the modality replacement attack can be prevented, thereby improving the robustness of subsequent attack detection.

[0102] Specifically, three groups of weight matrices are obtained through training and learning, i.e., the learning parameter matrix includes a query weight matrix, a key weight matrix and a value weight matrix. The weight matrix maps the multiple modal features to different semantic spaces, and the initial value of the weight matrix is randomly initialized in the training process. The standardized feature is converted into a query matrix, a key matrix and a value matrix through the weight matrix. The query matrix, the key matrix and the value matrix are divided into multiple sub-matrices, i.e., multiple attention heads, wherein each head independently calculates the attention weight. The attention weight calculates the correlation strength between different modal features through a softmax function, for example, the consistency weight between the voice emotion and the text instruction. The multiple sub-matrices generate the subspace fusion feature in combination with the attention weight, the outputs of all heads are spliced, and a unified 256-dimensional fusion feature is generated through a fully connected layer.

[0103] In the fusion feature generation process, the residual connection and the layer normalization are combined to prevent gradient disappearance between the modalities.

[0104] The formula for converting the modal features of the user into a feature matrix is as follows:

[0105] Q=F'xW Q ;

[0106] K=F'xW K ;

[0107] V=F'xW V ;

[0108] Wherein, Q is a query matrix, K is a key matrix, V is a value matrix, F' is a standardized feature set, W Q , W K and W V are learning parameter matrices, and WQ W is a query weight matrix, K W is a key weight matrix, V W is a value weight matrix.

[0109] The calculation formula based on the attention mechanism is as follows:

[0110]

[0111] Wherein, d k is the key latitude, Q is the query matrix, K is the key matrix, V is the value matrix, K T is the transpose of the key matrix, and Attention(Q, K, V) is the attention output matrix.

[0112]

[0113] MultiHead(Q, K, V) = Concat(head1,...,head h )×W o ;

[0114] Wherein, j is the modal index of the second time sequence, Q is the query matrix, K is the key matrix, V is the value matrix, j is the modal order, is the query weight projection matrix of the jth head, is the key weight projection matrix of the jth head, is the value weight projection matrix of the jth head, Concat is the connection function, head j is the jth head, h is the number of attention heads, W o is the output control matrix, and MultiHead(Q, K, V) is the multi-head attention output matrix.

[0115] Optionally, the learning parameter matrix is determined according to different bank business scenarios, and the corresponding weight of the business scenario is assigned by sensing different business scenarios, and the weight is taken as the initial value of the learning parameter matrix.

[0116] The formula for determining the weight ω of the business scenario sensing is as follows:

[0117] ω = {ω1, ω2, ω3, ω4};

[0118] Wherein, ω1 is the voice modal weight, ω2 is the image modal weight, ω3 is the text modal weight, and ω4 is the behavior modal weight.

[0119] Exemplarily, in the remittance transfer service scenario, ω1=0.3, ω2=0.2, ω3=0.1, and ω4=0.4; in the account opening service scenario, ω1=0.3, ω2=0.2, ω3=0.4, and ω4=0.1; in the complaint handling service scenario, ω1=0.3, ω2=0.5, ω3=0.1, and ω4=0.1; and in the information query service scenario, ω1=0.2, ω2=0.4, ω3=0.1, and ω4=0.3.

[0120] The formula for generating the fusion feature is as follows:

[0121] X fused =LayerNorm(MultiHead(Q,K,V)+Residual));

[0122] wherein X fused is the fusion feature, LayerNorm is layer normalization, Residual is residual connection, and MultiHead(Q,K,V) is a multi-head attention output matrix.

[0123] In some embodiments, as shown in FIG. 1B, step S106: quality evaluation is performed on the reconstructed feature to determine the fusion feature confidence, including: Figure 5

[0124] Step S1062: reconstruction error analysis is performed on the reconstructed feature to determine a reconstruction error analysis parameter;

[0125] Step S1064: a reconstruction quality parameter is determined according to the reconstruction error analysis parameter;

[0126] Step S1066: mutual information corresponding to the modal feature and the fusion feature is determined;

[0127] Step S1068: a modal consistency parameter is determined according to the mutual information;

[0128] Step S1070: the fusion feature confidence is determined according to the modal consistency parameter and the reconstruction quality parameter.

[0129] In this embodiment, the generator in the generative adversarial network is used to reconstruct the fusion feature, and the reconstruction error analysis parameter between the fusion feature and the reconstructed feature is calculated, and the reconstruction error analysis parameter is converted into a quality score by a function model, i.e., a reconstruction quality parameter. By determining the reconstruction error analysis parameter and the reconstruction quality parameter, abnormal detection is performed. Normal data is generated by a real user operation and conforms to a natural distribution, so the reconstruction error of the normal data is small, while the attack data is generated twice and its reconstruction error value is greater than the average value. By using the reconstruction error analysis parameter and the reconstruction quality parameter, the synthetic or tampered parameters are identified, and the robustness of user abnormal detection is improved. ​

[0130] Further, the mutual information between the plurality of modal features and the fusion feature is determined, and a modal consistency parameter is determined according to the mutual information, and logical contradictions in cross-modal detection of the multi-modal feature are detected.

[0131] Understandably, through the dual quality evaluation of the modal consistency parameter and the reconstruction quality parameter, deep verification of the multi-modal data is realized, the fusion feature confidence is determined, the synthetic or tampered attack data in the original data set of the user is identified while focusing on the data authenticity, and the logical consistency between the multi-modal data is ensured through the mutual information, thereby improving the data accuracy of subsequent attack detection.

[0132] Specifically, the fusion feature is reconstructed, and the generated reconstruction feature based on the generative adversarial network is as follows:

[0133] X recon =G(X fused );

[0134] Wherein, X recon is the reconstruction feature, G is the generator in the generative adversarial network, and X fused is the fusion feature.

[0135] The formula for reconstructing the error analysis of the fusion feature is as follows:

[0136]

[0137] Wherein, E recon is the reconstruction error analysis parameter, G is the generator in the generative adversarial network, and X fused is the fusion feature.

[0138] The formula for reconstructing the quality score is as follows:

[0139] C recon =sigmoid(β×(θ recon -E rec0n ));

[0140] Wherein, sigmoid is an S-shaped activation function, β is a sensitivity parameter, C recon is a reconstruction quality parameter, E recon is a reconstruction error analysis parameter, and θ recon is a reconstruction error threshold.

[0141] The formula for determining the mutual information corresponding to the modal feature and the fusion feature is as follows:

[0142] MI i =MI(f i ,X fused )=H(f i )+H(Xfused )-H(f i ,X fused );

[0143] Where i is the modality index of the first time series, MI i For the mutual information of the i-th standardized feature, X fused

[0144] For fusion features, f i For any standardized feature, H(f) i Let H(X) be the entropy of any standardized feature. fused ) for integration

[0145] The entropy of the symptom, H(f) i ,X fused Let MI(f) be the joint entropy of any standardized feature and fused feature. i ,X fused ) represents the mutual information between any standardized feature and the fused feature.

[0146] The formula for determining the modal consistency parameters is as follows:

[0147]

[0148] Where i is the modality index of the first time series, w i Let C be the weight of the i-th mode, n be the total number of modes, and C be the weight of the i-th mode. modal MI is a modal consistency parameter. i Let be the mutual information of the i-th standardized feature.

[0149] The formula for calculating the confidence level of multimodal features is as follows:

[0150] C fusion =λ×C modal +(1-λ)×C recon ;

[0151] Among them, C recon To reconstruct the quality parameters, C modal C is the modal consistency parameter. fusion λ represents the confidence level of the multimodal features, and λ is the second balancing parameter.

[0152] Optionally, the second balance parameter is dynamically adjusted according to the business scenario, the default value of the second balance parameter is 0.6, the system is provided with a risk threshold, and the risk parameter is detected in real time through the multi-modal poisoning attack defense system, when the risk parameter is higher than the risk threshold, it is determined that the business scenario is a high-risk scenario, and the second balance parameter is automatically adjusted to 0.5, under the balance parameter setting, the reconstruction quality and the importance of modal consistency are the same; when the risk parameter is lower than the risk threshold, it is determined that the business scenario is a low-risk scenario, and the second balance parameter is automatically adjusted to 0.7, under the balance parameter setting, the modal consistency is more important.

[0153] In some embodiments, optionally, as shown in Figure 6 Step S110: inputting the historical attack sample and the preprocessed data set into the generative adversarial network to determine the attack mode matching confidence, comprising:

[0154] Step S1102: receiving the historical attack sample through the generator in the generative adversarial network;

[0155] Step S1104: generating a poisoning attack sample according to the historical attack sample;

[0156] Step S1106: processing the modal features through the discriminator in the generative adversarial network using a double-branch network architecture, the double-branch network architecture comprising a first branch corresponding to the preprocessed data set and a second branch corresponding to the poisoning attack sample;

[0157] Step S1108: determining a user feature query matrix according to the first branch;

[0158] Step S1110: determining a poisoning attack sample feature key-value matrix and a poisoning attack sample feature value matrix according to the second branch;

[0159] Step S1112: determining a cross-modal attention parameter according to the user feature query matrix, the poisoning attack sample feature key-value matrix and the poisoning attack sample feature value matrix;

[0160] Step S1114: determining the attack mode matching confidence according to the cross-modal attention parameter.

[0161] In this embodiment, by combining the generative adversarial network and the cross-modal attention mechanism, the multi-modal poisoning attack is detected, and the matching confidence between the user original data set and the poisoning attack sample, i.e. the attack mode matching confidence, is determined.

[0162] It can be understood that by comparing the user features and the poisoning attack sample through the double-branch architecture and focusing on the key features by combining the attention mechanism, redundant calculation is reduced. By fusing text, speech, image and behavior features through cross-modal attention, at least one combination attack of modal is identified, and the accuracy and reliability of the poisoning attack defense are improved.

[0163] Exemplarily, the lightweight generative adversarial network model is deployed in multiple bank point servers, historical attack samples in the multiple bank points are obtained, the multiple historical attack samples are input into the generator as a training set, and simulated poisoning attack adversarial samples are generated through a multi-layer convolutional neural network. The poisoning attack adversarial samples include voice poisoning adversarial samples, image poisoning adversarial samples, text poisoning adversarial samples and behavior poisoning adversarial samples. For example, the voice poisoning adversarial sample is voice data with background noise or voice interference; the image poisoning adversarial sample is image data with injected Gaussian noise or local blur; and the text poisoning adversarial sample is text data with synonym replacement or semantic flip.

[0164] Further, the discriminator in the generative adversarial network includes a double-branch network architecture, wherein the first branch corresponds to the preprocessed data set, serving as a user branch to process real-time multi-modal data of the user. The first branch includes a modal-specific encoder, which completes the operation of mapping multiple modalities to the same latitude in the preprocessed data set. The second branch corresponds to the poisoning attack sample, and uses the same encoder architecture as the first branch to process multiple modalities, learn the common feature distribution of the poisoning attack adversarial samples generated by the generator, and map the common feature distribution to the same latitude.

[0165] Further, the fusion layer in the generative adversarial network combines a cross-branch attention mechanism to determine a cross-modal attention output matrix through the cross-branch attention mechanism.

[0166] Specifically, the two branch information is fused through the cross-branch attention mechanism, and the formula for calculating the cross-modal attention parameters of the first branch and the second branch is:

[0167]

[0168] wherein q is a user feature query matrix, k is a poisoning attack sample feature key matrix, v is a poisoning attack sample feature value matrix, d k is the key latitude, k T is the transpose of the key matrix, Attention(q, k, v) is the cross-modal attention output matrix, and softmax is a normalization function.

[0169] Exemplarily, the poisoning attack sample feature key-value matrix represents the mapping of the poisoning attack sample, which is used for similarity calculation with the user query feature Q. The system matches the potential attack mode through the poisoning attack sample feature key-value matrix, and the poisoning attack sample feature key-value matrix determines the part of the user input feature corresponding to the attack sample; the poisoning attack sample feature value matrix contains the actual content or semantic information of the poisoning attack sample.

[0170] The formula for determining the attack mode matching confidence degree according to the cross-modal attention parameter is as follows:

[0171] C pattern = 1 - softmax (Attention (q, k, v) x 1 d );

[0172] Wherein, Attention (q, k, v) is a cross-modal attention output matrix, C pattern is an attack mode matching confidence degree, 1 d is a vector with all elements being 1, and softmax is a normalization function.

[0173] Understandably, by multiplying the vector with all elements being 1 with the cross-modal attention output matrix, the multi-dimensional weight is compressed into a scalar value, which is convenient for normalization processing.

[0174] In some embodiments, optionally, as Figure 7 shown, step S114: triggering a defense action according to the security confidence degree parameter, including:

[0175] Step S1142: obtaining a defense response strategy;

[0176] Step S1144: determining a risk level according to the security confidence degree parameter;

[0177] Step S1146: determining a defense action according to the risk level and the defense response strategy.

[0178] In this embodiment, the original data set input by the user is dynamically responded based on the defense response strategy, the corresponding interval is determined through the security confidence degree parameter, the risk level corresponding to the original data set of the user is determined through the confidence interval, and the defense action is responded according to the preset parameters in the risk level and the defense response strategy. Wherein, the defense response strategy includes risk level, confidence interval, action trigger condition and defense action, the risk level corresponding to the original data set of the user is determined through the value of the security confidence degree, and the defense action is made according to the risk level.

[0179] Understandably, by presetting different risk levels, the risk level is matched with the confidence interval, so as to trigger the defense action in a manner, avoiding the delay and subjectivity of artificial decision, ensuring real-time interception in the case that the original data set input by the user includes a poisoning attack sample, improving the timeliness of attack interception in the business environment, thereby protecting the user information security and preventing the poisoning attack from further spreading in the business environment.

[0180] In some embodiments, optionally, as Figure 8 shown, the multi-modal poisoning attack defense method further includes:

[0181] Step S116: determining the six-stage conversation flow based on the hidden Markov model;

[0182] Step S118: determining the abnormal state in the pre-processing data set processing process according to the six-stage conversation flow;

[0183] Step S120: triggering a defense action when the abnormal state is detected.

[0184] In this embodiment, the dynamic conversation state machine (Deep Structured Semantic Model, DSSM) is constructed based on the hidden Markov model (Hidden Markov Model, HMM) six-stage conversation flow. The six-stage conversation flow includes: identity verification stage, business handling stage, confirmation stage, execution stage and end stage, the state transition abnormal probability is calculated in real time by DSSM, when illegal jump is detected, the fuse mechanism is triggered and the attack path is backtracked.

[0185] It can be understood that in the process of the user conducting bank business, the system monitors the user data transfer state in real time, and calculates the probability of abnormal transfer, when detecting the jump or operation not in the six-stage conversation flow, it is automatically determined as the highest risk level, the user's business system is fused, all the user's current transactions are terminated, the system automatically backtracks the attack path associated with the abnormal jump or abnormal operation. Through real-time monitoring of the whole process of user transaction, the accuracy of attack interception in business environment and the reliability of bank business system are improved.

[0186] The defense response strategy is shown in Table 1:

[0187] Table 1

[0188]

[0189] As shown in Table 1, C is a security confidence parameter, the risk level includes: safe, low risk, medium risk, high risk and extremely high risk, and the confidence interval corresponding to the safe level is C>0.9; the confidence interval corresponding to the low risk level is 0.7

[0190] In a specific embodiment, optionally, the multi-modal poisoning attack defense system includes a multi-modal context-aware defense module (i.e., a perception defense module), which constructs a six-stage dialogue flow (identity verification→ business handling→ confirmation→ execution→ end) based on a hidden Markov model and calculates a state transition anomaly probability in real time. When illegal jumping (such as triggering a transfer without verifying the identity) is detected, a fuse mechanism is triggered and the attack path is traced back.

[0191] The dynamic time warping algorithm is used to align the time axis of voice, text and image, and a cross-modal consistency score is defined.

[0192] The multi-modal poisoning attack defense system deploys a light GAN model on the bank point server through a lightweight federated defense module, generates poisoning attack adversarial samples based on a localized desensitization data generator, and outputs a joint confidence score through a double-branch network to process multi-modal features and dynamically enhance the robustness of the detection model.

[0193] The generator G receives the localized desensitized historical attack samples of the bank point server as input and generates simulated poisoning attack adversarial samples through a multi-layer convolutional neural network.

[0194] The generator G includes: an encoding layer: 3 convolutional layers (convolution kernel sizes are 5x5, 3x3 and 3x3) for extracting attack features; a conversion layer: 2 fully connected layers (1024 nodes and 512 nodes) for realizing feature mapping; and a decoding layer: 3 deconvolutional layers for reconstructing high-quality adversarial samples.

[0195] The generated poisoning counter-sample types include: voice poisoning: adding background noise (signal-to-noise ratio < 5 dB) or voice interference; image poisoning: injecting Gaussian noise, the peak signal-to-noise ratio (PSNR) of Gaussian noise < 20 dB, or locally blurring the image; text poisoning: synonym replacement (replacement rate 5%-15%) or semantic inversion.

[0196] The discriminator D adopts a dual-branch network architecture to process the multi-modal features.

[0197] The federal defense module aggregates the poisoning attack counter-sample features generated by each bank outlet using secure multi-party computation (MPC).

[0198] Each bank outlet maintains and updates the local poisoning attack sample library to form a local knowledge graph library (the knowledge graph knowledge mainly includes attack feature information such as deep fake pictures, device fingerprints, IP addresses, and black production techniques; the knowledge graph relationship mainly includes cross-institution money laundering gang association and high-frequency abnormal transaction patterns), and selects the majority node consistent attack features using the defense malicious client attack aggregation (Krum) algorithm. Homomorphic encryption aggregates attack features from each outlet and updates the entity library and association relationship in the global attack sample knowledge graph.

[0199] The original data used for training in the multi-modal poisoning attack defense system comes from various data entrances such as bank ATMs, counters, intelligent terminals, mobile banking APPs, and online banking APIs, specifically including user ATM operation video streams, touch screen interaction behaviors, and voice instructions on the bank ATM port; multi-modal data during the user identity authentication process on the counter terminal, including ID scanning, facial features, and signature features; user online interaction data on the mobile banking APP and online banking terminal, including click stream, dwell time, input features, user consultation content, and question type distribution, etc.

[0200] By interfacing with various business processes of the bank through the multi-modal poisoning attack defense system, more accurate attack detection and defense are achieved, and the business processes include:

[0201] Account opening business: interfaces with the account real-name authentication process, extracts multi-modal data during the authentication process, and performs defense detection;

[0202] Transfer and remittance business: interfaces with the risk control system, and focuses on monitoring multi-modal abnormalities in scenarios such as high-frequency small amount transfer, cross-bank fund aggregation, and large amount transfer, such as triggering "system fuse", synchronously notifying the bank anti-money laundering system, and performing joint anti-money laundering risk analysis.

[0203] Loan application business: interfaces with the fraud detection system, and analyzes behavioral abnormalities during the loan application process;

[0204] Complaint handling business: interface with customer satisfaction evaluation system, prevent poisoning attack in the process of complaint; identify specific induction language to bank customers, detect and defend against poisoning attacks using social engineering.

[0205] The calculation of attack confidence is the core link of the multi-modal data poisoning attack defense system, which comprehensively considers multi-modal data features, cross-modal consistency and attack mode matching. The following is the specific defense implementation process:

[0206] Step one: data collection and sensitive feature stripping

[0207] 1.1: Banking data collection: the original data used for training comes from various data portals such as Automated Teller Machine (ATM), counter, intelligent terminal, mobile banking APP, and Internet banking API, including user ATM operation video stream, touch screen interaction behavior, and voice instructions on the bank ATM port; multi-modal data of user identity authentication process on the counter terminal, including certificate scanning, facial features, and signature features; user online interaction data on mobile banking APP and Internet banking, including click stream, dwell time, input features, user consultation content, and problem type distribution.

[0208] 1.2: Sensitive feature labeling: first determine the sensitive modality at the original data level, poisoning attacks usually try to obtain user sensitive information, and preprocessing stage strips sensitive features to protect user privacy and does not affect the effectiveness of the defense system, providing clean high-quality data for subsequent analysis and reducing data noise.

[0209] Sensitive modality labeling at the original data level: voiceprint data: speaker identity features, speaking environment features, and emotion features; face data: facial key points (eyes, nose, mouth), facial expression features, and skin color features; text data: personal identity information (name, phone number, ID number), account information, and password information; behavior data: precise location information, device unique identifier, and input mode features.

[0210] 1.3: Sensitive feature stripping: original data preprocessing stage: voice data: spectral perturbation technology (adding ±2dB random noise) to blur speaker features; face data: key point perturbation (±2 pixel random offset) and Gaussian blur (σ = 1.5) processing; text data: entity replacement technology, using general markers to replace sensitive information; behavior data: reduce the granularity of location information (to the area rather than the precise coordinates).

[0211] Step two: multi-modal data feature extraction and standardization: different modalities require special neural network architectures for feature extraction, such as temporal models for speech and convolutional networks for images. The original feature dimensions of different modalities are inconsistent and need to be mapped to a unified dimension for subsequent fusion and comparison. By extracting the most valuable and discriminative features through professional models, we can convert heterogeneous features of different modalities into the same feature space, eliminate the dimensional differences between different modal features, and make subsequent calculations more accurate.

[0212] 2.1: Modal feature extraction: Speech modality f1: Extract 13-dimensional Mel Frequency Cepstral Coefficients (MFCC) to represent the vocal characteristics of speech; extract 128-dimensional voiceprint vectors through ResNet-50. Text modality f2: Obtain 768-dimensional semantic vectors through the BERT pre-training model; output sentiment polarity scores (range [0, 1]) based on the RoBERTa model. Image modality f3: Extract 2048-dimensional convolutional layer features through ResNet; calculate the probability of living (range [0, 1]) through 3D structured light analysis. Behavior modality f4: Through user click heat map, 100x100 pixel heat map reflects user click intensive area; encode 128-dimensional behavior pattern vector through LSTM.

[0213] 2.2: Feature standardization: all features are mapped to the same dimension d = 256, LayerNorm is the layer normalization operation to eliminate feature scale differences, and FC is the full connection layer for feature dimension reduction and conversion.

[0214] The formula for the standardized feature set is:

[0215] F' = {f'1, f'2, f'3, f'4};

[0216] Where F' is the standardized feature set, f'1 is the standardized speech modality feature, f'2 is the standardized text modality feature, f'3 is the standardized image modality feature, and f'4 is the standardized behavior modality feature.

[0217] f' i = LayerNorm(FC(f i ));

[0218] Where f' i is any standardized feature, LayerNorm is the layer normalization, FC is the full connection layer, and f i is any modality.

[0219] Step three: multi-modal feature fusion: traditional simple concatenation or average fusion methods ignore the interaction between modalities, while multi-head attention mechanism can capture complex dependencies between modalities. In different banking scenarios, the importance of each modality is different, and the weight needs to be dynamically adjusted.

[0220] 3.1: Multi-modal time alignment: Synchronize multi-modal timestamps using dynamic time warping algorithm, calculate alignment cost matrix:

[0221] D(i,j) = max(D(i-1,j), D(i,j-1), D(i-1,j-1));

[0222] where i represents the modal index of the first time series, j represents the modal index of the second time series, D(i,j) is the minimum accumulated alignment cost from the starting point (1,1) to the current point (i,j) of the sequence, D(i-1,j) is the cumulative cost from (i-1,j) to (i,j), D(i,j-1) is the cumulative cost from (i,j-1) to (i,j), and D(i-1,j-1) is the cumulative cost from (i-1,j-1) to (i,j).

[0223] 3.2: Multi-head attention mechanism for multi-modal feature fusion: Convert each modal feature of the user into a feature matrix, the formula is as follows:

[0224] Q = F' x W Q ;

[0225] K = F' x W K ;

[0226] V = F' x W V ;

[0227] where Q is the query matrix, K is the key matrix, V is the value matrix, F' is the standardized feature set, W Q , W K and W V are learning parameter matrices, W Q is the query weight matrix, W K is the key weight matrix, and W V is the value weight matrix.

[0228] Q, K, V are derived from different transformations of all multi-modal features. W Q , W K and W V are learnable parameter matrices, which are weight parameters learned in the training data, not fixed values by humans, used to convert input features to appropriate feature spaces to help the model capture key patterns in the data, and the initial values are randomly initialized by the training process.

[0229] After introducing the attention mechanism, the formula for calculation is as follows:

[0230]

[0231] where d kis the key matrix, V is the value matrix, K T is the transpose of the key matrix, Attention(Q, K, V) is the attention output matrix, and softmax is a normalization function.

[0232] The multi-head attention mechanism is introduced to calculate the multi-modal feature fusion:

[0233]

[0234] MultiHead(Q, K, V) = Concat(head1,..., head h ) x W o ;

[0235] where Q is the query matrix, K is the key matrix, V is the value matrix, is the query weight projection matrix of the jth head, is the key weight projection matrix of the jth head, is the value weight projection matrix of the jth head, Concat is the concatenation function, head j is the jth head, h is the number of attention heads, W o is the output control matrix, and MultiHead(Q, K, V) is the multi-head attention output matrix.

[0236] 3.3: Dynamic weight distribution: Set the service scenario-aware weight ω, and the formula for determining the service scenario-aware weight ω is as follows:

[0237] ω = {ω1, ω2, ω3, ω4};

[0238] where ω1 is the voice modality weight, ω2 is the image modality weight, ω3 is the text modality weight, and ω4 is the behavior modality weight.

[0239] Exemplarily, in the transfer remittance service scenario, ω1 = 0.3, ω2 = 0.2, ω3 = 0.1, and ω4 = 0.4; in the account opening service scenario, ω1 = 0.3, ω2 = 0.2, ω3 = 0.4, and ω4 = 0.1; in the complaint handling service scenario, ω1 = 0.3, ω2 = 0.5, ω3 = 0.1, and ω4 = 0.1; in the information query service scenario, ω1 = 0.2, ω2 = 0.4, ω3 = 0.1, and ω4 = 0.3.

[0240] 3.4: Fusion feature generation: The formula for fusion feature generation is as follows:

[0241] X fused = LayerNorm(MultiHead(Q, K, V) + Residual);

[0242] wherein X fused is the fusion feature, LayerNorm is the layer normalization, Residual is the residual connection, and MultiHead(Q, K, V) is the multi-head attention output matrix.

[0243] Step four: reconstruct quality evaluation process, detect data internal consistency, find unnatural or artificially synthesized abnormalities, as the first line of defense for anomaly detection, also effective for unknown attack mode, evaluate feature quality, provide reliability reference for subsequent defense decision.

[0244] 4.1: feature reconstruction: reconstruct the fusion feature, generate a reconstructed feature based on the generative adversarial network, and the formula is as follows:

[0245] X recon = G(X fused );

[0246] wherein X recon is the reconstructed feature, G is the generator in the generative adversarial network, and X fused is the fusion feature. Normal data and abnormal data show obvious differences in reconstruction, and normal data is more easily accurately reconstructed.

[0247] 4.2: reconstruction error analysis: the formula for reconstruction error analysis of the fusion feature is as follows:

[0248]

[0249] wherein E recon is the reconstruction error analysis parameter, G is the generator in the generative adversarial network, and X fused is the fusion feature.

[0250] 4.3: reconstruction quality score: the formula for reconstruction quality score is as follows:

[0251] C recon = sigmoid(β×(θ recon -E recon ));

[0252] wherein sigmoid is the S-shaped activation function, β is the sensitivity parameter, C recon is the reconstruction quality parameter, E recon is the reconstruction error analysis parameter, and θ rrcon is the reconstruction error threshold.

[0253] Exemplarily, sigmoid(x) = 1 / (1+e^(-x)), e is the natural constant, and x is the activation object.

[0254] Exemplarily, β is a sensitivity parameter, and the default value is 10; the default value of the reconstruction error threshold is 0.15; C recon The greater the ∈ [0, 1] value is, the higher the reconstruction quality is.

[0255] Step five: modal mutual information evaluation:

[0256] 5.1: Mutual information calculation: Calculate the mutual information of the data modal feature and the fusion feature, and the formula corresponding to the mutual information of the modal feature and the fusion feature is as follows:

[0257] MI i = MI(f i , X fused ) = H(f i ) + H(X fused ) - H(f i , X fused );

[0258] Wherein, i is the modal index of the first time sequence, MI i is the mutual information of the i-th standardized feature, X fused is the

[0259] fusion feature, f i is any standardized feature, H(f i ) is the entropy of any standardized feature, H(X fused ) is the entropy of the fusion feature, H(f i , X fused ) is the joint entropy of any standardized feature and the fusion feature, and MI(f i , X fused ) represents the mutual information between any standardized feature and the fusion feature.

[0260] 5.2: Modal consistency score, the modal consistency score is defined as the weighted average of the mutual information of each modal, and the formula of the modal consistency parameter is determined as follows:

[0261]

[0262] Wherein, i is the modal index of the first time sequence, w i is the weight of the i-th modal, n is the total number of modes, C modal is the modal consistency parameter, MI i is the mutual information of the i-th standardized feature, and C modal ∈ [0, 1] value is greater, indicating that the consistency between modes is higher, verifying whether each modal comes from the same interaction scene, preventing modal replacement attack, highlighting the contribution of important modes through the weight mechanism, and improving detection accuracy.

[0263] Step six: multi-modal feature confidence calculation, the calculation formula of multi-modal feature confidence is as follows:

[0264] C fusion =λ×C modal +(1-λ)×C recon ;

[0265] Wherein, C recon is the reconstruction quality parameter, C modal is the modal consistency parameter, C fusion is the multi-modal feature confidence, λ is the second balance parameter, λ can be dynamically adjusted according to the business scene: high-risk scene: λ = 0.5 (reconstruction quality and modal consistency are equally important); Low-risk scene: λ = 0.7 (modal consistency is more important); C fusion ∈[0,1] value is larger, indicating that the fusion feature confidence is higher.

[0266] Step seven: attack mode matching confidence calculation, for the accurate identification ability of known attack mode, through the double branch structure to realize the accurate comparison of user features and attack samples.

[0267] 7.1: construction of adversarial network double branch network, the double branch network includes user branch (first branch) and attack branch (second branch).

[0268] User branch: processing real-time multi-modal data of users, including modal specific encoder (speech encoder, text encoder, image encoder, behavior encoder), each modal is processed by an independent encoder, speech uses CNN+LSTM architecture, text uses RoBERTa, image uses ResNet-50, behavior uses LSTM, all features are uniformly mapped to a 256-dimensional space.

[0269] Attack branch: receiving the simulated attack samples generated by the generator G, processing the samples in the local knowledge graph library, using the same encoder architecture as branch one to process each modal, learning the common feature distribution of poisoning attacks, and performing the same 256-dimensional mapping on the attack sample features.

[0270] 7.2: cross-branch attention calculation, the cross-branch attention mechanism fuses the information of the two branches, and calculates the cross-modal attention score of the user feature and the attack sample feature.

[0271] The formula for calculating the cross-modal attention parameters of the first branch and the second branch is:

[0272]

[0273] Wherein, q is the user feature query matrix, k is the poisoning attack sample feature key matrix, v is the poisoning attack sample feature value matrix, d k is the key latitude, kT is the transpose of the key matrix, Attention(q, k, v) is the cross-modal attention output matrix, and softmax is the normalization function.

[0274] k represents the mapping representation of the attack sample feature, which is used for similarity calculation with the query matrix Q, and the system uses it to "index" or "find" the potential matching pattern, which determines which part of the attack sample the user input feature should focus on, and k comes from the feature representation of the simulated attack sample generated by the GAN generator. v contains the actual content or semantic information of the attack sample, and the relevant information is extracted from v after the system determines the similarity between the user feature and the attack feature, and the output of the final attention mechanism is the weighted combination of v, and the weight is determined by the similarity of q and k. v provides detailed information related to potential attacks for the final defense decision. The system first calculates the similarity between the user feature q and the attack feature k, converts these similarities into attention weights through the Softmax function, and then uses these weights to weight the combination of v to produce the final feature representation.

[0275] 7.3: Attack pattern matching confidence, the formula for determining the attack pattern matching confidence according to the cross-modal attention parameters is as follows:

[0276] C pattern =1-softmax(Attention(q,k,v)×1 d );

[0277] where Attention(q, k, v) is the cross-modal attention output matrix, C pattern is the attack pattern matching confidence, softmax is the normalization function, 1 d is a vector with all elements being 1, and C pattern The smaller the value, the more similar to the attack pattern.

[0278] Step eight: final confidence calculation:

[0279] 8.1: final confidence score, the formula used to determine the security confidence parameter according to the fused feature confidence and the attack pattern matching confidence is as follows:

[0280] C=μ×C fusion +(1-μ)×C pattern ;

[0281] where C is the security confidence parameter, μ is the first balance parameter, C fusion is the fused feature confidence, and C patternConfigure the confidence level for attack pattern matching. μ can be dynamically adjusted according to the business scenario: high-risk scenario: μ = 0.4 (tend to attack pattern matching); low-risk scenario: μ = 0.7 (tend to fusion feature analysis); the larger the C ∈ [0, 1] value, the higher the interaction security.

[0282] As shown in Table 2, the division threshold of the high-risk scenario is based on: transfer business, sensitive information, and first use of new device login, wherein the transfer business related includes: large amount of transfer whose amount exceeds 80% quantile point of user historical transfer amount; transaction amount over 50,000 yuan, etc.; sensitive information change business related includes: password modification, mobile phone number binding, security question change, etc.; first use of new device login includes: new IP address, new device identifier, out-of-town login, etc. The dynamic weight corresponding to the high-risk scenario is 0.4, which focuses on attack pattern confidence.

[0283] The division threshold of the low-risk scenario is based on: non-fund sensitive operation, business consultation and balance inquiry operation, non-fund sensitive operation includes: account inquiry and quota application; business consultation includes: product information, interest rate inquiry, branch navigation; balance inquiry operation includes information acquisition behavior not involving fund change. The dynamic weight corresponding to the low-risk scenario is 0.7, which focuses on fusion feature analysis.

[0284] On the basis of fixed threshold setting, there is also a threshold dynamic adjustment mechanism:

[0285] Quarterly backtracking analysis: randomly adjust the threshold based on false positives / false negatives, up and down by ±0.2;

[0286] Threat intelligence driven: temporarily adjust the threshold according to industry threat intelligence, up and down by ±0.2;

[0287] A / B test optimization: continuously optimize the threshold setting through online experiments.

[0288] Table 2

[0289]

[0290] 8.2: Risk level division, risk level based on confidence includes: extremely high risk: C≤0.3 (confirmed as attack behavior); high risk: 0.3

[0291] 8.3: Set defense response strategy, risk level corresponding response strategy includes: very high risk: system fuse, terminate all user transactions and trigger alarm; high risk: device ban, terminate session, mark terminal as high-risk device; medium risk: manual takeover, suspend current operation and verify identity; low risk: enhanced monitoring, enhance customer background audit; safe: normal processing, standard processing flow.

[0292] Determine hierarchical dynamic response strategy, implement five-level risk level response strategy (normal processing, enhanced monitoring, manual takeover, device ban, system fuse) according to attack confidence, and the strategy response delay is ≤200 ms.

[0293] Step nine: dynamic adjustment and optimization process:

[0294] 9.1: Parameter dynamic adjustment: dynamically adjust parameters according to business scenarios, including:

[0295] Balance parameters λ, μ according to real-time scene adjustment;

[0296] Modal weight ω is dynamically allocated according to business type;

[0297] Risk threshold θ is optimized in real time according to threat intelligence.

[0298] 9.2: Model updating mechanism: incremental learning updates defense model, collects new attack samples daily to update attack feature library; performs model incremental training every week to update model parameters; performs full retraining every month to optimize overall defense capability.

[0299] The multi-modal poisoning attack defense method of the bank intelligent customer service system constructs a stereoscopic defense system through the above closely connected processes, which can accurately identify known attack patterns and be vigilant against unknown threats, while customizing defense according to bank business scene characteristics, balancing security and user experience.

[0300] Exemplarily, taking the transfer attack of fake voiceprint and tampered certificate as an example, the attack process is simulated: the attacker initiates a large amount of transfer request using AI synthesized voice (voiceprint matching degree 92%); at the same time, uploads the PS modified identity card image (the validity period is tampered).

[0301] Defense process:

[0302] (1) Feature extraction: extract MFCC features of voice, detect background noise spectrum anomaly (5 kHz above noise energy surge); certificate image PS trace (PSNR <20 dB);

[0303] (2) Feature fusion: DTW alignment finds that voice and text emotions are contradictory (similarity <0.5);

[0304] (3) Pattern matching: the federation knowledge base matches to a similar attack pattern (isomorphism 0.85);

[0305] (4) Confidence calculation: C fusion = 0.45; C pattern = 0.18; C = 0.4 * 0.45 + 0.6 * 0.18 = 0.288.

[0306] Table 3

[0307]

[0308] As shown in Table 3, the confidence interval C≤0.3, the final attack trigger system high risk level response, system fuse, terminate all transactions and trigger alarm, through the federation learning synchronization notification system, realize the industry level risk joint defense.

[0309] As Figure 9 shown, the application provides a multi-modal poisoning attack defense system 900, the multi-modal poisoning attack defense system 900 comprises: a dynamic response module 902, used for acquiring a preprocessed data set; a feature fusion module 904, used for determining fusion features corresponding to the preprocessed data set; performing feature reconstruction on the fusion features to determine reconstructed features; performing quality assessment on the reconstructed features to determine fusion feature confidence; a federal defense module 906, used for acquiring historical attack samples; inputting the historical attack samples and the preprocessed data set into a generative adversarial network to determine attack pattern matching confidence; determining a security confidence parameter according to the fusion feature confidence and the attack pattern matching confidence; and a security defense module 908, used for triggering a defense action according to the security confidence parameter.

[0310] According to the multi-modal poisoning attack defense system 900 provided by the application, the multi-modal poisoning attack defense method is realized, the multi-modal features in the user data are fused and reconstructed to determine the fusion feature confidence; the multi-modal poisoning attack samples and the user multi-modal features are analyzed by the generative adversarial network comprising the double-branch network architecture to determine the attack pattern matching confidence; and finally, the security confidence is determined according to the fusion feature confidence and the attack pattern matching confidence, so that the balance between comprehensive defense and dynamic adaptability is realized, and the accuracy and robustness of multi-modal data poisoning defense are improved.

[0311] In some embodiments, optionally, as Figure 9 shown, the multi-modal poisoning attack defense system 900 further comprises: a perception defense module 910, used for determining a six-stage dialogue process based on a hidden Markov model; determining an abnormal state in the preprocessed data set processing process according to the six-stage dialogue process; and triggering the defense action when the abnormal state is detected.

[0312] In the embodiment, the perception defense module 910 includes a DSSM, and the dynamic session state machine constructs a six-stage session flow based on an HMM. The six-stage session flow includes an identity verification stage, a business handling stage, a confirmation stage, an execution stage and an end stage. The DSSM is used to calculate an abnormal state transition probability in real time, and when illegal jumping is detected, a fuse mechanism is triggered and an attack path is traced back.

[0313] In the present application, the terms "first", "second", "third" are only for the purpose of description, and cannot be understood as indicating or implying relative importance; the term "multiple" refers to two or more, unless otherwise explicitly limited. The terms "mounting", "connecting", "connecting", "fixing" and the like should be broadly understood, for example, "connecting" can be fixed connection, or detachable connection, or integrally connected; "connected" can be directly connected, or indirectly connected through an intermediate medium. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0314] In the description of the present application, it should be understood that the terms "upper", "lower", "left", "right", "front", "back" and the like indicate the orientation or positional relationship shown in the drawings, and are only for the purpose of facilitating the description of the present application and simplifying the description, and do not indicate or imply that the devices or units referred to must have a particular direction, be constructed and operated in a particular orientation, therefore, cannot be understood as a limitation on the present application.

[0315] In the description of the present application, the terms "one embodiment", "some embodiments", "a specific embodiment" and the like mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0316] The above is only the preferred embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A multi-modal poison attack defense method, comprising: The method comprises: acquiring a preprocessed data set; determining fusion features corresponding to the preprocessed data set; performing feature reconstruction on the fusion features to determine reconstructed features; performing quality evaluation on the reconstructed features to determine fusion feature confidence; acquiring historical attack samples; inputting the historical attack samples and the preprocessed data set into a generative adversarial network to determine attack pattern matching confidence; determining a security confidence parameter according to the fusion feature confidence and the attack pattern matching confidence; triggering a defense action according to the security confidence parameter; wherein the determination of the fusion features corresponding to the preprocessed data set comprises: acquiring a learning parameter matrix; determining a feature matrix corresponding to the preprocessed data set according to the learning parameter matrix; performing multi-head attention mechanism calculation on the feature matrix to determine fusion features; the determination of the attack pattern matching confidence comprises: receiving historical attack samples through a generator in the generative adversarial network; generating a poisoning attack sample according to the historical attack sample; processing modal features through a discriminator in the generative adversarial network using a double-branch network architecture, the double-branch network architecture comprising a first branch corresponding to the preprocessed data set and a second branch corresponding to the poisoning attack sample; determining a user feature query matrix according to the first branch; determining a poisoning attack sample feature key-value matrix and a poisoning attack sample feature value matrix according to the second branch; determining a cross-modal attention parameter according to the user feature query matrix, the poisoning attack sample feature key-value matrix, and the poisoning attack sample feature value matrix; determining attack pattern matching confidence according to the cross-modal attention parameter; wherein the learning parameter matrix comprises a query weight matrix, a key weight matrix, and a value weight matrix, the weight matrix mapping multiple modal features to different semantic spaces, the initial value of the weight matrix being randomly initialized in the training process.

2. The multi-modal poison attack defense method of claim 1, wherein, The acquisition of the preprocessed data set comprises: collecting a user original data set, the user original data set comprising voice data, image data, text data, and behavior data; determining a denoised data set corresponding to the user original data set; determining multiple modal features in the denoised data set, the modal features comprising a voice modal corresponding to the voice data, an image modal corresponding to the image data, a text modal corresponding to the text data, and a behavior modal corresponding to the behavior data; mapping the voice modal, the image modal, the text modal, and the behavior modal to the same latitude and performing time alignment to determine a preprocessed data set.

3. The multi-modal poison attack defense method of claim 2, wherein, The determination of the denoised data set corresponding to the user original data set comprises: determining sensitive features in the user original data set and labeling multiple sensitive features; respectively stripping the labeled sensitive features in the voice data, the image data, the text data, and the behavior data to determine a denoised data set.

4. The multi-modal poison attack defense method of claim 2, wherein, The quality evaluation on the reconstructed features to determine fusion feature confidence comprises: performing reconstruction error analysis on the reconstructed features to determine reconstruction error analysis parameters; determine a reconstruction quality parameter according to the reconstruction error analysis parameter; determine mutual information corresponding to the modality feature and the fusion feature; determine a modality consistency parameter according to the mutual information; determine a fusion feature confidence according to the modality consistency parameter and the reconstruction quality parameter.

5. The multi-modal poison attack defense method of claim 1, wherein, the triggering of the defense action according to the security confidence parameter comprises: obtaining a defense response strategy; determining a risk level according to the security confidence parameter; determining a defense action according to the risk level and the defense response strategy.

6. The multi-modal poison pill defense method of any of claims 1-5, wherein, further comprising: determining a six-stage dialogue flow based on a hidden Markov model; determining an abnormal state in the preprocessing data set processing process according to the six-stage dialogue flow; when the abnormal state is detected, triggering the defense action.

7. A multi-modal attack by poisoning defense system, characterized in that, comprising: a dynamic response module, configured to obtain a preprocessing data set; a feature fusion module, configured to determine a fusion feature corresponding to the preprocessing data set; performing feature reconstruction on the fusion feature to determine a reconstructed feature; performing quality evaluation on the reconstructed feature to determine a fusion feature confidence; a federal defense module, configured to obtain a historical attack sample; input the historical attack sample and the preprocessing data set into a generative adversarial network to determine an attack pattern matching confidence; determine a security confidence parameter according to the fusion feature confidence and the attack pattern matching confidence; a security defense module, configured to trigger a defense action according to the security confidence parameter; wherein the determination of the fusion feature corresponding to the preprocessing data set comprises: obtaining a learning parameter matrix; determining a feature matrix corresponding to the preprocessing data set according to the learning parameter matrix; performing multi-head attention mechanism calculation on the feature matrix to determine a fusion feature; the determination of the attack pattern matching confidence comprises: receiving a historical attack sample through a generator in the generative adversarial network; generating a poisoning attack sample according to the historical attack sample; processing modality features through a discriminator in the generative adversarial network using a double-branch network architecture, the double-branch network architecture comprising a first branch corresponding to the preprocessing data set and a second branch corresponding to the poisoning attack sample; determining a user feature query matrix according to the first branch; determining a poisoning attack sample feature key-value matrix and a poisoning attack sample feature value matrix according to the second branch; determining a cross-modal attention parameter according to the user feature query matrix, the poisoning attack sample feature key-value matrix, and the poisoning attack sample feature value matrix; determining an attack pattern matching confidence according to the cross-modal attention parameter; wherein the learning parameter matrix comprises a query weight matrix, a key weight matrix, and a value weight matrix, the weight matrix mapping a plurality of the modality features to different semantic spaces, and the initial value of the weight matrix being randomly initialized in the training process.

8. The multi-modal poison attack defense system of claim 7, wherein, further comprising: a perception defense module, configured to determine a six-stage dialogue flow based on a hidden Markov model; determine an abnormal state in the preprocessing data set processing process according to the six-stage dialogue flow; when the abnormal state is detected, triggering the defense action.

Images