Model adversarial sample online detection method and system for ai anti-fraud platform

Abstract

The present application relates to the technical field of data processing, and is a model adversarial sample online detection method and system for an AI anti-fraud platform, specifically comprising: during hot updating of the anti-fraud platform, distributing incoming request traffic according to a preset shunting strategy, guiding part of the traffic to a decoy model with differentiated decision boundary for processing, and synchronously guiding the remaining main traffic to the latest version model; through an adversarial drift detection module, setting and executing an adversarial drift detection strategy, comparing the decision differences of the latest version model and the decoy model for the same request in real time, extracting pattern features of the decision difference vector, identifying the fraud attack pattern on the anti-fraud platform, and dynamically adjusting the real-time defense strategy. The present application solves the problem in the prior art that passive response is made to formed attack samples, an effective sensing and intervention mechanism cannot be established for the attacker based on the decision boundary, and a defense blind area is thus formed.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and is a method and system for online detection of adversarial samples in AI anti-fraud platforms. Background Technology

[0002] In the current field of AI-based anti-fraud, facing rapidly evolving fraud methods, deep learning-based risk control models need to maintain their identification capabilities through frequent hot updates. However, this mechanism often faces a highly covert systemic attack, where attackers take advantage of model iteration gaps to launch low-intensity, continuous probing requests. By comparing the differences in decision responses before and after model updates, attackers gradually map the drift patterns of decision boundaries. This attack mode does not directly impact a single model version but focuses on vulnerabilities in decision consistency between versions, ultimately constructing cross-version adversarial samples that are effective against multiple consecutive model versions, thus substantially negating the security gains from model updates.

[0003] Existing defense solutions are mostly based on static model assumptions, mainly targeting and hardening adversarial attacks under a single version model. They lack the ability to capture temporal attack signals generated during the dynamic process of model updates. In addition, current technology has difficulty distinguishing between normal user requests and systemic boundary probing behavior, because the two behave similarly at the single request level. This makes it impossible for traditional protection mechanisms based on outlier detection or static rule engines to effectively identify such low-frequency, persistent targeted probing attacks. Existing methods passively respond to existing attack samples and fail to establish effective perception and intervention mechanisms for attackers to draw decision boundaries, thus creating defense blind spots. Summary of the Invention

[0004] The technical problem to be solved by this invention is that in the prior art, the passive response to the established attack samples fails to establish an effective perception and intervention mechanism for the attacker's decision boundary, thus forming a defense blind spot. The invention proposes an online detection method and system for adversarial samples of models for AI anti-fraud platforms.

[0005] To achieve the above objectives, the technical solution of the online detection method for adversarial samples in an AI anti-fraud platform according to the present invention includes the following steps:

[0006] S1: Real-time acquisition and processing of multi-dimensional feature data streams of user requests, and synchronous recording of the confidence scores and final decision labels for each category of each request by the anti-fraud platform;

[0007] S2: During the hot update of the anti-fraud platform, the incoming request traffic is allocated according to the preset traffic distribution strategy. Some traffic is guided to the decoy model with differentiated decision boundaries for processing, while the remaining main traffic is guided to the latest version of the model.

[0008] S3: Through the adversarial drift detection module, set and execute the adversarial drift detection strategy, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify the fraud attack patterns against the anti-fraud platform.

[0009] S4: Dynamically adjust real-time defense strategies based on detected fraudulent attack patterns.

[0010] Preferably, in S3, the adversarial drift detection strategy includes: a detection and identification sub-strategy based on multimodal decision difference fusion analysis;

[0011] The specific detection and identification sub-strategy is as follows: by constructing a weight matrix of fraud-sensitive feature dimensions, the difference distribution of the multi-class confidence vectors output by the old and new models for the same user request is compared in multiple dimensions.

[0012] The detection and identification sub-strategies include: feature bias robustness compensation strategy, adversarial distribution offset correction strategy, and depth drift pattern extraction strategy;

[0013] The robust compensation strategy for the characteristic deviation specifically includes:

[0014] A1: Extract the decision difference vectors of the old and new models for a batch of continuous requests within a set time window, calculate the minimum value of all decision difference vectors in the output dimension of each confidence level, and obtain the minimum difference dimension of decision difference.

[0015] A2: Select the dimension with the largest value from the minimum difference dimensions to obtain the baseline model difference deviation A, and introduce a dynamic detection window for adversarial sample detection;

[0016] A3: The dynamic detection window size for each dimension is determined based on the sparsity of the decision difference vector in the time dimension and the complexity of the fraud attack pattern, thus obtaining the bias robustness compensation coefficient.

[0017] Preferably, in step A2, adversarial sample detection is as follows:

[0018] ;

[0019] in, This represents the set of adversarial samples generated within the adaptive detection window for the original input x.

[0020] This indicates the base detection window size set based on system processing latency requirements;

[0021] This represents the window adjustment range coefficient. and These represent the weights for the significance of the difference and the pattern entropy, respectively. For smoothing parameters;

[0022] Indicates the strength of fraud-specific decision-making differences; This represents the entropy of the correlation between fraud patterns.

[0023] Preferably, the adversarial distribution shift correction strategy specifically includes:

[0024] B1: Extract the deviation robustness compensation coefficients output in step A3, and perform compensation processing based on the deviation robustness compensation coefficients to obtain the compensated decision difference vector. ;

[0025] B2: Iteratively calculate the average distribution offset of the compensated decision difference vector and the offset difference of each dimension to obtain the correction values ​​of all dimensions. Arrange them in order of statistical significance from low to high to obtain the sequence of correction values ​​of the compensated decision difference vector.

[0026] B3: Extract the weighted sum of the top K% of the corrected values ​​in the corrected value sequence of the compensated decision difference vector as the reference distribution offset benchmark value, and extract the corresponding number of significant dimensions sgs. The adversarial distribution offset correction coefficient is obtained by calculating the ratio of the product of the corrected values ​​of sgs dimensions to the reference distribution offset benchmark value.

[0027] B4: Based on the convolution operation of the model decision difference value distribution density function and the adversarial distribution offset correction coefficient, the decision difference vector is dynamically corrected to obtain the bias-robust-distribution offset corrected decision difference vector.

[0028] Preferably, the depth drift pattern extraction strategy specifically includes:

[0029] A fraud behavior trajectory evolution analysis model is constructed, and combined with a fraud attack pattern recognition model trained with historical adversarial drift data, systematic attack patterns are extracted from the difference vector.

[0030] The fraud behavior trajectory evolution analysis model operates using the following strategy:

[0031] C1: The initial fraud pattern trajectory in the corrected decision difference vector is obtained through a temporal anomaly density clustering algorithm, and the initial fraud pattern trajectory is represented as a set of temporal evolution points. ;

[0032] Where t represents the time series parameter, This represents all the differential feature vectors at time point t, where n is the total number of feature dimensions;

[0033] C2: Generating multi-scale fraud pattern feature maps using a temporal convolutional network. An evolution evaluation function for fraud attack patterns is constructed, wherein the evolution evaluation function for fraud attack patterns is the sum of the temporal consistency cost subfunction and the structural stability cost subfunction;

[0034] C3: Iteratively optimize the evaluation function of the fraud attack pattern to obtain the optimal fraud pattern trajectory.

[0035] Preferably, in S3, the adversarial drift detection strategy further includes: a threat quantification sub-strategy for the evolution of fraudulent attack patterns;

[0036] The threat quantification sub-strategy includes the following steps:

[0037] D1: Within the monitoring time window T after the model hot update, continuously collect the optimal fraud pattern trajectory output by step C3;

[0038] D2: Divide the time window T into m equal-length sub-intervals. Within each sub-interval, calculate the weighted feature centroid of the optimal fraud pattern trajectory. And weighted feature centroid As a representation vector of the sub-interval fraud attack pattern;

[0039] D3: The serialized representation vector By connecting in a high-dimensional feature space, a threat evolution trajectory representing the evolution path of attack patterns is constructed;

[0040] D4: Calculate the aggregated threat index of the threat evolution trajectory;

[0041] D5: The aggregated threat index of the threat evolution trajectory is determined by a preset threat threshold. When the aggregated threat index of the threat evolution trajectory is greater than the threat threshold, the platform is determined to have detected a systemic adversarial drift attack.

[0042] Preferably, the weighted feature centroid The specific calculation strategy is as follows:

[0043] D21: Based on a historical attack pattern library, a set of basis functions for normalized patterns is generated using principal component analysis or autoencoder methods. Each basis function represents a characteristic pattern of a known attack type;

[0044] D22: Transfer the trajectory data within the sub-interval Perform cross-correlation matching with each basis function and calculate the projection coefficients on that basis function;

[0045] D23: Extract the projection coefficients on the basis function, perform phase locking and signal enhancement processing simultaneously, and obtain the optimal combined coefficient vector;

[0046] D24: The weighted eigencentroid is obtained by weighted synthesis of the activated basis functions and the optimal combination coefficient vector. And weighted feature centroid As a representation vector of the sub-interval fraud attack pattern.

[0047] Preferably, S4 includes: setting an initial threat level weight for each detected attack source, calculating the ratio of the difference between the set maximum allowable drift and the currently detected drift to the maximum allowable drift, and obtaining the weight adjustment coefficient for each attack source;

[0048] Its threat level is updated in real time by multiplying the weight adjustment coefficient by the initial weight;

[0049] Based on the updated global threat level distribution, detection computing power is reallocated and response strategies are planned.

[0050] In addition, the online adversarial sample detection system for AI anti-fraud platforms of the present invention includes the following modules:

[0051] The platform includes a data extraction module, a traffic scheduling module, an adversarial drift detection module, and a model enhancement module.

[0052] The platform data extraction module is used to collect and process multi-dimensional feature data streams of user requests in real time, and simultaneously record the confidence scores of each category and the final decision label of each request by the anti-fraud platform.

[0053] The traffic scheduling module is used to allocate incoming request traffic according to a preset traffic distribution strategy during the hot update of the anti-fraud platform, guide some traffic to the decoy model with decision boundary differentiation for processing, and simultaneously guide the remaining main traffic to the latest version of the model.

[0054] The adversarial drift detection module is used to set and execute adversarial drift detection strategies, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify fraud attack patterns against the anti-fraud platform.

[0055] The model enhancement module dynamically adjusts the real-time defense strategy based on the detected fraud attack patterns.

[0056] Compared with the prior art, the technical effects of the present invention are as follows:

[0057] 1. This invention is based on the attack detection capability of decision boundary drift law. By deploying decoy models and new models in parallel and comparing the decision differences between the two in real time, the original passive model update process is transformed into an active attack detection field. It can accurately identify the regular difference patterns presented by the attacker's low-intensity and continuous boundary mapping behavior, thereby blocking the attacker in advance before forming effective adversarial samples and preventing the formation of the basis for cross-version model attacks.

[0058] 2. This invention significantly improves the dynamic adaptability and resource utilization efficiency of the defense system. By quantitatively analyzing the temporal characteristics and statistical distribution of the difference vector, the system automatically triggers differentiated response strategies, which avoids excessive intervention in normal requests and can accurately strike requests identified as attack sources, thereby reducing false alarm rate and computational resource consumption. Attached Figure Description

[0059] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0060] Figure 1 This is a flowchart illustrating the online detection method for adversarial samples in an AI anti-fraud platform according to the present invention.

[0061] Figure 2 This is a schematic diagram of the online detection system for adversarial samples in an AI anti-fraud platform according to the present invention. Detailed Implementation

[0062] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0063] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0064] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0065] Example 1:

[0066] like Figure 1 As shown in the embodiment of the present invention, the online detection method for adversarial samples in an AI anti-fraud platform is as follows: Figure 1 As shown, the specific steps include the following:

[0067] S1: Real-time acquisition and processing of multi-dimensional feature data streams of user requests, and synchronous recording of the confidence scores and final decision labels for each category of each request by the anti-fraud platform;

[0068] For example, in this embodiment, the multidimensional feature data stream includes, but is not limited to: user behavior sequence features, device fingerprint features, biometric identification confidence level, network environment indicator features, and real-time transaction graph features;

[0069] S2: During the hot update of the anti-fraud platform, the incoming request traffic is allocated according to the preset traffic distribution strategy. Some traffic is guided to the decoy model with differentiated decision boundaries for processing, while the remaining main traffic is guided to the latest version of the model.

[0070] For example, in this embodiment, the traffic splitting strategy is as follows: based on the device fingerprint hash value and behavioral feature clustering results of the user request, the incoming request traffic is distributed according to a preset ratio splitting strategy, so that 5%-15% of the sampled traffic is processed by the decoy model with decision boundary differentiation, while ensuring that 85%-95% of the main traffic is provided by the latest version of the model.

[0071] S3: Through the adversarial drift detection module, set and execute the adversarial drift detection strategy, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify the fraud attack patterns against the anti-fraud platform.

[0072] In S3, the adversarial drift detection strategy includes: a detection and identification sub-strategy based on multimodal decision difference fusion analysis;

[0073] The specific detection and identification sub-strategy is as follows: by constructing a weight matrix of fraud-sensitive feature dimensions, the difference distribution of the multi-class confidence vectors output by the old and new models for the same user request is compared in multiple dimensions.

[0074] The detection and identification sub-strategies include: feature bias robustness compensation strategy, adversarial distribution offset correction strategy, and depth drift pattern extraction strategy;

[0075] For example, in this embodiment, the multimodal decision difference fusion analysis specifically includes:

[0076] First, establish the fraud-sensitive feature dimension weight matrix W. It should be noted that this matrix is ​​dynamically adjusted based on the discriminative power of historical fraud samples in each feature dimension, and it is a diagonal matrix.

[0077] For example, the calculation strategy for the fraud-sensitive feature dimension weight matrix W is as follows:

[0078] ;

[0079] in, ; This represents the combined score of the i-th feature dimension in terms of historical discriminativeness and real-time anomaly; n is the total number of feature dimensions, and j is the index of the feature dimension;

[0080] In this embodiment, (i.e., Fisher Discriminant Ratio) represents the Fisher discriminant ratio of the i-th feature dimension between historical fraudulent samples and normal samples. It should be noted that... Used to measure the ability of a certain feature dimension to distinguish between two types of samples (e.g., fraud / normal). The larger the value, the more important the feature is in distinguishing fraud; This represents the abnormal fluctuation coefficient of this dimension in real-time traffic, which is used to characterize whether the value of this feature dimension has recently experienced abnormal fluctuations.

[0081] Then, the output vectors representing the decisions of the latest version model and the decoy model for the same request are extracted, and the difference is calculated to obtain the initial decision difference vector. The initial decision difference vector is then multiplied by the fraud-sensitive feature dimension weight matrix W to obtain the weighted decision difference vector.

[0082] Finally, the comprehensive decision discrepancy between the latest version model and the decoy model for the same request is calculated. ;

[0083] The combined decision difference between the latest version model and the decoy model for the same request. If the difference is greater than or equal to the difference threshold, the adversarial drift detection strategy continues to be implemented, while when the overall decision difference is greater than or equal to the difference threshold, the strategy continues to be implemented. If the difference is less than the difference threshold, the sample is determined to be a normal sample and is released.

[0084] In this embodiment, the comprehensive decision difference degree It is obtained by weighted summation of the first and second decision differences;

[0085] For example, in this embodiment, the first decision difference degree Specifically:

[0086] ;

[0087] in, Let represent the output vectors of the latest version model and the decoy model for the same request, respectively. It should be noted that the first decision difference is intended to quantify the Euclidean distance between the latest version model and the decoy model for the same request.

[0088] Among them This indicates that the difference vector is weighted. Considering that attackers on anti-fraud platforms may create perturbations on unimportant features to evade the platform's defense mechanisms, this approach in this embodiment aims to select feature dimensions to amplify the attack signal and suppress bias.

[0089] For example, in this embodiment, the second decision difference degree Specifically:

[0090] ;

[0091] in, It represents the inner product of two weighted vectors;

[0092] It should be noted that the second decision difference is designed to quantify the cosine similarity of the decision differences between the latest version model and the decoy model for the same request. Cosine similarity measures the similarity of two vectors in direction. It should also be noted that the treatment of "1-" is intended to convert the similarity into a difference, and the larger the value, the greater the difference in direction.

[0093] The robust compensation strategy for the characteristic deviation specifically includes:

[0094] A1: Extract the decision difference vectors of the old and new models for a batch of continuous requests within a set time window, calculate the minimum value of all decision difference vectors in the output dimension of each confidence level, and obtain the minimum difference dimension of decision difference.

[0095] A2: Select the dimension with the largest value from the minimum difference dimensions to obtain the baseline model difference deviation A, and introduce a dynamic detection window for adversarial sample detection;

[0096] A3: The dynamic detection window size for each dimension is determined based on the sparsity of the decision difference vector in the time dimension and the complexity of the fraud attack pattern, thus obtaining the bias robustness compensation coefficient.

[0097] For example, in this embodiment, a strategy for obtaining the deviation robustness compensation coefficient Rsc is provided, specifically as follows:

[0098] ;

[0099] Where y is an adversarial sample that the attacker might generate; This represents the component of the decision difference vector in the output dimension C; The historical data mean of the decision difference vector along the output dimension C; This represents the model decision sensitivity adjustment parameter, which is dynamically adjusted based on the degree of difference between model versions. It is used to control the strength of the overall compensation effect. The calculation strategy is as follows:

[0100] ;

[0101] in, Indicates the degree of difference between model versions. These are adjustable parameters used to control the shape and center point of the Sigmoid function;

[0102] It should be noted that the model decision sensitivity adjustment parameter... When the model versions differ significantly, When the value approaches 1, the platform enters a high-sensitivity mode, requiring bias compensation. However, when the model version difference is very small... To approach zero, unnecessary compensation should be minimized as much as possible to avoid introducing additional bias.

[0103] In step A2, adversarial sample detection is as follows:

[0104] ;

[0105] in, This represents the set of adversarial samples generated within the adaptive detection window for the original input x.

[0106] This indicates the base detection window size set based on system processing latency requirements;

[0107] This represents the window adjustment range coefficient. and These represent the weights for the significance of the difference and the pattern entropy, respectively. For smoothing parameters;

[0108] To represent the strength of fraud-specific decision differences, exemplarily, in this embodiment, a method is provided. The acquisition strategy is as follows: to quantify the significance of the difference by calculating the projection value of the weighted decision difference onto the fraud sensitivity dimension;

[0109] Representing the correlation entropy of fraud patterns, exemplarily, in this embodiment, a method is provided. The acquisition strategy is as follows: measure the degree of association between the differential sequence and the known fraud pattern template and the typical fraud behavior pattern by calculating the mutual information entropy of the differential sequence and the known fraud pattern template.

[0110] It should be noted that in the anti-fraud process, using a fixed window cannot address the technical issues of varying complexity of different request characteristics and the strength and variability of attack patterns. Therefore, in this embodiment, an adversarial detection dynamic detection window is used to solve the above-mentioned technical problems.

[0111] The adversarial distribution shift correction strategy specifically includes:

[0112] B1: Extract the deviation robustness compensation coefficients output in step A3, and perform compensation processing based on the deviation robustness compensation coefficients to obtain the compensated decision difference vector. ;

[0113] For example, in this embodiment, a method based on a deviation robustness compensation coefficient is provided. An example of how to implement compensation processing is as follows:

[0114] ;

[0115] in, This represents the weighted decision difference vector; A is the difference deviation of the baseline model.

[0116] B2: Iteratively calculate the average distribution offset of the compensated decision difference vector and the offset difference of each dimension to obtain the correction values ​​of all dimensions. Arrange them in order of statistical significance from low to high to obtain the sequence of correction values ​​of the compensated decision difference vector.

[0117] B3: Extract the weighted sum of the top K% of the corrected values ​​in the corrected value sequence of the compensated decision difference vector as the reference distribution offset benchmark value, and extract the corresponding number of significant dimensions sgs. The adversarial distribution offset correction coefficient is obtained by calculating the ratio of the product of the corrected values ​​of sgs dimensions to the reference distribution offset benchmark value.

[0118] In this embodiment, it should be noted that K is a percentile threshold that is dynamically adjusted based on the proportion of historical drift attacks.

[0119] B4: Based on the convolution operation of the model decision difference value distribution density function and the adversarial distribution offset correction coefficient, the decision difference vector is dynamically corrected to obtain the bias-robust-distribution offset corrected decision difference vector.

[0120] The depth drift pattern extraction strategy specifically includes:

[0121] A fraud behavior trajectory evolution analysis model is constructed, and combined with a fraud attack pattern recognition model trained with historical adversarial drift data, systematic attack patterns are extracted from the difference vector.

[0122] The fraud behavior trajectory evolution analysis model operates using the following strategy:

[0123] C1: The initial fraud pattern trajectory in the corrected decision difference vector is obtained through a temporal anomaly density clustering algorithm, and the initial fraud pattern trajectory is represented as a set of temporal evolution points. ;

[0124] Where t represents the time series parameter, This represents all the differential feature vectors at time point t, where n is the total number of feature dimensions;

[0125] C2: Generating multi-scale fraud pattern feature maps using a temporal convolutional network. An evolution evaluation function for fraud attack patterns is constructed, wherein the evolution evaluation function for fraud attack patterns is the sum of the temporal consistency cost subfunction and the structural stability cost subfunction;

[0126] For example, in this embodiment, a timing consistency cost subfunction is provided. The specific representation is as follows:

[0127] ;

[0128] in, The time change rate of the fraud pattern feature map is represented by the cost function. It should be noted that, in this embodiment, a negative sign is used in the time consistency cost subfunction to minimize the cost.

[0129] For example, in this embodiment, a structural stability cost subfunction is also provided. The specific representation is as follows:

[0130] ;

[0131] in, The first derivative (i.e., the evolution rate) represents the trajectory of the fraud pattern. The second derivative (i.e., evolutionary acceleration) represents the trajectory of the fraud pattern. Indicates the evolutionary stability weight parameter;

[0132] It should also be noted that, for the evolution evaluation function of the fraud attack mode in this embodiment, the temporal consistency cost subfunction aims to maximize the rate of change of the feature map, that is, to ensure that the platform captures all possible deviations as much as possible. At the same time, it also takes into account that real fraudulent behavior is often purposeful and coherent, that is, an attack source will continue to attack for a period of time, rather than appearing and disappearing instantly. The characteristics of random disturbances or noise are often fluctuating or constantly shaking. Therefore, in this embodiment, the structural stability cost subfunction is used to minimize the kinetic energy of the fraud mode trajectory, that is, to select the trajectory that is as smooth as possible.

[0133] C3: Iteratively optimize the evaluation function of the fraud attack pattern to obtain the optimal fraud pattern trajectory.

[0134] For example, in this embodiment, an adaptive moment estimation optimization algorithm is used to iteratively solve the evolution evaluation function of the fraud attack pattern. When the evolution stability index of the trajectory is less than the set stability threshold, the iteration stops. At this time, the extracted fraud pattern trajectory is the fraud behavior feature of the systemic attack.

[0135] In S3, the adversarial drift detection strategy also includes: a threat quantification sub-strategy for the evolution of fraudulent attack patterns;

[0136] The threat quantification sub-strategy includes the following steps:

[0137] D1: Within the monitoring time window T after the model hot update, continuously collect the optimal fraud pattern trajectory output by step C3;

[0138] D2: Divide the time window T into m equal-length sub-intervals. Within each sub-interval, calculate the weighted feature centroid of the optimal fraud pattern trajectory. And weighted feature centroid As a representation vector of the sub-interval fraud attack pattern;

[0139] It should be noted that the weighted eigencentroid Used to characterize the mainstream features of fraud attack patterns within sub-intervals.

[0140] D3: The serialized representation vector By connecting in a high-dimensional feature space, a threat evolution trajectory representing the evolution path of attack patterns is constructed;

[0141] D4: Calculate the aggregated threat index of the threat evolution trajectory;

[0142] For example, in this embodiment, a strategy for obtaining the aggregated threat index is given, specifically as follows:

[0143] ;

[0144] in, It represents the Euclidean distance between the final state and the initial state, which is used to quantify the overall evolution of the attack pattern from the initial to the final stage.

[0145] Used to quantify the stability and persistence of the evolution process;

[0146] The total attack intensity within window T is the total number of requests, which is used to quantify the attack scale of the fraudulent attack pattern.

[0147] D5: The aggregated threat index of the threat evolution trajectory is determined by a preset threat threshold. When the aggregated threat index of the threat evolution trajectory is greater than the threat threshold, the platform is determined to have detected a systemic adversarial drift attack.

[0148] The weighted feature centroid The specific calculation strategy is as follows:

[0149] D21: Based on a historical attack pattern library, a set of basis functions for normalized patterns is generated using principal component analysis or autoencoder methods. Each basis function represents a characteristic pattern of a known attack type;

[0150] D22: Transfer the trajectory data within the sub-interval Perform cross-correlation matching with each basis function and calculate the projection coefficients on that basis function;

[0151] For example, in this embodiment, a projection coefficient is provided. The acquisition strategy is as follows: ;

[0152] in, This represents the inner product operation. Indicates the similarity between the current attack trajectory and historical attack patterns; It is the standard deviation of the fraud pattern trajectory data within this sub-interval;

[0153] D23: Extract the projection coefficients on the basis function, perform phase locking and signal enhancement processing simultaneously, and obtain the optimal combined coefficient vector;

[0154] For example, in this embodiment, an optimal combination coefficient vector is provided. The acquisition strategy is as follows:

[0155] ;

[0156] in, Represents the projection coefficient of the i-th historical attack pattern; For the combination coefficient vector, , Each element in the table represents the weight of the corresponding historical attack pattern when reconstructing the current attack signal; Describing the L1 norm, For regularization parameters;

[0157] D24: The weighted eigencentroid is obtained by weighted synthesis of the activated basis functions and the optimal combination coefficient vector. And weighted feature centroid As a representation vector of the sub-interval fraud attack pattern.

[0158] S4: Dynamically adjust real-time defense strategies based on detected fraudulent attack patterns.

[0159] S4 includes: setting an initial threat level weight for each detected attack source, calculating the difference between the set maximum allowable drift and the currently detected drift, and the ratio of this difference to the maximum allowable drift, to obtain the weight adjustment coefficient for each attack source;

[0160] Its threat level is updated in real time by multiplying the weight adjustment coefficient by the initial weight;

[0161] Based on the updated global threat level distribution, detection computing power is reallocated and response strategies are planned.

[0162] For example, in this embodiment, a defense strategy for dynamically defending against adversarial samples based on the updated global threat level distribution is also provided. Specifically, the state of each response to an attack during the defense process is defined as the current threat level distribution of each attack source; the maximum value of the difference between the threat level of the attack source with the highest threat level and the lowest threat level is defined as the objective function.

[0163] The resource consumption and false positive probability of each defensive action are used as the cost function;

[0164] For example, in this embodiment, the defense actions include, but are not limited to, enhanced verification, slider verification, or manual review;

[0165] When a new attack pattern is identified, the sum of the cumulative costs of each defense combination strategy is calculated as the total cost of that strategy.

[0166] Select the strategy with the lowest total cost as the preferred defense strategy for the next time;

[0167] The system evaluates the objective function after implementing the defense strategy. If the objective function is less than the set security threshold, the system maintains the current defense configuration. If the objective function is greater than or equal to the set security threshold, the system performs escalation measures on the attack source with the highest threat level, such as temporary blocking, until the objective function is less than the security threshold.

[0168] For example, in this embodiment, step S4 further includes: injecting the identified adversarial sample features into the model incremental learning process to enhance the model's robustness to adversarial drift attacks.

[0169] Example 2:

[0170] like Figure 2 As shown in the embodiment of the present invention, an online system for detecting adversarial samples in an AI anti-fraud platform is provided. Figure 2 As shown, it includes the following modules:

[0171] The platform includes a data extraction module, a traffic scheduling module, an adversarial drift detection module, and a model enhancement module.

[0172] The platform data extraction module is used to collect and process multi-dimensional feature data streams of user requests in real time, and simultaneously record the confidence scores of each category and the final decision label of each request by the anti-fraud platform.

[0173] The traffic scheduling module is used to allocate incoming request traffic according to a preset traffic distribution strategy during the hot update of the anti-fraud platform, guide some traffic to the decoy model with decision boundary differentiation for processing, and simultaneously guide the remaining main traffic to the latest version of the model.

[0174] The adversarial drift detection module is used to set and execute adversarial drift detection strategies, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify fraud attack patterns against the anti-fraud platform.

[0175] The model enhancement module dynamically adjusts the real-time defense strategy based on the detected fraud attack patterns.

[0176] Example 3:

[0177] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0178] The processor executes the aforementioned online adversarial sample detection method for AI anti-fraud platforms by calling computer programs stored in memory.

[0179] The electronic device can vary considerably depending on its configuration or performance. It may include one or more Central Processing Units (CPUs) and one or more memories, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the online adversarial sample detection method for the AI ​​anti-fraud platform provided in the above-described embodiment. The electronic device may also include other components for implementing its functions; for example, it may have wired or wireless network interfaces and input / output interfaces for data input and output. Details will not be elaborated upon in this embodiment.

[0180] Example 4:

[0181] This embodiment proposes a computer-readable storage medium on which an erasable and rewritable computer program is stored.

[0182] When the computer program runs on the computer device, it causes the computer device to perform the above-described online method for detecting adversarial samples for an AI anti-fraud platform.

[0183] For example, computer-readable storage media can be read-only memory (ROM), random access memory (RAM), compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage devices.

[0184] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0185] It should be understood that determining B based on A does not mean determining B solely based on A; it also means determining B based on A and / or other information.

[0186] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired network and / or wireless network. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives (SSDs).

[0187] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0188] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0189] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0190] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0191] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0192] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. An online method for detecting adversarial samples in an AI anti-fraud platform, characterized in that, The method includes: S1: Real-time acquisition and processing of multi-dimensional feature data streams of user requests, and synchronous recording of the confidence scores and final decision labels for each category of each request by the anti-fraud platform; S2: During the hot update of the anti-fraud platform, the incoming request traffic is allocated according to the preset traffic distribution strategy. Some traffic is guided to the decoy model with differentiated decision boundaries for processing, while the remaining main traffic is guided to the latest version of the model. S3: Through the adversarial drift detection module, set and execute the adversarial drift detection strategy, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify the fraud attack patterns against the anti-fraud platform. In S3, the adversarial drift detection strategy includes: a detection and identification sub-strategy based on multimodal decision difference fusion analysis; The specific detection and identification sub-strategy is as follows: by constructing a weight matrix of fraud-sensitive feature dimensions, the difference distribution of the multi-class confidence vectors output by the old and new models for the same user request is compared in multiple dimensions. The detection and identification sub-strategies include: feature bias robustness compensation strategy, adversarial distribution offset correction strategy, and depth drift pattern extraction strategy; The robust compensation strategy for the characteristic deviation specifically includes: A1: Extract the decision difference vectors of the old and new models for a batch of continuous requests within a set time window, calculate the minimum value of all decision difference vectors in the output dimension of each confidence level, and obtain the minimum difference dimension of decision difference. A2: Select the dimension with the largest value from the minimum difference dimensions to obtain the baseline model difference deviation A, and introduce a dynamic detection window for adversarial sample detection; A3: The dynamic detection window size for each dimension is determined based on the sparsity of the decision difference vector in the time dimension and the complexity of the fraud attack pattern, thus obtaining the bias robustness compensation coefficient. In step A2, adversarial sample detection is as follows: ； in, This represents the set of adversarial samples generated within the adaptive detection window for the original input x. This indicates the base detection window size set based on system processing latency requirements; This represents the window adjustment range coefficient. and These represent the weights for the significance of the difference and the pattern entropy, respectively. For smoothing parameters; Indicates the strength of fraud-specific decision-making differences; Represents the entropy of the correlation between fraud patterns; S4: Dynamically adjust real-time defense strategies based on detected fraudulent attack patterns.

2. The online method for detecting adversarial samples in an AI anti-fraud platform according to claim 1, characterized in that, The adversarial distribution shift correction strategy specifically includes: B1: Extract the deviation robustness compensation coefficients output in step A3, and perform compensation processing based on the deviation robustness compensation coefficients to obtain the compensated decision difference vector. ; B2: Iteratively calculate the average distribution offset of the compensated decision difference vector and the offset difference of each dimension to obtain the correction values ​​of all dimensions. Arrange them in order of statistical significance from low to high to obtain the sequence of correction values ​​of the compensated decision difference vector. B3: Extract the weighted sum of the top K% of the corrected values ​​in the corrected value sequence of the compensated decision difference vector as the reference distribution offset benchmark value, and extract the corresponding number of significant dimensions sgs. The adversarial distribution offset correction coefficient is obtained by calculating the ratio of the product of the corrected values ​​of sgs dimensions to the reference distribution offset benchmark value. B4: Based on the convolution operation of the model decision difference value distribution density function and the adversarial distribution offset correction coefficient, the decision difference vector is dynamically corrected to obtain the bias-robust-distribution offset corrected decision difference vector.

3. The online method for detecting adversarial samples in an AI anti-fraud platform according to claim 2, characterized in that, The depth drift pattern extraction strategy specifically includes: A fraud behavior trajectory evolution analysis model is constructed, and combined with a fraud attack pattern recognition model trained with historical adversarial drift data, systematic attack patterns are extracted from the difference vector. The fraud behavior trajectory evolution analysis model operates using the following strategy: C1: The initial fraud pattern trajectory in the corrected decision difference vector is obtained through a temporal anomaly density clustering algorithm, and the initial fraud pattern trajectory is represented as a set of temporal evolution points. ; Where t represents the time series parameter, This represents all the differential feature vectors at time point t, where n is the total number of feature dimensions; C2: Generating multi-scale fraud pattern feature maps using a temporal convolutional network. An evolution evaluation function for fraud attack patterns is constructed, wherein the evolution evaluation function for fraud attack patterns is the sum of the temporal consistency cost subfunction and the structural stability cost subfunction; C3: Iteratively optimize the evaluation function of the fraud attack pattern to obtain the optimal fraud pattern trajectory.

4. The online method for detecting adversarial samples in an AI anti-fraud platform according to claim 3, characterized in that, In S3, the adversarial drift detection strategy also includes: a threat quantification sub-strategy for the evolution of fraudulent attack patterns; The threat quantification sub-strategy includes the following steps: D1: Within the monitoring time window T after the model hot update, continuously collect the optimal fraud pattern trajectory output by step C3; D2: Divide the time window T into m equal-length sub-intervals. Within each sub-interval, calculate the weighted feature centroid of the optimal fraud pattern trajectory. And weighted feature centroid As a representation vector of the fraud attack pattern within the sub-interval; D3: The serialized representation vector By connecting in a high-dimensional feature space, a threat evolution trajectory representing the evolution path of attack patterns is constructed; D4: Calculate the aggregated threat index of the threat evolution trajectory; D5: The aggregated threat index of the threat evolution trajectory is determined by a preset threat threshold. When the aggregated threat index of the threat evolution trajectory is greater than the threat threshold, the platform is determined to have detected a systemic adversarial drift attack.

5. The online method for detecting adversarial samples in an AI anti-fraud platform according to claim 4, characterized in that, The weighted feature centroid The specific calculation strategy is as follows: D21: Based on a historical attack pattern library, a set of basis functions for normalized patterns is generated using principal component analysis or autoencoder methods. Each basis function represents a characteristic pattern of a known attack type; D22: Transfer the trajectory data within the sub-interval Perform cross-correlation matching with each basis function and calculate the projection coefficients on that basis function; D23: Extract the projection coefficients on the basis function, perform phase locking and signal enhancement processing simultaneously, and obtain the optimal combined coefficient vector; D24: The weighted eigencentroid is obtained by weighted synthesis of the activated basis functions and the optimal combination coefficient vector. And weighted feature centroid As a representation vector of the sub-interval fraud attack pattern.

6. The online method for detecting adversarial samples in an AI anti-fraud platform according to claim 5, characterized in that, S4 includes: For each detected attack source, an initial threat level weight is set, and the ratio of the difference between the set maximum allowable drift and the currently detected drift to the maximum allowable drift is calculated to obtain the weight adjustment coefficient for each attack source. Its threat level is updated in real time by multiplying the weight adjustment coefficient by the initial weight; Based on the updated global threat level distribution, detection computing power is reallocated and response strategies are planned.

7. An online system for detecting adversarial samples in an AI anti-fraud platform, used to implement the online detection method for adversarial samples in an AI anti-fraud platform as described in any one of claims 1-6, characterized in that, The system includes: The platform includes a data extraction module, a traffic scheduling module, an adversarial drift detection module, and a model enhancement module. The platform data extraction module is used to collect and process multi-dimensional feature data streams of user requests in real time, and simultaneously record the confidence scores of each category and the final decision label of each request by the anti-fraud platform. The traffic scheduling module is used to allocate incoming request traffic according to a preset traffic distribution strategy during the hot update of the anti-fraud platform, guide some traffic to the decoy model with decision boundary differentiation for processing, and simultaneously guide the remaining main traffic to the latest version of the model. The adversarial drift detection module is used to set and execute adversarial drift detection strategies, compare the decision differences between the latest version model and the decoy model for the same request in real time, extract pattern features from the decision difference vector, and identify fraud attack patterns against the anti-fraud platform. The model enhancement module dynamically adjusts the real-time defense strategy based on the detected fraud attack patterns.

Images