Multi-modal AI model attack behavior detection and blocking system

Abstract

The invention relates to the technical field of anomaly detection, in particular to a multi-modal AI model attack behavior detection and blocking system which comprises a flow distribution monitoring module, an attack behavior guide recognition module, a log time structure recognition module, an attack behavior positioning module and a modal blocking control module. According to the method, the trend change direction of multi-modal input on a time sequence is extracted, a trend reverse fragment combination quantification mechanism is constructed based on trend correlation difference between modals, and combination fragment statistics and time continuity judgment of the trend change direction are introduced; and forming an identification path for potential attack guide behaviors in combination with trend frequency change, carrying out abnormal interruption association analysis by fusing a time synchronization log structure, matching modal behavior offset characteristics and carrying out marking judgment, and completing real-time control and strategy isolation for potential malicious input. And rapid positioning and effective blocking of confrontation sample attacks and model poisoning behaviors are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly detection, in particular to a multi-modal AI model attack behavior detection and blocking system. BACKGROUND

[0002] The technical field of anomaly detection mainly involves monitoring and analyzing system operation data to identify potential abnormal behavior, enabling automatic identification and judgment of abnormal data patterns, and is widely used in network security, financial risk control, industrial control, intelligent security, and other scenarios. Among them, the AI model attack behavior detection and blocking system refers to building a classification model to identify hostile input samples and setting up a protection mechanism to deal with malicious interference during model inference. It aims to address the problem of performance degradation caused by adversarial sample attacks and model poisoning attacks on multi-modal artificial intelligence models when processing multi-source inputs such as images, audio, and text. It usually uses a feature abnormality evaluation-based method to build an anomaly discrimination mechanism and uses class boundary features in supervised learning to analyze the behavior of input samples to identify and respond to potential attacks.

[0003] In the existing AI model attack behavior detection and blocking process, it mainly relies on static evaluation and judgment of the abnormality of input sample features, focusing on using class boundary features to build an anomaly discrimination mechanism for input behavior. When facing high-frequency input changes or multi-modal heterogeneous data, it is difficult to capture dynamic collaborative abnormal relationships between cross-modal trends. Especially when hostile inputs do not deviate significantly from boundary features but have guiding disturbances, it is easy to cause delays in identifying potential attack behavior, such as image and text interference synchronously in time but with feature distribution still within reasonable boundaries, which is easily misjudged as normal input state, leading to the system's inability to respond and intervene in time, increasing the risk of attack execution and causing model inference performance to decline. SUMMARY

[0004] To solve the technical problems existing in the prior art, the embodiments of the present application provide a multi-modal AI model attack behavior detection and blocking system. The technical solution is as follows: On the one hand, a multi-modal AI model attack behavior detection and blocking system is provided, which includes: A traffic distribution monitoring module acquires real-time traffic data of each channel of a multi-modal AI model, extracts input trend change directions of the channel within adjacent time periods, detects the Pearson correlation coefficient between input trends of different modal channels, records all trend direction opposite combination segments, and generates a total amount of modal trend reverse combination segments; An attack behavior guiding identification module retrieves combination segments that appear continuously in time according to the total amount of modal trend reverse combination segments, delimits potential attack guiding sections according to the duration of appearance and trend switching frequency, and generates a combination segment group number list of attack guiding features; The log time structure identification module reads multi-level hardware log data within the same time window based on the attack boot feature fragment group number list, maps it according to timestamps, and counts the log structure positions where abnormal behavior coincides with the boot segment time, and obtains the log interruption abnormal behavior association index set. The attack behavior localization module matches the modality number corresponding to the abnormal behavior with the log interruption abnormal behavior association index set, determines whether there is an offset behavior feature, marks the modality behavior with offset features, and generates an offset feature modality number list.

[0005] As a further aspect of the present invention, the total number of modal trend reverse combination segments includes the number of combination segments with opposite trend directions, the time slice index of each modal channel, and strongly negatively correlated combination records; the attack guidance feature segment group number list includes modal identifiers, time period start and end indexes, and trend switching frequency information; the log interruption anomaly structure association index set includes log structure location indexes, modal log interruption identifiers, and timestamp correspondences; and the offset feature modal number list includes modal numbers with offset behavior characteristics, consistency labels between switching points and interruption times, and behavior feature parameters within the period.

[0006] As a further aspect of the present invention, the Pearson correlation coefficient is specifically a standard indicator in statistics for measuring the degree of linear correlation between two variables, with a value range of -1 to 1, and less than -0.7 indicating a strong negative correlation.

[0007] As a further aspect of the present invention, the flow distribution monitoring module includes: The traffic slicing submodule acquires real-time traffic data from each channel of the multimodal AI model, divides the real-time traffic data of each channel into fixed time periods in chronological order, and numbers and identifies the traffic data of the divided time periods. By comparing the traffic data sets of adjacent time periods in the division results with the difference trend of the traffic data of the current time period and the previous time period in terms of the direction of numerical change, a channel time slice trend direction sequence is generated. The trend extraction submodule reads the trend direction of the time slice corresponding to different modal channels within the same time period based on the channel time slice trend direction sequence. It performs direction consistency judgment on any two modal channel trend direction values ​​in a one-to-one pairing manner, filters out pairing combinations with opposite directions, and records the pairing combinations to generate modal trend reverse combination fragment values. The relevant calculation submodule constructs a trend direction sequence for each modal channel within the same time period based on the modal trend reverse combination segment values, determines the corresponding time period trend value vectors between pairs of modal channels, calculates the Pearson correlation coefficient between the trend value vectors, counts the number of all combination segments that meet the strong negative correlation condition, and obtains the total number of modal trend reverse combination segments.

[0008] As a further aspect of the present invention, the attack behavior guidance and identification module includes: The continuous segment identification submodule combines the total number of segments in reverse based on the modal trend, obtains the time index number corresponding to each combined segment and the time interval between adjacent segments, and if adjacent time intervals are continuous, they are classified into the same combination group. All combined segments are divided into continuous segments to generate the number of continuous combined segment groups. The segment delineation submodule is based on the start and end time index and trend direction sequence of each group of combined segments in the number of continuous combined segments. It performs dual screening based on the time span and trend switching frequency of each group. It establishes an identifier for the combined groups that meet both conditions, compares the screening results and removes groups that do not meet the conditions, and obtains the number of attack guidance segments. The feature numbering submodule extracts the modal channel identifier, segment start and end time index and trend switching sequence corresponding to all marked segments based on the number of attack guidance segments. It combines the fields in a fixed format and generates a unique serial number for each combination to obtain a list of attack guidance feature fragment group numbers.

[0009] As a further aspect of the present invention, the log time structure identification module includes: The log reading submodule reads multi-level hardware log data within the time window corresponding to all numbered segments based on the attack guidance feature fragment group number list, and extracts the modal channel identifier, timestamp and execution record type corresponding to each log record. It then re-sorts each log record by timestamp from smallest to largest and establishes a time series list by modal channel classification, generating a modal time series set. The anomaly detection submodule determines the time difference between adjacent log timestamps in the modal time series based on the time series of each modal channel in the modal time series set. At the same time, it obtains whether the time point of the current interruption segment overlaps with the segment covered by any number in the attack guidance feature segment group number list. If the timestamps overlap, it records the current modal channel and the log structure position number and obtains the number of time-overlapping interruptions. The index building submodule extracts the modal identifier, structural hierarchy name and interrupt time point corresponding to all marked interrupt records based on the number of time-overlapping interrupts, establishes a corresponding mapping table, groups the mapping content according to the modal dimension, generates a number sequence after arranging the interrupt records in chronological order for each group, numbers and indexes the interrupt information under each modal record, and obtains the log interruption abnormal behavior association index set.

[0010] As a further aspect of the present invention, the attack behavior localization module includes: The modal backtracking submodule, based on the log interruption abnormal behavior association index set, matches the modal identifier number pointed to by each interruption record, backtracks the behavior records of the corresponding modal channel before and after the interruption time point, extracts the trend change sequence and behavior type within the time range, records them by behavior segment and binds them with the modal number, and generates the number of backtracking modal behavior features. The consistency comparison submodule determines whether the difference between the time of the mode switching operation and the log interruption time is less than the time difference threshold based on the trend change record corresponding to each mode number in the number of backtracked modal behavior features and the log interruption time. If the difference is true, the corresponding mode number and switching point time are recorded to generate the number of time consistency matches. The feature marking submodule extracts a list of all modal numbers that meet the time difference threshold based on the time consistency matching quantity, performs a second judgment on the trend value sequence in the backtracking behavior segment, filters out the sequence segments with continuous reversal of fluctuation amplitude and records the start and end times, confirms that it has the offset behavior feature and marks it with an offset mark, organizes all marked modal numbers and obtains a list of offset feature modal numbers.

[0011] As a further aspect of the present invention, the system further includes: The modal blocking control module reviews the current running status based on the offset feature modal number list and the number of the marked modal. If there is an identified offset behavior, it applies an isolation flag to the channel traffic input command and the modal switching execution command, blocks the running path and stops scheduling, and obtains the multimodal AI model attack behavior detection and blocking response records. The multimodal AI model attack behavior detection and blocking response record includes the isolation flag corresponding to the modality number, the channel traffic blocking command, and the model scheduling abort status record.

[0012] As a further aspect of the present invention, the isolation flag is specifically the network isolation standard among the key security control measures formulated by the Internet Security Center.

[0013] As a further aspect of the present invention, the modal blocking control module includes: The status review submodule extracts the current running status flag of each mode number based on the offset feature mode number list, reads the latest recorded status information, performs a filtering and judgment operation on the status, and if there is any status and the number has been marked as an offset number, the corresponding mode number is marked as a state number that needs to be blocked, and the number of blocked state mode numbers is generated. The instruction isolation submodule locates the corresponding model channel traffic input instruction and mode switching execution instruction based on all mode numbers in the number of blocking state mode numbers, and writes an isolation flag to the operation tag. For each successful write, the number and writing time are recorded, and the instruction control structure identifier is updated to obtain the number of isolation instruction identifiers. The scheduling and blocking submodule retrieves all corresponding path entries based on the modality number recorded in the number of isolation instruction identifiers, matches the path control unit by number, adjusts the current running status, records the modified path number, termination timestamp and modality number, and obtains attack behavior detection and blocking response records after establishing an index structure.

[0014] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: By extracting the trend change direction of multimodal inputs over time, a trend reversal segment combination quantification mechanism is constructed based on the trend correlation differences between modalities. The combination segment statistics and time continuity judgment of the trend change direction are introduced. The identification path of potential attack guidance behavior is formed by combining trend frequency changes. The abnormal interruption correlation analysis is carried out by integrating the time synchronization log structure. The modal behavior offset features are matched and marked and judged according to the time consistency condition. By identifying channel input behaviors with offset features and dynamically blocking their execution process, real-time control and policy isolation of potential malicious inputs are completed, realizing rapid location and effective blocking of adversarial sample attacks and model poisoning behavior. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the multimodal AI model attack behavior detection and blocking system provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the system framework of the present invention; Figure 3 This is a flowchart of the flow distribution monitoring module in this invention; Figure 4 This is a flowchart of the attack behavior guidance and identification module in this invention; Figure 5 This is a flowchart of the log time structure recognition module in this invention; Figure 6 This is a flowchart of the attack behavior localization module in this invention; Figure 7This is a flowchart of the modal blocking control module in this invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0019] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0020] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0021] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0022] This invention provides a system for detecting and blocking multimodal AI model attack behaviors, such as... Figures 1-2 The diagram shown illustrates a multimodal AI model attack behavior detection and blocking system. The system includes: The traffic distribution monitoring module acquires real-time traffic data from each channel of the multimodal AI model, slices it according to time sequence, extracts the input trend change direction of each channel in adjacent time periods according to modality dimension, detects the Pearson correlation coefficient (a standard indicator in statistics for measuring the linear correlation between two variables, with a value range of -1 to 1, and less than -0.7 indicating a strong negative correlation) between the input trends of different modal channels in the same time period, records all combination segments with opposite trend directions, and generates the total number of modality trend reverse combination segments; The attack behavior guidance and identification module retrieves combined fragments that appear continuously in time based on the total number of modal trends, defines potential attack guidance segments based on the duration of occurrence (≥5 seconds) and the frequency of trend switching (≥3 times / second), and integrates the corresponding modal identifier, time index and trend change characteristics to generate a list of attack guidance feature fragment group numbers. The log time structure identification module reads multi-level hardware log data within the same time window based on the attack boot feature fragment group number list, extracts modal execution records, maps them by timestamp, checks whether there are continuous record interruptions in each modal log, counts the log structure positions where abnormal behavior coincides with the boot segment time, constructs a correspondence index between modal and log interruption, and obtains the log interruption abnormal behavior association index set; The attack behavior localization module matches the modality number corresponding to each abnormal behavior based on the log interruption abnormal behavior association index set, traces back the behavior characteristics of the corresponding modality in adjacent periods, determines whether there are offset behavior characteristics, compares the modality switching point with the log structure interruption time consistency (time difference <500ms), marks the modality behavior with offset characteristics, and generates a list of offset feature modality numbers. The modal blocking control module reviews the current operating status of the marked modal numbers based on the offset feature modal number list. If there is an identified offset behavior, it applies an isolation flag (network isolation standard in the key security control measures formulated by the Internet Security Center) to the channel traffic inbound command and modal switching execution command, blocks the operating path and stops scheduling, and obtains the multimodal AI model attack behavior detection and blocking response records.

[0023] The total number of modal trend reverse combination segments includes the number of combination segments with opposite trend directions, the time slice index of each modal channel, and strongly negatively correlated combination records. The attack guidance feature segment group number list includes modal identifiers, time period start and end indexes, and trend switching frequency information. The log interruption anomaly structure association index set includes log structure location indexes, modal log interruption identifiers, and timestamp correspondences. The offset feature modal number list includes modal numbers with offset behavior characteristics, consistency labels between switching points and interruption times, and behavior feature parameters within the period. The multimodal AI model attack behavior detection and blocking response record includes isolation flags corresponding to modal numbers, channel traffic blocking instructions, and model scheduling abort status records.

[0024] Specifically, such as Figure 2 , 3 As shown, the traffic distribution monitoring module includes: The traffic slicing submodule acquires real-time traffic data from each channel of the multimodal AI model, divides the real-time traffic data of each channel into fixed time periods in chronological order, and numbers and identifies the traffic data of the divided time periods. By comparing the traffic data sets of adjacent time periods in the division results with the difference trend of the traffic data of the current time period and the previous time period in terms of the direction of numerical change, a channel time slice trend direction sequence is generated. To obtain real-time traffic data for each channel of a multimodal AI model, a separate data flow record table needs to be established for each channel. During the acquisition process, data traffic within each millisecond should be continuously collected according to the actual deployed inference engine architecture. The data acquisition module, primarily driven by the CPU or GPU, records the traffic value corresponding to each inference task call. For example, the traffic of a certain image modality channel might be 8.5MB at the first time point, 9.1MB at the second time point, and 9.3MB at the third time point. Based on this, each acquisition record is sequentially numbered using a timestamp. For fixed time intervals of 1 second, all data within the channel is divided according to the timestamp from smallest to largest. The data is divided into multiple adjacent time segments. For example, the first segment contains all data within 0-1 seconds, the second segment contains 1-2 seconds, and so on. Each segment contains multiple sampling points. After division, information such as the segment number, start and end time, and number of sampling points must be recorded. Then, the direction of the traffic trend over time is determined based on the difference in the average traffic value between two adjacent segments. If the average traffic value of the later segment is higher than that of the earlier segment, the trend direction is defined as positive; otherwise, it is negative. For example, if the average traffic value of segment number 1 is 8.7MB and the average traffic value of segment number 2 is 9.4MB, the trend is positive. If the average traffic value of segment number 3 is 8.6MB, the trend is negative. To determine the trend direction, the process of calculating the average traffic value in each segment is as follows: ,in, For the first The average flow rate of the segment For the first Section 1 The flow rate values ​​sampled at each time point, For the first The number of sampling points contained in a segment. For example, if segment 1 contains 10 sampling points and the total flow is 87MB, then the average value is 8.7MB. The directional trend value is calculated based on the segment average, and a trend direction sequence is generated sequentially. For example, the trend sequence for channel A can be represented as... Finally, a channel time slice trend direction sequence is generated.

[0025] The trend extraction submodule reads the trend direction of the time slice corresponding to different modal channels within the same time period based on the channel time slice trend direction sequence. It performs direction consistency judgment on any two modal channel trend direction values ​​in a one-to-one pairing manner, filters out pairing combinations with opposite directions, records the pairing combinations, and generates modal trend reverse combination fragment values. Based on the channel time slice trend direction sequence, the trend direction values ​​of different modal channels within the same time period are paired. For example, at the 3rd second, the trend of the image modality is +1, the text modality is -1, and the speech modality is +1. Therefore, within this time period, the trend direction pairings are image-text, image-speech, and text-speech. Each pairing is compared one by one for the trend direction values. If the trend values ​​of two channels have opposite signs, they are determined to be a combination with opposite directions. For example, in the image-text pairing, the trends are +1 and -1 respectively, with opposite trend directions, making it a valid combination. All valid combinations are cumulatively counted, and their time period number and participating channel name are recorded. For example, at the 5th second, there is a text... For combinations opposite to the speech direction, with trend direction values ​​of +1 and -1 respectively, the combination is recorded as a valid combination segment. Each time the trend direction sign is checked for reversal, the trend direction values ​​are multiplied. If the product is less than 0, the direction is reversed. For example, if the trend is +1 and -1, the product is -1, which is less than 0, so the combination is recorded again. This process iterates through all trend pairings between all channels in each time period. The pairing method is performed in pairs, and the total number of combinations is equal to the number of channels. That is, if there are 4 modal channels, the number of pairings per second is 6. The total number of opposite trend combinations in all time periods is counted to generate the modal trend reverse combination segment value.

[0026] The relevant calculation submodule constructs the trend direction sequence of each modal channel within the same time period based on the modal trend reverse combination segment values, determines the corresponding time period trend value vector between each pair of modal channels, calculates the Pearson correlation coefficient between the trend value vectors, counts the number of all combination segments that meet the strong negative correlation condition, and obtains the total number of modal trend reverse combination segments. Based on the modal trend reverse combination segment values, the trend direction sequence of all modal channels in each time period is called. In the i-th second time period, any two channels form a trend vector. For example, the trend vector of the image modal channel is... The trend vector of the text modal channel is Then, a trend value vector is constructed for these two channels in the corresponding time period, and the linear correlation is calculated using the Pearson correlation coefficient. The calculation formula is as follows: ,in, and These represent the trend direction values ​​of the two channels in the k-th time period. and This represents the mean of the trend sequences for each channel. The number of time periods, if the calculation result If the correlation is less than -0.7, it is considered a strong negative correlation. Specifically, in the example above, the two channels are in completely opposite directions. If the conditions are met, the Pearson coefficient of each channel combination in each time period is calculated and judged. All combination time periods and combination channel names less than -0.7 are recorded, and the total number of such combinations is counted. For example, if there are 13 combination segments that meet the conditions in 50 time periods, the total number of modal trend reverse combination segments is 13.

[0027] Specifically, such as Figure 2 , 4 As shown, the attack behavior guidance and identification module includes: The continuous segment recognition submodule combines the total number of segments based on modal trends, obtains the time index number corresponding to each combined segment and the time interval between adjacent segments, and classifies adjacent time intervals into the same combined group if they are consecutive. It then divides all combined segments into continuous segments and generates the number of continuous combined segment groups. Based on the total number of modal trend reverse combination segments, the time index number of each combination segment and the time interval value between it and adjacent combination segments are obtained. First, all identified trend reverse combination segments are sorted in chronological order, and each segment is marked with its start time point number, such as number 1. , , Wait, then calculate the time interval between two adjacent segments. ,judge If the time index is equal to 1 second, then the two segments are considered to appear consecutively and are grouped into the same group. For example, if the time indices of the segments are 10, 11, 12, 14, 15, 18, 19, and 20, then the first three segments form one group, 14 and 15 form the second group, and 18 to 20 form the third group. Each group contains consecutive occurrences of 3 seconds, 2 seconds, and 3 seconds respectively. If there are non-consecutive segments, such as... and If the interval is 2 seconds, then it will not be grouped together. When performing the above judgment action, it is necessary to judge each pair of adjacent time points. The judgment action is: if If the current combination group continues to expand, then the current combination group is marked as such; otherwise, the current group is terminated and a new combination identifier count is started. After all combination groups are constructed, the number of combination segments, start time number, end time number, and combination sequence number in each group are recorded. The combination sequence number is set in an incrementing manner from 1, and the final number of consecutive combination segment groups is generated.

[0028] The segment delineation submodule is based on the start and end time index and trend direction sequence of each group of combined segments in the number of consecutive combined segments. It performs double screening based on the time span and trend switching frequency of each group. It establishes an identifier for the combined groups that meet both conditions, compares the screening results and removes groups that do not meet the conditions, and obtains the number of attack guidance segments. The process retrieves the start and end time indices and trend direction sequences for each group of consecutive segment combinations. For each segment combination, the duration is calculated by subtracting the start time number from the end time number and then adding 1. The result is checked to see if this value is greater than or equal to 5. If it is, the process moves to the next condition and extracts all trend direction values ​​from the corresponding trend direction sequence. The number of positive and negative changes (i.e., the number of times +1 changes to -1 or -1 changes to +1) is counted, and the total number of trend changes is recorded. This total number is then divided by the duration to calculate the trend switching frequency. The system determines whether the frequency is greater than or equal to 3 times per second. If both conditions are met—the duration is no less than 5 seconds and the number of trend direction changes per second is no less than 3—then the group is marked as an attack guidance candidate segment. For example, if the start and end time of a group is 20 to 26 seconds, a total of 7 seconds, its trend direction sequence is as follows: The number of switching times is 6, and the frequency is If the frequency is less than 3 times / second, the condition is not met and it is not recorded as an attack guidance segment. However, if another combination group has 15 direction changes within 5 seconds, which is 3 times / second, the condition is met and it is included in the attack guidance segment. Finally, all combination groups are filtered, judged and marked to obtain the number of attack guidance segments.

[0029] The feature numbering submodule extracts the modal channel identifier, segment start and end time index and trend switching sequence corresponding to all marked segments based on the number of attack bootstrapping segments. It combines the fields in a fixed format and generates a unique serial number for each combination to obtain a list of attack bootstrapping feature fragment group numbers. Based on the number of attack guidance segments, extract the modal channel identifier information, start and end time indexes of the combination segment, and trend switching direction sequence within that segment for each combination group marked as an attack guidance segment. The modal channel identifier information is extracted from all relevant channel numbers in the original reverse trend combination segments contained in the combination group, and duplicates are removed and integrated. The time index directly uses the start and end numbers of the combination group as the segment boundary. The trend switching direction sequence is the trend direction value per second throughout the entire time period of the combination group. Then, these three items are combined into a text field using the format: channel identifier - time range - trend sequence concatenation. A unique number is then assigned to each combination content using an incrementing numbering rule, such as G001, G002, etc. For example, if a channel combination is image and audio, with a start and end time of 30-36 seconds, and the trend sequence is... Then its combined field is "image + audio - 30_36 - [+1, -1, +1, -1, +1, -1, +1]", and the field number is G001. After all the filtered segments are processed in sequence, a mapping table between the number and the content is formed, and finally the attack guidance feature fragment group number list is obtained.

[0030] Specifically, such as Figure 2 , 5 As shown, the log time structure recognition module includes: The log reading submodule reads multi-level hardware log data within the time window corresponding to all numbered segments based on the attack bootstrapping feature fragment group number list, and extracts the modal channel identifier, timestamp, and execution record type corresponding to each log record. It then re-sorts each log record by timestamp from smallest to largest and classifies them by modal channel to create a time series list, generating a modal time series set. Based on the attack bootstrapping feature fragment group number list, multi-level hardware log data within the time range corresponding to each number is read. The reading process extracts log entries by querying each segment in the number list. Each numbered record contains start and end timestamps and modal channel type fields. The reading action is filtered by segment time index, retaining only data records whose timestamps are within that segment. The modal identifier, timestamp, and execution event type fields are extracted from each record. The modal identifier field distinguishes whether the log source belongs to a visual, voice, or text channel, etc. The execution event type field records the operation category, such as "start inference," "complete inference," "error retry," etc. Subsequently, all extracted logs are processed... Aggregation is performed using modal identifiers as grouping criteria to generate multiple log sequences. Each log sequence is then sorted in ascending order by timestamp field, forming a modal-time two-dimensional sequence data structure. For example, in segment G002, the time range is from 110 seconds to 122 seconds. After reading the original log records, 9 log sequences belonging to the voice channel are extracted, with timestamps of 110, 111, 112, 113, 115, 116, 117, 119, and 120, and event types of "execution start", "speech recognition", and "cache loading", respectively. An ordered structure is regenerated through sorting for subsequent interruption judgment, ultimately generating a modal time series set.

[0031] The anomaly detection submodule determines the time difference between adjacent log timestamps in the modal time series based on the time series of each modal channel in the modal time series set. At the same time, it obtains whether the time point of the current interruption segment overlaps with the segment covered by any number in the attack guidance feature segment group number list. If the timestamps overlap, it records the current modal channel and the log structure position number and obtains the number of time-overlapping interruptions. The system retrieves the timestamp sequence for each modal channel in the modal time series set, sequentially extracts the timestamp difference between two adjacent log records, and performs a difference check. If the time interval is greater than 1 second, it is marked as an interrupted segment. The difference check is performed on any two adjacent timestamps. and Perform calculation If the result is greater than 1, the current segment is the start point of the interruption, and the start and end times are recorded. For example, if there are consecutive records with timestamps of 200 and 203 in the visual channel log, the interruption segment is defined as seconds 201 to 202. After marking, the time range of the interruption record is obtained, and then compared with the start and end times marked on each numbered record in the attack guidance feature fragment group number list to determine if the time range overlaps with any numbered segment on the time axis. The judgment criterion is that the time range of the interruption segment intersects with any numbered segment on the time axis. and If the conditions are met, the interruption segment is considered to have occurred at the same time as the attack guidance segment. The modality type, log structure level (such as core layer, middleware layer) and interruption time of the record are recorded. For example, if the log interruption of a certain voice modality occurs between 300 and 304 seconds, and the segment covered by number G005 is between 302 and 308 seconds, then the two timelines have an intersection, which is judged as an overlap and included in the result statistics. Finally, the number of time-overlapping interruptions is obtained.

[0032] The index building submodule extracts the modal identifier, structural hierarchy name and interrupt time point corresponding to all marked interrupt records based on the number of interrupts with overlapping time, and builds a corresponding mapping table. The mapping content is grouped according to the modal dimension. After arranging the interrupt records in each group in chronological order, a number sequence is generated. The interrupt information under each modal record is numbered and indexed to obtain the log interruption abnormal behavior associated index set. Based on the number of overlapping interruptions, three core fields are extracted from all overlapping interruption records: modality type, log structure level name, and the start timestamp of the interrupt segment. The structure level name is mapped and classified by the source module field in the log record. For example, interrupts generated by the CPU scheduler are marked as scheduling layer interrupts, and interrupts generated by the model service process are marked as inference layer interrupts. A one-to-one correspondence is established for the three fields of all interruption records, and a field triplet mapping list is constructed. For example, for a record "text modality-middleware layer-205 seconds", a mapping record of "text modality→middleware layer→205 seconds" is established. Then, all records are grouped according to the modality dimension. The interrupt segments of the records in each group are sorted in ascending order by timestamp and renumbered. The numbering format is "M001-1", "M001-2", etc. Each record is assigned a unique number. Finally, all interrupt fields and corresponding numbers are integrated into a dictionary structure, all mapping relationships are recorded and exported as an index file, and finally, the log interruption abnormal behavior association index set is obtained.

[0033] Specifically, such as Figure 2 , 6 As shown, the attack behavior localization module includes: The modal backtracking submodule is based on the log interruption abnormal behavior association index set. It matches the modal identifier number pointed to by each interruption record, backtracks the behavior records of the corresponding modal channel before and after the interruption time point, extracts the trend change sequence and behavior type within the time range, records them by behavior segment and binds them with the modal number, and generates the number of backtracking modal behavior features. Based on the log interruption anomaly behavior association index set, the modality number field labeled for each record is extracted from the index set, and a mapping list between the number and the interruption time is established. The behavior data records of the modality channel corresponding to that number are traced back, and behavior performance data is extracted within a 2-second range before and after the interruption time. The behavior data includes a trend direction sequence and a behavior type label. The trend direction sequence is compared using a difference function; if the trend direction value of adjacent points changes sign, it is counted as one change. The total number of changes is counted and it is determined whether it exceeds 3. If the number of changes meets the condition, the behavior type of that segment is further checked to see if fields such as "instruction withdrawal" or "data retransmission" appear. For example, if the trend direction of number M014 changes between 105 and 109 seconds... If the number of changes is 4 and the behavior type is marked as "retransmission" at 107 seconds, then the number meets the backtracking filtering conditions. The trend sequence and operation label are recorded, and the modality number is bound to the result set to finally generate the number of backtracking modality behavior features.

[0034] The consistency comparison submodule determines whether the difference between the time of the mode switching operation and the log interruption time is less than the time difference threshold based on the trend change record corresponding to each mode number in the backtracked modal behavior feature quantity and the log interruption time point. If the difference is true, the corresponding mode number and switching point time are recorded, and the time consistency matching quantity is generated. The algorithm retrieves the trend record and log interruption time point corresponding to each modality number included in the backtracking modal behavior feature count, obtains the time value of the modality switching operation, and calculates the difference between this time value and the interruption time. Let the interruption time be... Switching point time is ,implement ,judge If the time is greater than 0 and less than 500 milliseconds, then the mode number meets the consistency matching condition. For example, the interrupt time of the mode number M009 is 311.300 seconds and the switching point is 311.520 seconds, with a difference of 220 milliseconds, which meets the judgment condition. The mode number, the corresponding switching point time and the interrupt time are recorded together. All the mode numbers and times that meet the conditions are accumulated and counted in the result list, and finally the number of time consistency matches is generated.

[0035] The feature marking submodule extracts a list of all modal numbers that meet the time difference threshold based on the number of time consistency matches, and performs a second judgment on the trend value sequence in the backtracking behavior segment. It filters out the sequence segments with continuous reversal of fluctuation amplitude and records the start and end times. After confirming that it has the offset behavior feature, it marks the offset. It organizes all the marked modal numbers to obtain a list of offset feature modal numbers. Based on the number of time consistency matches, extract the modality numbers that have met the time difference threshold. Perform a secondary fluctuation judgment operation on the corresponding trend direction sequence. The judgment criterion is the occurrence of three consecutive sign direction reversals in the sequence, i.e., if the sequence has three consecutive occurrences of, for example... If a segment exhibits an offset behavior, the sequence is analyzed, and the interval where the first three reversals are satisfied is identified and designated as the offset segment. This segment is then marked with an "offset" tag, and its number, the start and end times of the fluctuation segment, and the behavior time period identifier are recorded. All segments with this tag are collected and organized into a structured data table. For example, the trend sequence with the number M021 is... If four directional reversals occur within 120 to 124 seconds, the condition is met, and M021 is recorded and added to the list. Finally, the list of offset feature mode numbers is obtained.

[0036] Specifically, such as Figure 2 , 7 As shown, the modal blocking control module includes: The status review submodule extracts the current running status flag of each mode number based on the offset feature mode number list, reads the latest recorded status information, performs a filtering and judgment operation on the status, and if there is any status and the number has been marked as an offset number, the corresponding mode number is marked as a status number that needs to be blocked, and the number of blocking status mode numbers is generated. Based on the offset feature modality number list, each modality number is first retrieved from this list. Then, by reading the latest running status information recorded in the model task scheduling table, the current status corresponding to each modality number is extracted. This status typically includes different activity identifiers such as "In Inference," "Waiting for Requests," and "Buffered Transmission." Each status reflects the current modality channel's running state; for example, "In Inference" indicates that the current modality is executing an inference task, "Waiting for Requests" indicates that the modality is waiting for a data request, and "Buffered Transmission" indicates that data is in the process of transmission and has not yet been completed. Next, the current status field is filtered to determine whether the modality is in one of these key activity states. If a modality is in one of these states, and the modality number was previously marked as an offset number, then the modality number is marked as "Needs to be Blocked." This operation is achieved by comparing the offset feature modality number with the current status identifier. For example, assuming the modality number M032 is currently in "In Inference" and has been determined to be an offset number in a previous status review, then this number will be marked as "Needs to be Blocked." At this time, all subsequent instructions for this modality will be blocked to prevent its continued execution and ensure system security. Through this filtering and judgment, all modal IDs that meet the conditions will be listed, and a number of blocking state modal IDs will be generated based on their status. Assuming that there are 10 modal IDs in the list that meet these conditions, the generated result is "number of blocking state modal IDs" of 10, which means that these 10 modes need to be isolated and blocked.

[0037] The instruction isolation submodule locates the corresponding model channel traffic input instruction and mode switching execution instruction based on all mode numbers in the number of blocking state mode numbers, and writes isolation flags to the operation tag. For each successful write, the number and writing time are recorded, and the instruction control structure identifier is updated to obtain the number of isolation instruction identifiers. In the blockade modality numbering, the system first delves deeper into the channel traffic ingress commands and modality switching execution commands related to these modalities in the model inference scheduling, based on all modality numbers filtered from the status review. Each modality has multiple control commands in the system, managing key tasks such as traffic ingress, processing, and model switching. These commands are closely related to the modality's operation and directly affect the overall system stability. For each modality number, the system will match its associated traffic ingress commands and modality switching execution commands one by one, and update the operation tag fields of these commands by writing an "isolation flag". This "isolation flag" is set according to the network isolation standard formulated by the Internet Security Center, with a value of "FLAG_ISO", which indicates that the command is in a network isolation state and will no longer be executed. For example, assuming that the traffic ingress commands and switching execution commands corresponding to the modality channel number M014 have been identified in the system, and the modality number has been determined to be in a blockade state, the system will immediately write the "FLAG_ISO" flag for these commands and record the timestamp of the operation and the corresponding modality number. If, in a real-world scenario, modality M018 requires isolation, and the instruction is written at 10:30:45, then this instruction will be updated to include the control flag "FLAG_ISO". In this way, all modal instructions requiring isolation are promptly marked, and the control structures of all related instructions are updated in real time. Ultimately, all modalities successfully written to the isolation flag and their related operations are recorded and counted, generating the number of isolation instruction identifiers. For example, when processing 10 modalities, instructions for 8 modalities may have been successfully written to the isolation flag, resulting in a "number of isolation instruction identifiers" of 8.

[0038] The scheduling and blocking submodule retrieves all corresponding path entries based on the modal numbers recorded in the isolation instruction identifier quantity, matches the path control unit by number, adjusts the current running status, records the modified path number, abort timestamp and modal number, and obtains attack behavior detection and blocking response records after establishing an index structure. Based on the records in the isolation instruction identifier count, the system retrieves the scheduling path management table to find the path entries corresponding to these modality numbers. Each path entry represents a specific scheduling path, recording the specific execution route and scheduling control information of the model inference task. By matching these path entries with the modality numbers, the system can accurately identify each path that needs to be terminated. For each identified path, the system immediately adjusts the path's status, switching it from "running" to "terminated." This status change means that all inference tasks on that path will no longer continue execution, thus blocking further operations of the modality. This process is implemented through the path control unit, which is responsible for managing and terminating the scheduling tasks. Taking modality number M005 as an example, assuming its corresponding path control entry is marked as path P022 in the scheduling table, and path P022's current status is "running," while M005 has been determined to be in a state requiring blocking, path P022 will be forcibly terminated by the system, and the path status will be updated to "terminated." All terminated path records will be summarized in the response event table, and the records contain detailed information such as the path number, timestamp, and modality number. In this way, all paths that need to be stopped are accurately identified, and their relevant information is effectively archived. For example, if path P022 is marked as stopped at 10:40:30, and modality number M005 is associated with path P022, this stoppage event will ultimately be recorded in the response event table. By integrating and storing these stoppage records, the system can generate detailed attack behavior detection and blocking response records. These records can be used for subsequent auditing, analysis, and further security testing to ensure the security and stability of the system.

[0039] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A multimodal AI model attack behavior detection and blocking system, characterized in that, The system includes: The traffic distribution monitoring module acquires real-time traffic data for each channel of the multimodal AI model, extracts the direction of input trend change of the channel in adjacent time periods, detects the Pearson correlation coefficient between the input trends of different modal channels, records all combination segments with opposite trend directions, and generates the total number of modal trend reverse combination segments. The attack behavior guidance and identification module retrieves the combined fragments that appear continuously in time based on the total number of the modal trends, defines potential attack guidance segments based on the duration of occurrence and the frequency of trend switching, and generates a list of attack guidance feature fragment group numbers. The log time structure identification module reads multi-level hardware log data within the same time window based on the attack boot feature fragment group number list, maps it according to timestamps, and counts the log structure positions where abnormal behavior coincides with the boot segment time, and obtains the log interruption abnormal behavior association index set. The attack behavior localization module matches the modality number corresponding to the abnormal behavior with the log interruption abnormal behavior association index set, determines whether there is an offset behavior feature, marks the modality behavior with offset features, and generates an offset feature modality number list.

2. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The total number of modal trend reverse combination segments includes the number of combination segments with opposite trend directions, the time slice index of each modal channel, and strongly negatively correlated combination records. The attack guidance feature segment group number list includes modal identifiers, time period start and end indexes, and trend switching frequency information. The log interruption anomaly structure association index set includes log structure location indexes, modal log interruption identifiers, and timestamp correspondences. The offset feature modal number list includes modal numbers with offset behavior characteristics, consistency labels between switching points and interruption times, and behavior feature parameters within the period.

3. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The Pearson correlation coefficient is a standard indicator in statistics for measuring the degree of linear correlation between two variables. Its value ranges from -1 to 1, and a value less than -0.7 indicates a strong negative correlation.

4. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The flow distribution monitoring module includes: The traffic slicing submodule acquires real-time traffic data from each channel of the multimodal AI model, divides the real-time traffic data of each channel into fixed time periods in chronological order, and numbers and identifies the traffic data of the divided time periods. By comparing the traffic data sets of adjacent time periods in the division results with the difference trend of the traffic data of the current time period and the previous time period in terms of the direction of numerical change, a channel time slice trend direction sequence is generated. The trend extraction submodule reads the trend direction of the time slice corresponding to different modal channels within the same time period based on the channel time slice trend direction sequence. It performs direction consistency judgment on any two modal channel trend direction values ​​in a one-to-one pairing manner, filters out pairing combinations with opposite directions, and records the pairing combinations to generate modal trend reverse combination fragment values. The relevant calculation submodule constructs a trend direction sequence for each modal channel within the same time period based on the modal trend reverse combination segment values, determines the corresponding time period trend value vectors between pairs of modal channels, calculates the Pearson correlation coefficient between the trend value vectors, counts the number of all combination segments that meet the strong negative correlation condition, and obtains the total number of modal trend reverse combination segments.

5. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The attack behavior guidance and identification module includes: The continuous segment identification submodule combines the total number of segments in reverse based on the modal trend, obtains the time index number corresponding to each combined segment and the time interval between adjacent segments, and if adjacent time intervals are continuous, they are classified into the same combination group. All combined segments are divided into continuous segments to generate the number of continuous combined segment groups. The segment delineation submodule is based on the start and end time index and trend direction sequence of each group of combined segments in the number of continuous combined segments. It performs dual screening based on the time span and trend switching frequency of each group. It establishes an identifier for the combined groups that meet both conditions, compares the screening results and removes groups that do not meet the conditions, and obtains the number of attack guidance segments. The feature numbering submodule extracts the modal channel identifier, segment start and end time index and trend switching sequence corresponding to all marked segments based on the number of attack guidance segments. It combines the fields in a fixed format and generates a unique serial number for each combination to obtain a list of attack guidance feature fragment group numbers.

6. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The log time structure recognition module includes: The log reading submodule reads multi-level hardware log data within the time window corresponding to all numbered segments based on the attack guidance feature fragment group number list, and extracts the modal channel identifier, timestamp and execution record type corresponding to each log record. It then re-sorts each log record by timestamp from smallest to largest and establishes a time series list by modal channel classification, generating a modal time series set. The anomaly detection submodule determines the time difference between adjacent log timestamps in the modal time series based on the time series of each modal channel in the modal time series set. At the same time, it obtains whether the time point of the current interruption segment overlaps with the segment covered by any number in the attack guidance feature segment group number list. If the timestamps overlap, it records the current modal channel and the log structure position number and obtains the number of time-overlapping interruptions. The index building submodule extracts the modal identifier, structural hierarchy name and interrupt time point corresponding to all marked interrupt records based on the number of time-overlapping interrupts, establishes a corresponding mapping table, groups the mapping content according to the modal dimension, generates a number sequence after arranging the interrupt records in chronological order for each group, numbers and indexes the interrupt information under each modal record, and obtains the log interruption abnormal behavior association index set.

7. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The attack behavior localization module includes: The modal backtracking submodule, based on the log interruption abnormal behavior association index set, matches the modal identifier number pointed to by each interruption record, backtracks the behavior records of the corresponding modal channel before and after the interruption time point, extracts the trend change sequence and behavior type within the time range, records them by behavior segment and binds them with the modal number, and generates the number of backtracking modal behavior features. The consistency comparison submodule determines whether the difference between the time of the mode switching operation and the log interruption time is less than the time difference threshold based on the trend change record corresponding to each mode number in the number of backtracked modal behavior features and the log interruption time. If the difference is true, the corresponding mode number and switching point time are recorded to generate the number of time consistency matches. The feature marking submodule extracts a list of all modal numbers that meet the time difference threshold based on the time consistency matching quantity, performs a second judgment on the trend value sequence in the backtracking behavior segment, filters out the sequence segments with continuous reversal of fluctuation amplitude and records the start and end times, confirms that it has the offset behavior feature and marks it with an offset mark, organizes all marked modal numbers and obtains a list of offset feature modal numbers.

8. The multimodal AI model attack behavior detection and blocking system according to claim 1, characterized in that, The system also includes: The modal blocking control module reviews the current running status based on the offset feature modal number list and the number of the marked modal. If there is an identified offset behavior, it applies an isolation flag to the channel traffic input command and the modal switching execution command, blocks the running path and stops scheduling, and obtains the multimodal AI model attack behavior detection and blocking response records. The multimodal AI model attack behavior detection and blocking response record includes the isolation flag corresponding to the modality number, the channel traffic blocking command, and the model scheduling abort status record.

9. The multimodal AI model attack behavior detection and blocking system according to claim 8, characterized in that, The isolation flag specifically refers to the network isolation standard among the key security control measures formulated by the Internet Security Center.

10. The multimodal AI model attack behavior detection and blocking system according to claim 8, characterized in that, The modal blocking control module includes: The status review submodule extracts the current running status flag of each mode number based on the offset feature mode number list, reads the latest recorded status information, performs a filtering and judgment operation on the status, and if there is any status and the number has been marked as an offset number, the corresponding mode number is marked as a state number that needs to be blocked, and the number of blocked state mode numbers is generated. The instruction isolation submodule locates the corresponding model channel traffic input instruction and mode switching execution instruction based on all mode numbers in the number of blocking state mode numbers, and writes an isolation flag to the operation tag. For each successful write, the number and writing time are recorded, and the instruction control structure identifier is updated to obtain the number of isolation instruction identifiers. The scheduling and blocking submodule retrieves all corresponding path entries based on the modality number recorded in the number of isolation instruction identifiers, matches the path control unit by number, adjusts the current running status, records the modified path number, termination timestamp and modality number, and obtains attack behavior detection and blocking response records after establishing an index structure.

Images