Multimodal ai model attack behavior detection and blocking system

Abstract

The present application relates to the technical field of anomaly detection, in particular to a multi-modal AI model attack behavior detection and blocking system, which comprises a traffic distribution monitoring module, an attack behavior guiding recognition module, a log time structure recognition module, an attack behavior positioning module and a modal blocking control module.In the present application, the trend change direction of multi-modal input in time series is extracted, a trend reverse segment combination quantitative mechanism is constructed based on the trend correlation difference between modes, the combination segment statistics of the trend change direction and the time continuity judgment are introduced, the recognition path of potential attack guiding behavior is formed combined with the trend frequency change, the abnormal interruption correlation analysis is carried out by fusing the time synchronization log structure, the modal behavior offset characteristics are matched and marked, the real-time control and strategy isolation of potential malicious input are completed, and the rapid positioning and effective blocking of the attack and model poisoning behavior of the adversarial sample are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly detection, in particular to a multi-modal AI model attack behavior detection and blocking system. BACKGROUND

[0002] The technical field of anomaly detection mainly involves monitoring and analyzing system operation data to identify potential abnormal behavior, achieving automatic identification and judgment of abnormal data patterns, and is widely used in network security, financial risk control, industrial control, intelligent security, etc. The AI model attack behavior detection and blocking system refers to building a classification model to identify hostile input samples and setting a protection mechanism to deal with malicious interference during model inference. It is aimed at the problem that multi-modal artificial intelligence models are vulnerable to adversarial sample attacks and model poisoning attacks when processing multi-source inputs such as images, audio, and text, which can cause performance degradation. It usually uses a feature abnormality evaluation-based method to build an anomaly discrimination mechanism and uses class boundary features in supervised learning to analyze the behavior of input samples to identify and respond to potential attacks.

[0003] In the existing AI model attack behavior detection and blocking process, it mainly relies on static evaluation and judgment of the abnormality of input sample features, focusing on using class boundary features to build an input behavior anomaly discrimination mechanism. When facing high-frequency input changes or multi-modal heterogeneous data, it is difficult to capture dynamic collaborative abnormal relationships between cross-modal trends. Especially when hostile inputs do not deviate significantly from boundary features but have guiding disturbances, it is easy to cause delay in identifying potential attack behavior, for example, image and text interference is synchronized in time, but the feature distribution is still within the reasonable boundary, which is easy to be misjudged as normal input state, causing the system to fail to respond and intervene in time, increasing the risk of attack execution and causing model inference performance to decline. SUMMARY

[0004] To solve the technical problems existing in the prior art, the embodiments of the present application provide a multi-modal AI model attack behavior detection and blocking system. The technical solution is as follows:

[0005] On the one hand, a multi-modal AI model attack behavior detection and blocking system is provided, which includes:

[0006] The traffic distribution monitoring module obtains real-time traffic data of each channel of the multi-modal AI model, extracts the input trend change direction of the channel in adjacent time periods, detects the Pearson correlation coefficient between the input trends of different modal channels, records all trend direction opposite combination segments, and generates the total amount of modal trend reverse combination segments;

[0007] The attack behavior guide identification module combines the total quantity of the modal trend reverse combination fragments, retrieves combination fragments that appear continuously in time, delimits a potential attack guide segment according to a continuous time length and a trend switching frequency, and generates an attack guide feature fragment group number list;

[0008] The log time structure identification module reads multi-level hardware log data in the same time window based on the attack guide feature fragment group number list, maps according to a timestamp, and counts log structure positions of abnormal behaviors and guide segments that coincide in time, to obtain a log interruption abnormal behavior association index set;

[0009] The attack behavior positioning module matches a modal number corresponding to the abnormal behavior according to the log interruption abnormal behavior association index set, judges whether there is a deviation behavior feature, and marks modal behaviors with the deviation feature, to generate a deviation feature modal number list.

[0010] As a further scheme of the application, the total quantity of the modal trend reverse combination fragments includes the number of combination fragments with opposite trend directions, time slice indexes of each modal channel, and strong negative correlation combination records, the attack guide feature fragment group number list includes modal identifiers, time period start and end indexes, and trend switching frequency information, the log interruption abnormal behavior association index set includes log structure position indexes, modal log interruption identifiers, and timestamp corresponding relationships, and the deviation feature modal number list includes modal numbers with deviation behavior features, consistency labels of switching points and interruption times, and behavior feature parameters in a period.

[0011] As a further scheme of the application, the Pearson correlation coefficient is a standard index for measuring the degree of linear correlation between two variables in statistics, and the value range is -1 to 1, and less than -0.7 indicates strong negative correlation.

[0012] As a further scheme of the application, the flow distribution monitoring module includes:

[0013] The flow slice sub-module obtains real-time flow data of each channel of the multi-modal AI model, continuously divides the real-time flow data of each channel in a fixed time period according to time sequence, and numbers and identifies the divided time period flow data, compares the difference value change trend of adjacent numbered time period flow data sets in the division result and the current and previous time period flow data in the numerical change direction, and generates a channel time slice trend direction sequence.

[0014] The trend extraction submodule reads the trend directions of the time slices corresponding to different modal channels in the same time period based on the channel time slice trend direction sequence, performs direction consistency discrimination on the trend direction values of any two modal channels in a one-to-one pairing manner, filters the pairing combinations with opposite directions, and records the pairing combinations to generate a modal trend reverse combination segment value;

[0015] The correlation calculation submodule constructs the trend direction sequence of each modal channel in the same time period according to the modal trend reverse combination segment value, determines the trend value vectors of the corresponding time periods between two modal channels, performs Pearson correlation coefficient calculation on the trend value vectors, counts the number of combination segments that meet the strong negative correlation condition, and obtains a total amount of modal trend reverse combination segments.

[0016] As a further scheme of the application, the attack behavior guidance recognition module comprises:

[0017] The continuous segment recognition submodule obtains the time index number corresponding to each combination segment and the time interval of adjacent segments based on the total amount of modal trend reverse combination segments, and if the adjacent time periods are continuous, it is classified into the same combination group, the continuous segment division is performed on all combination segments, and the number of continuous combination segment groups is generated.

[0018] The section demarcation submodule performs double screening according to the time span and trend switching frequency of each group based on the start and end time indexes and trend direction sequence of the combination segments in the number of continuous combination segment groups, establishes an identification mark for the combination group that meets the two conditions, compares and filters the screening results, and obtains the number of attack guidance sections by filtering out the groups that do not meet the conditions.

[0019] The feature number arrangement submodule extracts the modal channel identifier, section start and end time index, and trend switching sequence corresponding to all marked sections according to the number of attack guidance sections, combines the fields in a fixed format, generates a unique number sequence for each combined content, and obtains a feature segment group number list.

[0020] As a further scheme of the application, the log time structure recognition module comprises:

[0021] The log reading submodule reads the multi-level hardware log data in the time window corresponding to all numbered sections based on the attack guidance feature segment group number list, extracts the modal channel identifier, timestamp, and execution record type corresponding to each log record, reorders each log record in ascending order of timestamp, and classifies and establishes a time sequence list according to the modal channel to generate a modal time sequence set.

[0022] The anomaly detection submodule judges the time difference of adjacent log time stamps in the sequence according to the time sequence of each modality channel in the modality time sequence set, simultaneously judges whether the time point of the current interruption segment coincides with the time range covered by any number in the attack guide characteristic segment group number list, records the current modality channel and the log structure position number if the time stamps coincide, and obtains the number of time coincidences;

[0023] The index establishment submodule extracts the modality identifier, structure level name and interruption time point corresponding to all marked interruption records according to the number of time coincidences, establishes a corresponding relationship mapping table, groups the mapping content according to the modality dimension, arranges the interruption records in each group in chronological order to generate a number sequence, numbers and indexes the interruption information under each modality record, and obtains the log interruption anomaly behavior association index set.

[0024] As a further scheme of the application, the attack behavior positioning module comprises:

[0025] The modality backtracking submodule matches the modality identifier number pointed to by each interruption record based on the log interruption anomaly behavior association index set, backtracks the behavior records of the corresponding modality channel before and after the interruption time point, extracts the trend change sequence and behavior type within the time range, records and binds the behavior segments according to the modality number, and generates the number of backtracked modality behavior characteristics.

[0026] The consistency comparison submodule judges whether the time of the modality switching operation differs from the log interruption time by less than a time difference threshold according to the trend change record corresponding to each modality number in the backtracked modality behavior characteristic number and the log interruption time point, records the corresponding modality number and switching point time if the condition is met, and generates the number of time consistency matches.

[0027] The feature marking submodule extracts all modality number lists that have met the time difference threshold according to the number of time consistency matches, performs secondary judgment on the trend value sequence in the backtracked behavior segment, filters the sequence segment with continuous fluctuation amplitude and records the start and end time, confirms the offset behavior characteristics, marks the offset, arranges all the marked modality numbers, and obtains the offset characteristic modality number list.

[0028] As a further scheme of the application, the system further comprises:

[0029] The modality blocking control module performs strategy review according to the current running state of the marked modality number based on the offset characteristic modality number list, applies an isolation flag to the channel flow import instruction and modality switching execution instruction if the offset behavior has been determined, blocks the running path and suspends the scheduling, and obtains the multi-modality AI model attack behavior detection and blocking response record.

[0030] The multi-modal AI model attack behavior detection and blocking response record includes an isolation mark corresponding to the modal number, a channel flow blocking instruction, and a model scheduling suspension state record.

[0031] As a further scheme of the application, the isolation mark is specifically a network isolation standard in key security control measures formulated by the Internet Security Center.

[0032] As a further scheme of the application, the modal blocking control module includes:

[0033] The state review submodule extracts the running state mark of each modal number currently in based on the offset feature modal number list, reads the latest state information recorded, performs a screening judgment operation on the state, and if there is any state and the number has been marked as an offset number, marks the corresponding modal number as a blocking state number, generates the number of blocking state modal numbers, and

[0034] The instruction isolation submodule locates the corresponding model channel flow incoming instruction and modal switching execution instruction according to all modal numbers in the number of blocking state modal numbers, writes an isolation mark to the operation label, records the number and write time for each successful writing, completes the instruction control structure identification update, obtains the number of isolation instruction identifications, and

[0035] The scheduling lock submodule retrieves all corresponding path entries according to the modal numbers recorded in the number of isolation instruction identifications, adjusts the current running state according to the number matching path control unit, records the modified path number, suspension timestamp and modal number, establishes an index structure, and obtains the attack behavior detection and blocking response record.

[0036] The technical scheme provided by the embodiment of the application has at least the following beneficial effects:

[0037] By extracting the trend change direction of the multi-modal input in the time sequence, constructing a trend reverse segment combination quantization mechanism based on the trend correlation difference between the modes, introducing combination segment statistics of the trend change direction and time continuity judgment, combining the trend frequency change to form a recognition path of potential attack guiding behavior, performing abnormal interruption association analysis on the time synchronization log structure, matching the modal behavior offset feature and marking and judging under the condition of time consistency, identifying the channel input behavior with the offset feature and dynamically blocking its execution process, completing real-time control and strategy isolation of potential malicious input, and realizing rapid positioning and effective blocking of the adversarial sample attack and model poisoning behavior. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0039] Figure 1 FIG. 1 is a schematic diagram of a multi-modal AI model attack behavior detection and blocking system provided by an embodiment of the present application;

[0040] Figure 2 FIG. 2 is a system framework schematic diagram of the present application;

[0041] Figure 3 FIG. 3 is a flowchart of a traffic distribution monitoring module in the present application;

[0042] Figure 4 FIG. 4 is a flowchart of an attack behavior guiding identification module in the present application;

[0043] Figure 5 FIG. 5 is a flowchart of a log time structure identification module in the present application;

[0044] Figure 6 FIG. 6 is a flowchart of an attack behavior positioning module in the present application;

[0045] Figure 7 FIG. 7 is a flowchart of a modal blocking control module in the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the present application will be described below with reference to the drawings.

[0047] In the embodiments of the present application, the words such as "example", "for example" and the like are used to represent as an example, illustration or description. Any embodiment or design scheme described as "example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the word "example" is intended to present the concept in a specific manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be one of the two.

[0048] In the embodiments of the present application, "image" and "picture" can be used interchangeably at times. It should be pointed out that when the distinction is not emphasized, the meanings expressed are consistent. "Of", "corresponding" and "corresponding" can be used interchangeably at times. It should be pointed out that when the distinction is not emphasized, the meanings expressed are consistent.

[0049] In the embodiments of the present application, sometimes the subscript such as W1 may be written in the form of non-subscript such as W1, and the meanings expressed thereby are consistent when the distinction is not emphasized.

[0050] To make the technical problems, technical solutions and advantages to be solved by the present application clearer, specific embodiments will be described in detail below with reference to the drawings.

[0051] The embodiments of the present application provide a multi-modal AI model attack behavior detection and blocking system, such as Figures 1-2 The multi-modal AI model attack behavior detection and blocking system schematic diagram is shown in the figure, the system comprises:

[0052] The traffic distribution monitoring module obtains real-time traffic data of each channel of the multi-modal AI model, extracts the input trend change direction of each channel in the adjacent time period according to the time sequence slice, detects the Pearson correlation coefficient (a standard index for measuring the linear correlation degree of two variables in statistics, the value range is-1 to 1, less than-0.7 indicates strong negative correlation) between the input trends of different modal channels in the same time period, records all the combination segments with opposite trend directions, and generates the total amount of modal trend reverse combination segments;

[0053] The attack behavior guiding recognition module searches for the combination segments that appear continuously in time according to the total amount of modal trend reverse combination segments, delimits the potential attack guiding section according to the continuous time length (≥5 seconds) and the trend switching frequency (≥3 times per second), integrates the corresponding modal identifier, time index and trend change characteristics, and generates the attack guiding feature segment group number list;

[0054] The log time structure recognition module reads the multi-level hardware log data in the same time window based on the attack guiding feature segment group number list, extracts the modal execution record, maps it according to the timestamp, checks whether there is a continuous record interruption in each modal log, counts the log structure position where the abnormal behavior coincides with the guiding section, constructs the corresponding relationship index of the modal and the log interruption, obtains the log interruption abnormal behavior association index set;

[0055] The attack behavior positioning module matches the modal number corresponding to each abnormal behavior according to the log interruption abnormal behavior association index set, traces back the behavior performance characteristics of the corresponding modal in the adjacent period, judges whether there is a deviation behavior characteristic, compares the time consistency (time difference <500 ms) of the modal switching point and the log structure interruption, marks the modal behavior with the deviation characteristic, and generates the deviation characteristic modal number list;

[0056] The modal blocking control module performs strategy review based on the offset feature modal number list according to the current running state of the number of marked modes, and if there is a determined offset behavior, the isolation flag (network isolation standard in the key security control measures formulated by the Internet Security Center) is applied to the channel flow incoming instruction and the modal switching execution instruction, the running path is blocked and the scheduling is suspended, and the multi-modal AI model attack behavior detection and blocking response record is obtained.

[0057] The total amount of modal trend reverse combination fragments includes the number of combination fragments with opposite trend directions, the time slice index of each modal channel, and the strong negative correlation combination record. The attack guide feature fragment group number list includes modal identification, time period start and end index, and trend switching frequency information. The log interruption abnormal behavior association index set includes the log structure position index, the modal log interruption identification, and the timestamp correspondence relationship. The offset feature modal number list includes the modal number with offset behavior characteristics, the consistency label of the switching point and the interruption time, and the behavior characteristic parameter in the period. The multi-modal AI model attack behavior detection and blocking response record includes the isolation flag corresponding to the modal number, the channel flow blocking instruction, and the model scheduling suspension state record.

[0058] Specifically, as shown in Figure 2 , 3 The flow distribution monitoring module includes:

[0059] The flow slice submodule obtains real-time flow data of each channel of the multi-modal AI model, continuously divides the real-time flow data of each channel in a fixed time period according to time sequence, and numbers and identifies the divided time period flow data. By comparing the difference value change trend of the adjacent number time period flow data set in the division result with the current and the previous time period flow data in the numerical change direction, a channel time slice trend direction sequence is generated.

[0060] To obtain real-time traffic data for each channel of a multimodal AI model, a separate data flow record table needs to be established for each channel. During the acquisition process, data traffic within each millisecond should be continuously collected according to the actual deployed inference engine architecture. The data acquisition module, primarily driven by the CPU or GPU, records the traffic value corresponding to each inference task call. For example, the traffic of a certain image modality channel might be 8.5MB at the first time point, 9.1MB at the second time point, and 9.3MB at the third time point. Based on this, each acquisition record is sequentially numbered using a timestamp. For fixed time intervals of 1 second, all data within the channel is divided according to the timestamp from smallest to largest. The data is divided into multiple adjacent time segments. For example, the first segment contains all data within 0-1 seconds, the second segment contains 1-2 seconds, and so on. Each segment contains multiple sampling points. After division, information such as the segment number, start and end time, and number of sampling points must be recorded. Then, the direction of the traffic trend over time is determined based on the difference in the average traffic value between two adjacent segments. If the average traffic value of the later segment is higher than that of the earlier segment, the trend direction is defined as positive; otherwise, it is negative. For example, if the average traffic value of segment number 1 is 8.7MB and the average traffic value of segment number 2 is 9.4MB, the trend is positive. If the average traffic value of segment number 3 is 8.6MB, the trend is negative. To determine the trend direction, the process of calculating the average traffic value in each segment is as follows: in, For the first The average flow rate of the segment For the first Section 1 The flow rate values ​​sampled at each time point, For the first The number of sampling points contained in a segment. For example, if segment 1 contains 10 sampling points and the total flow is 87MB, then the average value is 8.7MB. The directional trend value is calculated based on the segment average, and a trend direction sequence is generated sequentially. For example, the trend sequence for channel A can be represented as... Finally, a channel time slice trend direction sequence is generated.

[0061] The trend extraction submodule reads the trend direction of the time slice corresponding to different modal channels within the same time period based on the channel time slice trend direction sequence. It performs direction consistency judgment on any two modal channel trend direction values ​​in a one-to-one pairing manner, filters out pairing combinations with opposite directions, records the pairing combinations, and generates modal trend reverse combination fragment values.

[0062] Based on the channel time slice trend direction sequence, the trend direction values of different modal channels in the same time period are paired. For example, at the 3rd second, the trend of the image modal is +1, the trend of the text modal is -1, and the trend of the voice modal is +1. In this time period, the trend direction pairing of the three groups is image-text, image-voice, and text-voice. The trend direction values of each group are compared one by one. If the signs of the trend values of the two channels are opposite, it is determined that the directions are opposite. For example, in the pairing of image-text, the trends are +1 and -1, respectively, and the trend directions are opposite, which is an effective combination. The number of all effective combinations is counted, and the time period number and the channel name involved are recorded. For example, at the 5th second, there is a text-voice combination with opposite directions, and the trend direction values are +1 and -1, respectively. This combination is recorded as an effective combination segment. Each time the trend direction signs are determined, the trend direction values are actually multiplied. If the product is less than 0, the directions are opposite. For example, the trends are +1 and -1, respectively, and the product is -1, which is less than 0. The combination is recorded. This process will traverse all trend pairings between channels in each time period. The pairing method is two-by-two pairing. The total number of combinations is the number of combinations of the number of channels. If there are 4 modal channels, the number of pairing combinations per second is 6 groups. The total number of opposite trend combinations in all time periods is counted to generate the modal trend reverse combination segment value.

[0063] The correlation calculation sub-module constructs the trend direction sequence of each modal channel in the same time period according to the modal trend reverse combination segment value, determines the trend value vector between two modal channels in the corresponding time period, and calculates the Pearson correlation coefficient between the trend value vectors. The number of combination segments that meet the strong negative correlation condition is counted to obtain the total amount of modal trend reverse combination segments.

[0064] According to the modal trend reverse combination segment value, the trend direction sequence of all modal channels in each time period is called. In the ith second time period, any two channels form a trend vector. For example, the trend vector of the image modal channel is , and the trend vector of the text modal channel is . The trend value vector is constructed for the two channels in the corresponding time period, and the Pearson correlation coefficient is used to calculate the linear correlation degree. The calculation formula is as follows: , wherein and represent the trend direction values of the two channels in the kth time period, and represent the mean values of the trend sequences of the channels, is the number of time periods. If the calculation result is less than -0.7, it is determined that there is a strong negative correlation. Specifically, in the above example, the directions of the two channels are completely opposite, and , if the condition is met, the Pearson coefficient of each pair of channel combination in each time period is calculated and judged, and the combination time period number and combination channel name of all combinations less than-0.7 are recorded, and the total number of such combinations is counted, for example, if there are 13 combination segments that meet the condition in 50 time periods, then the total number of modal trend reverse combination segments is 13.

[0065] Specifically, as shown in Figure 2 , 4 , the attack behavior guidance recognition module includes:

[0066] The continuous segment identification submodule obtains the time index number corresponding to each combination segment and the time interval of adjacent segments based on the total number of modal trend reverse combination segments, and if the adjacent time periods are continuous, they are classified into the same combination group. All combination segments are divided into continuous combination segment groups to generate the number of continuous combination segment groups.

[0067] Based on the total number of modal trend reverse combination segments, the time index number of each combination segment and the time interval between adjacent combination segments are obtained. First, all identified trend reverse combination segments are sorted in chronological order, and each segment is labeled with its starting time point number, such as number , , , etc. Then, the time interval between the adjacent two segments is calculated, and is judged whether it is equal to 1 second. If the condition is met, it is considered that the two segments appear continuously and are classified into the same combination group. For example, if the time index of the segments is 10, 11, 12, 14, 15, 18, 19, and 20, the first three segments form a combination group, 14 and 15 form a second group, and 18 to 20 form a third group, each group contains 3 seconds, 2 seconds, and 3 seconds of continuous appearance information. If there are discontinuous segments, such as and , the interval is 2 seconds, then they are not classified into the same group. When performing the above judgment action, each pair of adjacent time points needs to be judged. The judgment action is: if , the current combination group is marked for continuous expansion, otherwise the current group is ended and a new combination identification count is started. After all combination groups are constructed, the number of combination segments, the starting time number, the ending time number, and the combination sequence number in each group are recorded. The combination sequence number is set in an increasing manner from 1, and the number of continuous combination segment groups is finally generated.

[0068] The section determination submodule performs double screening on the time span and trend switching frequency of each group based on the start and end time indexes of the combination segments in the number of continuous combination segment groups and the trend direction sequence, establishes an identification mark for the combination groups that meet both conditions, compares and filters out the groups that do not meet the conditions, and obtains the number of attack guidance sections.

[0069] Call the start and end time index of each group in the number of continuous combination fragment groups and the trend direction sequence, first calculate the duration length of each combination fragment group, which is the termination time number minus the start time number plus 1, judge whether the value is greater than or equal to 5, if it meets the next judgment condition, continue to extract all trend direction values from the trend direction sequence corresponding to the combination group, count the number of positive and negative changes, that is, the number of times from +1 to -1 or from -1 to +1, record the total number of trend changes, and then divide the value by the duration length to calculate the trend switching frequency , judge whether the frequency is greater than or equal to 3 times per second, if the two conditions are met, that is, the duration is not less than 5 seconds, and the trend direction switching times per second is not less than 3 times, then mark the combination group as an attack guide candidate segment, for example, if a combination group starts and ends at 20 to 26 seconds, a total of 7 seconds, and the trend direction sequence is , then the switching times are 6, and the frequency is , which is less than 3 times per second, which does not meet the condition, and is not recorded as an attack guide segment, while if another combination group has 15 direction switches in 5 seconds, the frequency is 3 times per second, which meets the condition and is counted as an attack guide segment. Finally, all combination groups are screened, judged and marked to obtain the number of attack guide segments.

[0070] The feature number arrangement submodule extracts the modal channel identifier, segment start and end time index, and trend switching sequence corresponding to all marked segments according to the number of attack guide segments, combines the fields in a fixed format, and generates a unique serial number for each combination content to obtain an attack guide feature segment group number list;

[0071] According to the number of attack guide segments, extract the modal channel identifier information, start and end time index of the combination segment, and trend switching direction sequence corresponding to each combination group marked as an attack guide segment. The modal channel identifier information is extracted from all involved channel numbers in the original reverse trend combination fragment included in the combination group and is de-duplicated and integrated, the time index directly uses the start number and end number of the combination group as the segment boundary, and the trend switching direction sequence is the trend direction value per second in the combination group. Subsequently, the three contents are combined into a text field in the format: channel identifier-time range-trend sequence, and then a unique number is assigned to each combination content by calling the number increment rule, such as numbers G001, G002, etc. For example, if a channel combination is image and voice, the start and end time is 30-36 seconds, and the trend sequence is Then its combined field is "image + audio - 30_36 - [+1, -1, +1, -1, +1, -1, +1]", and the field number is G001. After all the filtered segments are processed in sequence, a mapping table between the number and the content is formed, and finally the attack guidance feature fragment group number list is obtained.

[0072] Specifically, such as Figure 2 , 5 As shown, the log time structure recognition module includes:

[0073] The log reading submodule reads multi-level hardware log data within the time window corresponding to all numbered segments based on the attack bootstrapping feature fragment group number list, and extracts the modal channel identifier, timestamp, and execution record type corresponding to each log record. It then re-sorts each log record by timestamp from smallest to largest and classifies them by modal channel to create a time series list, generating a modal time series set.

[0074] Based on the attack bootstrapping feature fragment group number list, multi-level hardware log data within the time range corresponding to each number is read. The reading process extracts log entries by querying each segment in the number list. Each numbered record contains start and end timestamps and modal channel type fields. The reading action is filtered by segment time index, retaining only data records whose timestamps are within that segment. The modal identifier, timestamp, and execution event type fields are extracted from each record. The modal identifier field distinguishes whether the log source belongs to a visual, voice, or text channel, etc. The execution event type field records the operation category, such as "start inference," "complete inference," "error retry," etc. Subsequently, all extracted logs are processed... Aggregation is performed using modal identifiers as grouping criteria to generate multiple log sequences. Each log sequence is then sorted in ascending order by timestamp field, forming a modal-time two-dimensional sequence data structure. For example, in segment G002, the time range is from 110 seconds to 122 seconds. After reading the original log records, 9 log sequences belonging to the voice channel are extracted, with timestamps of 110, 111, 112, 113, 115, 116, 117, 119, and 120, and event types of "execution start", "speech recognition", and "cache loading", respectively. An ordered structure is regenerated through sorting for subsequent interruption judgment, ultimately generating a modal time series set.

[0075] The anomaly detection submodule determines the time difference between adjacent log timestamps in the modal time series based on the time series of each modal channel in the modal time series set. At the same time, it obtains whether the time point of the current interruption segment overlaps with the segment covered by any number in the attack guidance feature segment group number list. If the timestamps overlap, it records the current modal channel and the log structure position number and obtains the number of time-overlapping interruptions.

[0076] The system retrieves the timestamp sequence for each modal channel in the modal time series set, sequentially extracts the timestamp difference between two adjacent log records, and performs a difference check. If the time interval is greater than 1 second, it is marked as an interrupted segment. The difference check is performed on any two adjacent timestamps. and Perform calculation If the result is greater than 1, the current segment is the start point of the interruption, and the start and end times are recorded. For example, if there are consecutive records with timestamps of 200 and 203 in the visual channel log, the interruption segment is defined as seconds 201 to 202. After marking, the time range of the interruption record is obtained, and then compared with the start and end times marked on each numbered record in the attack guidance feature fragment group number list to determine if the time range overlaps with any numbered segment on the time axis. The judgment criterion is that the time range of the interruption segment intersects with any numbered segment on the time axis. and If the conditions are met, the interruption segment is considered to have occurred at the same time as the attack guidance segment. The modality type, log structure level (such as core layer, middleware layer) and interruption time of the record are recorded. For example, if the log interruption of a certain voice modality occurs between 300 and 304 seconds, and the segment covered by number G005 is between 302 and 308 seconds, then the two timelines have an intersection, which is judged as an overlap and included in the result statistics. Finally, the number of time-overlapping interruptions is obtained.

[0077] The index building submodule extracts the modal identifier, structural hierarchy name and interrupt time point corresponding to all marked interrupt records based on the number of interrupts with overlapping time, and builds a corresponding mapping table. The mapping content is grouped according to the modal dimension. After arranging the interrupt records in each group in chronological order, a number sequence is generated. The interrupt information under each modal record is numbered and indexed to obtain the log interruption abnormal behavior associated index set.

[0078] According to the number of time coincident interrupts, three core fields in all coincident interrupt records are extracted, including the type of the modal to which the interrupt belongs, the name of the log structure level, and the start timestamp of the interrupt segment. The name of the structure level is mapped and classified by the source module field in the log record, such as being marked as a scheduling layer if the interrupt is generated by a CPU scheduler, and being marked as an inference layer if it belongs to a model service process. A one-to-one correspondence is established for all three fields of the interrupt record to construct a field triple mapping list. For example, a record is "text modal-middleware layer-205 seconds", and a mapping record of "text modal->middleware layer->205 seconds" is established. Then all records are grouped according to the modal dimension, and the interrupt segments of the records in each group are sorted in ascending order of timestamp and then renumbered. The numbering format is "M001-1", "M001-2", and so on. Each record is assigned a unique number. Finally, all interrupt fields and corresponding numbers are integrated into a dictionary structure, and all mapping relationships are recorded and exported as an index file to obtain the log interrupt abnormal behavior association index set.

[0079] Specifically, as shown in Figure 2 、 6 , the attack behavior positioning module includes:

[0080] The modal backtracking submodule matches the modal identifier number pointed to by each interrupt record based on the log interrupt abnormal behavior association index set, backtracks the behavior records of the corresponding modal channel before and after the interrupt time point, extracts the trend change sequence and behavior type within the time range, records the behavior segments and binds them with the modal number, and generates the backtracked modal behavior feature quantity.

[0081] Based on the log interrupt abnormal behavior association index set, the modal number field annotated by each record in the index set is extracted, and a mapping list of the number and the interrupt time is established. The behavior data records of the modal channel corresponding to the number are backtracked, and the behavior performance data within a range of 2 seconds before and after the interrupt time point is extracted. The behavior data includes the trend direction sequence and the behavior type label. The difference of the trend direction sequence is judged. If the trend direction value of each adjacent point changes from positive to negative or vice versa, it is counted as one change. The total number of changes is counted and judged whether it is greater than 3. If the number of changes meets the condition, the behavior type in this segment is further checked whether it appears "instruction withdrawal" or "data retransmission" and the like. For example, the number M014 changes the trend direction from to between 105 and 109 seconds, and the number of changes is 4. At the same time, the behavior type is marked as "retransmission" at 107 seconds. Therefore, the number meets the backtracking filtering condition, the trend sequence and the operation label are recorded, and the modal number is bound into the result set to finally generate the backtracked modal behavior feature quantity.

[0082] The consistency comparison submodule judges whether the time of the mode switching operation is less than the time difference threshold from the trend change record corresponding to each mode number in the backtracking mode behavior feature quantity and the log interruption time point. If yes, the corresponding mode number and switching point time are recorded, and the time consistency matching quantity is generated;

[0083] The trend record corresponding to each mode number in the backtracking mode behavior feature quantity is called, the time value of the mode switching operation is obtained, and the difference value is calculated from the interruption time. Let the interruption time be , the switching point time be , execute , judge whether it is greater than 0 and less than 500 milliseconds. If yes, the mode number meets the consistency matching condition. For example, the interruption time of number M009 is 311.300 seconds, the switching point is 311.520 seconds, the difference is 220 milliseconds, which meets the judgment condition. The mode number, corresponding switching point time and interruption time are recorded together. All numbers and times that meet the conditions are accumulated in the result list, and the time consistency matching quantity is finally generated.

[0084] The feature marking submodule extracts the mode number list that has met the time difference threshold according to the time consistency matching quantity, and performs secondary judgment on the trend value sequence in the backtracking behavior segment. The sequence segment with continuous fluctuation amplitude and direction reversal is screened and the start and end times are recorded. After confirming the offset behavior feature, the offset mark is marked. The offset feature mode number list is obtained by sorting all the marked mode numbers.

[0085] According to the time consistency matching quantity, the mode numbers that have met the time difference threshold judgment are extracted, and secondary fluctuation judgment operation is performed on the trend direction sequence corresponding to the mode numbers. The judgment basis is that three consecutive sign direction reversals appear in the sequence, that is, if there are, for example , it is considered that there is an offset behavior. The position interval of the first time that meets the three reversals is located for each sequence, which is set as the offset section. The mode number is marked with an "offset" mark. The number, fluctuation segment start and end time and behavior time segment identifier are recorded. All the numbers with this mark are collected and sorted into a structured data table. For example, the trend sequence of number M021 is , four direction reversals are formed in 120 to 124 seconds, which meets the condition. M021 is recorded and listed. Finally, the offset feature mode number list is obtained.

[0086] Specifically, as shown in Figure 2 , 7 , the mode blocking control module comprises:

[0087] The state review submodule extracts the running state flag of each modal number based on the offset feature modal number list, reads the latest state information recorded, performs a screening and judgment operation on the state, and if there is any state and the number has been marked as an offset number, the corresponding modal number is marked as a state number that needs to be blocked, and the number of blocked state modal numbers is generated;

[0088] Based on the offset feature modal number list, first, each modal number is obtained from the list, and the current state corresponding to each modal number is extracted by reading the latest running state information recorded in the model task scheduling table. This state usually includes different activity identifiers such as "inference", "request waiting", "buffer transmission", etc. Each state reflects the current state of the modal channel during running, such as "inference" indicating that the current modal is executing an inference task, "request waiting" indicating that the modal is waiting for a data request, and "buffer transmission" indicating that data is in the process of transmission and has not been completed. Then, by screening the current state field, it is determined whether the modal is in one of these key active states. If a modal is in these states and the modal number is marked as an offset number in the previous operation, we will mark the modal number as a "blocked" state. This operation is achieved by comparing the offset feature modal number with the current state identifier. For example, assume that the modal number M032 is in the "inference" state, and has been determined to be an offset number in the previous state review, then the number will be marked as a blocked state. At this time, all subsequent instructions of the modal will be blocked to prevent its continuous execution, ensuring the safety of the system. Through such screening and judgment, all modal numbers that meet the conditions will be listed, and the number of blocked state modal numbers will be generated according to their states. Assuming that there are 10 modal numbers in the list that meet these conditions, the result generated is that the "number of blocked state modal numbers" is 10, meaning that these 10 modals need to be isolated and blocked.

[0089] The instruction isolation submodule locates the corresponding model channel flow import instruction and modal switch execution instruction according to all modal numbers in the number of blocked state modal numbers, writes an isolation flag to the operation label, records the number and write time for each successful write, and completes the instruction control structure identifier update to obtain the number of isolated instruction identifiers;

[0090] In the number of blocking state modal, first according to all the modal numbers screened from the state review, continue to locate the channel traffic import instruction and modal switch execution instruction in the model reasoning scheduling related to these modes. Each mode will have multiple control instructions in the system, respectively managing traffic import, processing and model switching, etc. These instructions are closely related to the operation of the mode, and directly affect the overall stability of the system. For each modal number, the system will match its related traffic import instruction and modal switch execution instruction one by one, and update the operation label field of these instructions, write an "isolation flag". This "isolation flag" is set according to the network isolation standard formulated by the Internet Security Center, the value is "FLAG_ISO", which means that the instruction is in the network isolation state and will no longer continue to execute. For example, assume that the traffic import instruction and switch execution instruction corresponding to the modal channel of number M014 have been identified in the system, and the modal number has been determined to be blocked, the system will immediately write "FLAG_ISO" flag for these instructions, and record the timestamp of the operation and the corresponding modal number. If in an actual scenario, the modal number M018 needs to be isolated, and the instruction is written at 10:30:45, the instruction will be updated to contain the control flag "FLAG_ISO". In this way, all the modal instructions that need to be isolated will be timely marked, and the control structure of all related instructions will be updated in real time. Finally, all the modal numbers and their related operations that have successfully written the isolation flag will be recorded and counted, generating the number of isolated instruction identifiers, for example, when processing 10 modal numbers, there may be 8 modal numbers whose instructions have successfully written the isolation flag, so the "number of isolated instruction identifiers" is 8.

[0091] The scheduling lock sub-module retrieves all corresponding path entries according to the modal numbers recorded in the number of isolated instruction identifiers, matches the path control unit by number and adjusts the current running state, records the modified path number, abort timestamp and modal number, establishes an index structure to obtain attack behavior detection and blocking response records;

[0092] According to the records in the isolation instruction identifier quantity, the system will retrieve the dispatch path management table to find the path entries corresponding to these modal numbers. Each path entry represents a specific dispatch path, which records the specific execution route and dispatch control information of the model inference task. By matching these path entries with the modal numbers, the system can accurately identify each path that needs to be aborted. For each identified path, the system will immediately adjust the path's state, switching it from "running" to "aborted". This state change means that all inference tasks on this path will no longer continue to execute, thereby blocking further operations of the modal. This process is implemented through the path control unit, which is responsible for the management and termination of dispatch tasks. Taking the modal with number M005 as an example, suppose its corresponding path control entry is marked as path P022 in the dispatch table, and the current state of path P022 is "running", while M005 has been determined to be blocked. At this time, path P022 will be forcibly aborted by the system, and the path state will be updated to "aborted". All aborted path records will be summarized into the response event table, recording detailed information such as path number, timestamp, and modal number. In this way, all paths that need to be aborted will be accurately locked, and their related information will be effectively archived. For example, path P022 is marked as aborted at 10:40:30, modal number M005 is related to path P022, and finally this aborted event will be recorded in the response event table. Through the integration and storage of these aborted records, the system can generate detailed attack behavior detection and blocking response records, which can be used for subsequent auditing, analysis, and further security detection, ensuring the security and stability of the system.

[0093] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A multi-modal AI model attack behavior detection and blocking system, characterized in that, The system comprises: The flow distribution monitoring module obtains real-time flow data of each channel of the multi-modal AI model, extracts input trend change directions of the channels in adjacent time periods, detects Pearson correlation coefficients between input trends of different modal channels, records all trend direction opposite combination segments, and generates a total amount of modal trend reverse combination segments; The attack behavior guidance recognition module retrieves combination segments that appear continuously in time according to the total amount of modal trend reverse combination segments, delimits potential attack guidance segments according to the duration and trend switching frequency of the appearance, and generates a group number list of attack guidance feature segments; The log time structure recognition module reads multi-level hardware log data in the same time window based on the group number list of attack guidance feature segments, maps according to timestamps, and counts log structure positions where abnormal behaviors coincide with guidance segments to obtain an abnormal behavior association index set of log interruptions; The attack behavior positioning module matches modal numbers corresponding to abnormal behaviors according to the abnormal behavior association index set of log interruptions, judges whether there is a shift behavior feature, marks modal behaviors with the shift feature, and generates a shift feature modal number list.

2. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The total amount of modal trend reverse combination segments includes the number of combination segments with opposite trend directions, time slice indexes of each modal channel, and strong negative correlation combination records, the group number list of attack guidance feature segments includes modal identifiers, time period start and end indexes, and trend switching frequency information, the abnormal behavior association index set of log interruptions includes log structure position indexes, modal log interruption identifiers, and timestamp correspondence, and the shift feature modal number list includes modal numbers with shift behavior features, consistency labels of switching points and interruption times, and behavior feature parameters in a period.

3. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The Pearson correlation coefficient is a standard index for measuring the linear correlation degree of two variables in statistics, and the value range is -1 to 1. Less than -0.7 indicates strong negative correlation.

4. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The flow distribution monitoring module comprises: The flow slice submodule obtains real-time flow data of each channel of the multi-modal AI model, continuously divides the real-time flow data of each channel in a fixed time period according to time sequence, and numbers and identifies the flow data of the divided time period. By comparing the difference trend of the current and the last time period flow data in the value change direction through the set of adjacent numbered time period flow data in the division result, a channel time slice trend direction sequence is generated; The trend extraction submodule reads the trend directions of the corresponding time slices of different modal channels in the same time period based on the channel time slice trend direction sequence, discriminates the direction consistency of the trend direction values of any two modal channels in a one-to-one pairing manner, filters the pairing combinations with opposite directions, records the pairing combinations, and generates a modal trend reverse combination segment value. The correlation calculation sub-module combines the trend values of the fragments in reverse according to the modal trend, constructs a trend direction sequence of each modal channel in the same time period, determines trend value vectors between two modal channels in a corresponding time period, calculates Pearson correlation coefficients between the trend value vectors, counts the number of combined fragments that meet the strong negative correlation condition, and obtains a total amount of modal trend reverse combined fragments.

5. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The attack behavior guidance identification module includes: The continuous fragment identification sub-module obtains the time index number corresponding to each combined fragment and the time interval of adjacent fragments based on the total amount of modal trend reverse combined fragments, and if the adjacent time periods are continuous, they are classified into the same combined group. The section demarcation sub-module performs double screening according to the time span and trend switching frequency of each group of combined fragments based on the start and end time indexes of the combined fragments in the continuous combined fragment group quantity and the trend direction sequence, establishes an identification mark for the combined group that meets the two conditions, compares and filters the screening results, and filters out the groups that do not meet the conditions to obtain the number of attack guidance sections. The feature number arrangement sub-module extracts the modal channel identifier, section start and end time index, and trend switching sequence of all marked sections according to the number of attack guidance sections, combines the fields in a fixed format, generates a unique number sequence for each combined content, and obtains a combined group number list of attack guidance feature fragments.

6. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The log time structure identification module includes: The log reading sub-module reads the multi-level hardware log data in the time window corresponding to each numbered section based on the combined group number list of attack guidance feature fragments, extracts the modal channel identifier, timestamp, and execution record type of each log record, reorders each log record in ascending order of timestamp, and classifies and establishes a time sequence list according to the modal channel to generate a modal time sequence set; The anomaly detection sub-module judges the time difference between adjacent log timestamps in the time sequence of each modal channel in the modal time sequence set, simultaneously determines whether the time point of the current interrupt fragment overlaps with the section covered by any number in the combined group number list of attack guidance feature fragments, records the current modal channel and the log structure position number if the timestamps overlap, and obtains the number of time overlapping interrupts; The index establishment sub-module extracts the modal identifier, structure level name, and interrupt time point corresponding to all marked interrupt records according to the number of time overlapping interrupts, establishes a corresponding relationship mapping table, groups the mapping content by modal dimension, arranges each group of interrupt records in chronological order to generate a number sequence, numbers and indexes the interrupt information under each modal record, and obtains a log interrupt abnormal behavior association index set.

7. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The attack behavior positioning module includes: The modal backtracking sub-module matches the modal identifier number pointed to by each interrupt record based on the log interrupt abnormal behavior association index set, backtracks the behavior records of the corresponding modal channel before and after the interrupt time point, extracts the trend change sequence and behavior type within the time range, records and binds the behavior fragments according to the modal number, and generates the number of backtracked modal behavior features. The attack behavior positioning module includes: The modal backtracking sub-module matches the modal identifier number pointed to by each interrupt record based on the log interrupt abnormal behavior association index set, backtracks the behavior records of the corresponding modal channel before and after the interrupt time point, extracts the trend change sequence and behavior type within the time range, records and binds the behavior fragments according to the modal number, and generates the number of backtracked modal behavior features. The consistency comparison submodule determines whether the time of the mode switching operation is less than the time difference threshold from the log interruption time point according to the trend change record corresponding to each mode number in the backtracking mode behavior feature quantity, and records the corresponding mode number and switching point time if the determination is true, and generates a time consistency matching quantity; The feature marking submodule extracts a mode number list that has met the time difference threshold according to the time consistency matching quantity, and performs secondary judgment on the trend value sequence in the backtracking behavior segment, screens the sequence segment with continuous fluctuation amplitude and records the start and end time, confirms the offset behavior feature, marks the offset, arranges all the marked mode numbers, and obtains an offset feature mode number list.

8. The multi-modal AI model attack behavior detection and blocking system of claim 1, wherein, The system further comprises: The mode blocking control module performs strategy review based on the offset feature mode number list according to the current running state of the marked mode number, and applies an isolation flag to the channel flow import instruction and the mode switching execution instruction if the offset behavior is determined, blocks the running path and suspends the scheduling, and obtains a multi-modal AI model attack behavior detection and blocking response record; The multi-modal AI model attack behavior detection and blocking response record comprises an isolation flag corresponding to the mode number, a channel flow blocking instruction, and a model scheduling suspension state record.

9. The multi-modal AI model attack behavior detection and blocking system of claim 8, wherein, The isolation flag is specifically a network isolation standard in the key security control measures formulated by the Internet Security Center.

10. The multi-modal AI model attack behavior detection and blocking system of claim 8, wherein, The mode blocking control module comprises: The state review submodule extracts the running state flag of each mode number based on the offset feature mode number list, reads the latest state information, performs screening and judgment operations on the state, and marks the corresponding mode number as a blocking state number if any state and number have been marked as offset numbers, and generates a blocking state mode number quantity; The instruction isolation submodule locates the corresponding model channel flow import instruction and mode switching execution instruction according to all the mode numbers in the blocking state mode number quantity, writes an isolation flag to the operation label, records the number and write time for each successful write, completes the instruction control structure identification update, and obtains an isolation instruction identification quantity; The scheduling blocking submodule retrieves all corresponding path entries according to the mode numbers recorded in the isolation instruction identification quantity, adjusts the current running state according to the number matching path control unit, records the modified path number, suspension timestamp and mode number, establishes an index structure, and obtains an attack behavior detection and blocking response record.

Images