Attack detection method and device for MCP client, medium and equipment

Abstract

The embodiment of the invention discloses an attack detection method for an MCP client, which comprises the following steps of: deploying a tangent point program in the MCP client in advance, triggering the tangent point when the MCP client operates the code in response to a tool calling request sent by an LLM (Logical Link Management), and sending the tangent point to the MCP client, and calling a pre-deployed section program, and carrying out attack detection on description information of each available tool provided by each MCP server and obtained by running the code through the section program. Through the method, the tool poisoning attack instruction added in the description information of the available tool by an attacker can be effectively detected, so that the security of calling the tool provided by the MCP server by the MCP client can be improved.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to an attack detection method, apparatus, medium and device for an MCP client. Background Technology

[0002] With the development of artificial intelligence (AI) technology, large language models (LLM) have been widely used in various fields.

[0003] Through LLM, users can obtain various information and knowledge as if communicating with real people. In particular, generative LLM can also help users generate images and computer code, greatly simplifying the tedious operations required by users in their daily life and work.

[0004] However, for some questions raised by users, relying solely on the LLM's own reasoning capabilities is insufficient. This necessitates invoking external tools to assist in resolving the user's questions. To facilitate unified invocation of various external tools, the Model Context Protocol (MCP) was developed. MCP clients can simultaneously establish an interaction channel between the user and the LLM and invoke tools provided by various external MCP servers to assist the LLM in providing services to the user.

[0005] However, in scenarios where attackers interact with LLM through an MCP client and invoke tools provided by the MCP server, how to detect attacks carried out by attackers using the MCP client is an urgent problem to be solved. Summary of the Invention

[0006] This specification provides an attack detection method, apparatus, storage medium, and electronic device for MCP clients, in order to partially solve the problems existing in the prior art.

[0007] The embodiments in this specification adopt the following technical solutions:

[0008] This specification provides an attack detection method for an MCP client. The method is applied to a Model Context Protocol (MCP) client, and an aspect-oriented program is pre-deployed in the MCP client. The pointcut of the aspect-oriented program is the code in the MCP client used to obtain description information of available tools provided by the MCP server. The method includes:

[0009] Obtain the user's input command and send the input command to the Large Language Model (LLM);

[0010] receive a tool calling request returned by the LLM after performing semantic analysis on the input instruction;

[0011] in response to the tool calling request, run the code to obtain description information of each available tool provided by each MCP server;

[0012] in response to a trigger of running the code, call the aspect program deployed in advance;

[0013] perform attack detection on the obtained description information through the aspect program.

[0014] The present specification provides an attack detection device of an MCP client, which is applied to an MCP client, and an aspect program is deployed in the device in advance, and the point of the aspect program is code for obtaining description information of available tools provided by an MCP server; the device comprises:

[0015] an interaction module configured to obtain an input instruction of a user and send the input instruction to a large language model (LLM);

[0016] a receiving module configured to receive a tool calling request returned by the LLM after performing semantic analysis on the input instruction;

[0017] an obtaining module configured to, in response to the tool calling request, run the code to obtain description information of each available tool provided by each MCP server;

[0018] a calling module configured to, in response to a trigger of running the code, call the aspect program deployed in advance;

[0019] a detection module configured to perform attack detection on the obtained description information through the aspect program.

[0020] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the attack detection method of the MCP client.

[0021] The present specification provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the attack detection method of the MCP client when executing the program.

[0022] The above at least one technical solution adopted by the embodiments of the present specification can achieve the following beneficial effects:

[0023] The embodiment of the present specification discloses an attack detection method of an MCP client, a cutting surface program is deployed in advance in the MCP client, the cutting point is the code in the MCP client for obtaining the description information of the available tools provided by the MCP server, when the code is run in response to the tool call request sent by the LLM, the cutting point is triggered, the cutting surface program deployed in advance is called, and the description information of each available tool provided by each MCP server obtained by running the code is detected by the cutting surface program. Through the above method, the tool poisoning attack instructions added by the attacker in the description information of the available tools can be effectively detected, so that the security of the MCP client calling the tools provided by the MCP server can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0024] The drawings described herein are used to provide further understanding of the present specification, constitute a part of the present specification, the illustrative embodiments of the present specification and the description thereof are used to explain the present specification, and do not constitute improper limitation on the present specification. In the drawings:

[0025] Figure 1 A system structure schematic diagram of an MCP client calling external tools is provided for the embodiment of the present specification;

[0026] Figure 2 A flowchart of an attack detection method of an MCP client is provided for the embodiment of the present specification;

[0027] Figure 3 An attack detection device schematic diagram of an MCP client is provided for the embodiment of the present specification;

[0028] Figure 4 A structure schematic diagram of an electronic device is provided for the embodiment of the present specification. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical scheme and advantages of the present specification clearer, the technical scheme of the present specification will be described clearly and completely in combination with the specific embodiments of the present specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present specification, not all the embodiments. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present specification.

[0030] The technical scheme provided by each embodiment of the present specification will be described in detail below in combination with the drawings.

[0031] Figure 1 A system structure schematic diagram of an MCP client calling external tools is provided for the embodiment of the present specification, which specifically includes: an MCP client, an MCP server and an LLM. Wherein:

[0032] The MCP client is used for user-oriented and can be deployed on a user device (such as a personal computer, a mobile phone, a tablet computer, etc.) to provide a channel for the user to interact with the LLM.

[0033] Each MCP server is usually deployed in a remote background, for example, can be deployed on a background server, to provide available tools for the MCP client. Relative to the MCP client and the LLM, the available tools provided by the MCP server are external tools.

[0034] The LLM can be deployed on a user device as well as a user device, or can be deployed on a background server. When deployed on a background server, it can be deployed on the same background server as any MCP server, or can be deployed on another background server without any MCP. The LLM is pre-trained and can interact with the user in any one or more of the forms of text, voice, vision, etc.

[0035] In actual application, the MCP client can receive an input instruction directly input by the user in any one or more of the forms of text, voice, vision, etc., such as "What's the weather like today". The MCP client then sends the input instruction to the LLM, and the LLM executes the input instruction. When the LLM finds that it cannot execute the input instruction by itself, it returns a tool calling request to the MCP client to inform the MCP client that the execution of the input instruction requires calling an external tool. After receiving the calling request, the MCP client can obtain a list of available tools provided by each MCP server, which contains the tool identifier of each available tool provided by each MCP server and the description information of each available tool. The MCP client sends the obtained list of available tools to the LLM, so that the LLM determines the tool identifier of the available tool (hereinafter referred to as the target tool) used to execute the input instruction according to the description information of each available tool in the list of available tools and the input instruction of the user, and returns the tool identifier to the MCP client, so that the MCP client calls the target tool corresponding to the tool identifier and executes the input instruction through the target tool.

[0036] However, the process of LLM analyzing the description information of each available tool to determine which available tool is the target tool that can be used to execute the input instruction of the user, and the process of MCP client receiving the tool bar request sent by LLM, obtaining the list of available tools and sending it to LLM, and receiving the tool identifier returned by LLM and calling the corresponding target tool, are not visible to the user, so the attacker can add attack instructions for attack behavior to the description information of the available tool, so that LLM executes the attack instructions added in the description information when analyzing the semantics of the description information of the available tool. For example, if an attack instruction for reading sensitive information is added to the description information of the available tool, LLM will execute the attack instruction when analyzing the semantics of the description information of the available tool to read the sensitive information of the user. Such an attack is called a tool poisoning attack.

[0037] In order to detect the above-mentioned tool poisoning attack, the aspect program is deployed in the MCP client in advance, and the point is the code in the MCP client for obtaining the description information of the available tool provided by the MCP server. Once the MCP client runs the code to obtain the description information of the available tool provided by the MCP server, the running of the above-mentioned aspect program is triggered, and the obtained description information can be detected by the aspect program to detect whether the attack instruction is contained in the description information obtained by the MCP client, such as Figure 2

[0038] Figure 2 An attack detection method flow chart of an MCP client provided by an embodiment of the present specification is shown in the following table, which specifically includes the following steps:

[0039] S200: Obtain the input instruction of the user and send the input instruction to the large language model LLM.

[0040] In the embodiment of the present specification, the method shown in Figure 2 application can be applied to the MCP client, and specifically can be applied to the electronic device where the MCP client is located, such as a personal computer, a mobile phone, a tablet computer, a server or a server cluster composed of multiple servers, etc.

[0041] The user can directly input the input instruction in the form of any one or several of text, voice, vision, etc. to the MCP client. After the MCP client receives the input instruction, the MCP client can send the input instruction to the LLM.

[0042] S202: Receive the tool calling request returned by the LLM after the semantic analysis of the input instruction.

[0043] ​Generally, after receiving the input instruction, the LLM can perform semantic analysis on the input instruction input by the user based on its own reasoning capability, and generate reply information as an execution result of executing the input instruction according to the analysis result. When the LLM determines that it is unable to generate the reply information corresponding to the input instruction only by relying on its own reasoning capability according to the analysis result, it is determined that the execution of the input instruction needs to call external tools at this time, and therefore, the LLM returns a tool calling request to the MCP client.

[0044] S204: In response to the tool calling request, the code is run to obtain the description information of each available tool provided by each MCP server.

[0045] The MCP client runs the code internally pre-written for obtaining the description information of the available tools provided by each MCP server in response to the tool calling request sent by the LLM, and obtains the description information of each available tool provided by each MCP server by running the code.

[0046] The description information of the available tools in the embodiments of the present specification is information for describing the functions of the available tools by natural language, which is written in the MCP server in the form of comments and the like by the developer of the available tools when developing the available tools.

[0047] S206: In response to the trigger of running the code, the pre-deployed aspect program is called.

[0048] Since the aspect program is pre-deployed with the above-mentioned code as the join point in the embodiments of the present specification, the MCP client will trigger the calling of the aspect program once the above-mentioned code is run.

[0049] The MCP client can load the aspect base corresponding to the aspect program when initializing, and the aspect base contains the above-mentioned aspect program and the join point corresponding to the aspect program. Through the aspect base, the MCP client can deploy the aspect program accordingly, so that the running of the above-mentioned code triggers the running of the aspect program.

[0050] S208: The obtained description information is detected for attack by the aspect program.

[0051] In the embodiments of the present specification, the above-mentioned aspect program pre-deployed in the MCP client is used to detect attacks on the description information of each available tool provided by each MCP server obtained by the MCP client. Specifically, for each available tool, it can be detected whether the obtained description information of the available tool contains attack instructions. If the attack instructions are contained, it is determined that the description information of the available tool has attack behavior, otherwise it is determined that the description information of the available tool does not have attack behavior.

[0052] In the embodiment of the present specification, after the MCP client invokes the aspect program, the aspect program can call the pre-trained detection model, and the detection model can detect the attack of the description information of each available tool. The detection model can be deployed on the same electronic device as the MCP client, or can be deployed on other devices, as long as the detection model can be called by the aspect program to detect the attack of the description information.

[0053] Specifically, the MCP client can input the description information of each available tool into the called detection model, and detect whether the description information of the available tool contains attack instructions for attacking LLM. If the attack instructions are contained, it is determined that the description information of the available tool has tool poisoning attack behavior, otherwise it is determined that the description information of the available tool does not have tool poisoning attack behavior.

[0054] Since the tool poisoning attack is that the attacker embeds the attack instructions in the description information of the available tool, and uses LLM to execute the attack instructions embedded in the description information to achieve the attack purpose, and the description information is in natural language form, the attack instructions are also in natural language form. Therefore, in order to enable the detection model to accurately detect whether the description information contains attack instructions, the detection model needs to be pre-trained in the embodiment of the present specification.

[0055] During the training of the detection model, sample description information can be obtained, and the sample description information includes positive samples and negative samples. The positive samples are description information of available tools without attack instructions, and the negative samples are description information of available tools with attack instructions. After obtaining the sample description information, the sample description information can be input into the detection model to be trained, and the detection model to be trained can detect the attack of the input sample description information. According to the attack detection result of the detection model to be trained on the sample description information and the annotation of the sample description information, the model parameters of the detection model to be trained are adjusted. The annotation of the sample description information is whether the sample description information contains attack instructions, and can also include the text of the attack instructions contained in the sample description information and the type of the attack instructions.

[0056] In order to balance the detection efficiency, the detection model can be a lightweight machine learning model, rather than a heavy large model such as an LLM. The detection model can include at least one of a Naive Bayes classifier, a Support Vector Machine (SVM) model, a random forest model, and a Gradient Boosting Decision Tree (GBDT) model.

[0057] When the detection model is a Naive Bayes classifier, an SVM model, or a GBDT model, a loss value of the detection model to be trained can be determined according to an attack detection result of sample description information by the detection model to be trained and a label of the sample description information. The greater the difference between the attack detection result of the sample description information by the detection model to be trained and the label of the sample description information, the greater the loss value. Conversely, the smaller the loss value. Then, the model parameters of the detection model to be trained are adjusted using a gradient descent method according to the loss value.

[0058] When the detection model is a random forest model, multiple decision trees can be constructed in parallel. Each tree can extract samples from the sample description information by random sampling with replacement. For each node of the decision tree, only part of the features in the extracted sample description information can be randomly selected to calculate an optimal split point until the node is pure or reaches a preset maximum depth of the decision tree.

[0059] The device for training the detection model can be a device where the MCP client is located, or can be another electronic device. The present specification does not limit this.

[0060] After the detection model trained by the above method is used to perform attack detection on the description information of each available tool obtained by the MCP client, for the description information of each available tool, when it is detected that the description information of the available tool has an attack behavior, the available tool is determined as a risk tool, and risk control processing is performed according to a preset risk control strategy. The risk control strategy described in the embodiments of the present specification includes at least one of recording a risk log according to the detected risk tool, generating alarm information according to the detected risk tool, and blocking a connection with an MCP server providing the risk tool.

[0061] Since the MCP client usually returns the description information of each available tool to the LLM after obtaining the description information of each available tool, the LLM determines a target tool required to execute the input instruction of the user in each available tool according to the semantics of the input instruction of the user and the description information of each available tool, and returns the tool identifier of the target tool to the MCP client, so that the MCP client calls the target tool to execute the input instruction of the user. Therefore, in the embodiment of the present specification, the MCP client can also determine the MCP server providing the target tool as a target server according to the tool identifier of the target tool returned by the LLM when the detection model detects that the description information of the target tool does not exist attack behavior, and call the target tool provided by the target server to execute the input instruction of the user through the target tool.

[0062] When it is detected that the description information of the target tool exists attack behavior, the target tool is directly refused to be called.

[0063] Of course, the MCP client can also temporarily intercept the operation of sending the description information of each available tool to the LLM through the aspect program called after obtaining the description information of each available tool, and detect attacks on the description information of all available tools through the detection model, and then according to the detection result, only send the description information of the available tool without attack behavior to the LLM, and refuse to send the description information of the available tool with attack behavior to the LLM, and use the preset risk control strategy for risk control processing.

[0064] The above is an attack detection method of an MCP client provided by the embodiment of the present specification. Based on the same idea, the present specification also provides a corresponding device, a storage medium and an electronic equipment.

[0065] Figure 3 The attack detection device of the MCP client provided by the embodiment of the present specification is a schematic diagram of the device applied to a model context protocol (MCP) client. An aspect program is deployed in the device in advance, and the aspect point of the aspect program is the code in the device for obtaining the description information of the available tool provided by the MCP server. The device comprises:

[0066] The interaction module 301 is configured to obtain the input instruction of the user and send the input instruction to the large language model (LLM);

[0067] The receiving module 302 is configured to receive the tool calling request returned by the LLM after the LLM performs semantic analysis on the input instruction;

[0068] The obtaining module 303 is configured to respond to the tool calling request, run the code, and obtain the description information of each available tool provided by each MCP server;

[0069] The calling module 304 is configured to call the pre-deployed aspect program in response to a trigger of running the code.

[0070] The detection module 305 is configured to perform attack detection on the obtained description information by using the aspect program.

[0071] Optionally, the description information is in a natural language form.

[0072] The detection module 305 is specifically configured to call a pre-trained detection model by using the aspect program, and perform attack detection on the obtained description information by using the detection model.

[0073] Optionally, the detection module 305 is specifically configured to input the description information of each available tool into the detection model, and detect whether the description information of the available tool contains attack instructions for attacking the LLM by using the detection model; if yes, it is determined that the description information of the available tool contains attack behavior; otherwise, it is determined that the description information of the available tool does not contain attack behavior.

[0074] Optionally, the apparatus further comprises:

[0075] The training module 306 is configured to obtain sample description information, the sample description information including positive samples and negative samples, the positive samples being description information of available tools not containing attack instructions, and the negative samples being description information of available tools containing attack instructions; input the sample description information into a detection model to be trained, and perform attack detection on the sample description information by using the detection model to be trained; and adjust model parameters of the detection model to be trained according to an attack detection result of the sample description information by using the detection model to be trained and a label of the sample description information.

[0076] Optionally, the detection model includes at least one of a Naive Bayes classifier, a support vector machine (SVM) model, a random forest model, and a gradient boosting decision tree (GBDT) model.

[0077] Optionally, the detection module 305 is further configured to: return the acquired description information of each available tool to the LLM, so that the LLM determines the target tool required to execute the input command from among the available tools based on the semantics of the input command and the description information of each available tool; receive the tool identifier for the target tool sent by the LLM; when it is detected that the description information of the target tool does not contain any attack behavior, determine the MCP server that provides the target tool as the target server based on the tool identifier, and call the target tool provided by the target server to execute the input command through the target tool; when it is detected that the description information of the target tool contains any attack behavior, refuse to call the target tool.

[0078] Optionally, the detection module 305 is further configured to, for each available tool's description information, when it detects that the description information of the available tool contains attack behavior, identify the available tool as a risk tool and perform risk control processing according to a preset risk control strategy; wherein, the risk control strategy includes at least one of: recording risk logs based on the detected risk tool, generating alarm information based on the detected risk tool, and blocking the connection with the MCP server that provides the risk tool.

[0079] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the attack detection method for the MCP client provided above.

[0080] based on Figure 2 The attack detection method for the MCP client shown in this specification also provides the following embodiments: Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile storage, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to implement the aforementioned attack detection method for the MCP client.

[0081] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An attack detection method of an MCP client, the method is applied to a model context protocol (MCP) client, a aspect program is pre-deployed in the MCP client, and a pointcut of the aspect program is a code in the MCP client for obtaining description information of available tools provided by an MCP server; the method comprises: obtaining an input instruction of a user and sending the input instruction to a large language model (LLM); receiving a tool calling request returned by the LLM after performing semantic analysis on the input instruction; in response to the tool calling request, running the code to obtain description information of each available tool provided by each MCP server; in response to triggering of running the code, calling the pre-deployed aspect program; performing attack detection on the obtained description information through the aspect program.

2. The method of claim 1, wherein the description information is description information in natural language form; and performing attack detection on the obtained description information through the aspect program specifically comprises: calling a pre-trained detection model through the aspect program; and performing attack detection on the obtained description information through the detection model.

3. The method of claim 2, wherein performing attack detection on the obtained description information through the detection model specifically comprises: for the description information of each available tool, inputting the description information of the available tool into the detection model to detect, through the detection model, whether the description information of the available tool contains an attack instruction for attacking the LLM; if yes, determining that the description information of the available tool contains attack behavior; and otherwise, determining that the description information of the available tool does not contain attack behavior.

4. The method of claim 3, wherein the detection model is pre-trained, and the pre-training specifically comprises: obtaining sample description information, wherein the sample description information includes positive samples and negative samples, the positive samples are description information of available tools that do not contain attack instructions, and the negative samples are description information of available tools that contain attack instructions; inputting the sample description information into a detection model to be trained to perform attack detection on the sample description information through the detection model to be trained; and adjusting model parameters of the detection model to be trained according to an attack detection result of the detection model to be trained on the sample description information and a label of the sample description information. at least one of a Naive Bayes classifier, a support vector machine (SVM) model, a random forest model, and a gradient boosting decision tree (GBDT) model.

5. The method of claim 2, the detection model comprising:

6. The method of claim 1, wherein after obtaining the description information of each available tool provided by each MCP server, the method further comprises: returning the obtained description information of each available tool to the LLM, so that the LLM determines a target tool required for executing the input instruction from each available tool according to semantics of the input instruction and the description information of each available tool; receiving a tool identifier of the target tool sent by the LLM; and after performing attack detection on the obtained description information, the method further comprises: ​ When it is detected that the description information of the target tool does not exist attack behavior, according to the tool identifier, a MCP server providing the target tool is determined as a target server, and the target tool provided by the target server is invoked, and the input instruction is executed through the target tool; When it is detected that the description information of the target tool exists attack behavior, the target tool is rejected.

7. The method of claim 1, further comprising: For the description information of each available tool, when it is detected that the description information of the available tool exists attack behavior, the available tool is determined as a risk tool, and a risk control strategy is performed according to a preset risk control strategy; The risk control strategy includes at least one of recording a risk log according to the detected risk tool, generating alarm information according to the detected risk tool, and blocking the connection with the MCP server providing the risk tool.

8. An attack detection apparatus of an MCP client, the apparatus being applied to a model context protocol (MCP) client, a join point of an aspect program being pre-deployed in the apparatus, the join point being a code in the apparatus for obtaining description information of available tools provided by an MCP server. The apparatus comprises: An interaction module configured to obtain an input instruction of a user and send the input instruction to a large language model (LLM); A receiving module configured to receive a tool invocation request returned by the LLM after performing semantic analysis on the input instruction; An obtaining module configured to run the code to obtain description information of each available tool provided by each MCP server in response to the tool invocation request; An invoking module configured to invoke the aspect program deployed in advance in response to triggering of the running of the code; A detecting module configured to perform attack detection on the obtained description information through the aspect program.

9. A computer readable storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the method of any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the method of any one of claims 1-7.

Images