Security detection method and device, electronic equipment and storage medium

Abstract

The invention provides a security detection method and device, electronic equipment and a storage medium. The security detection method comprises the following steps: receiving a security detection request, wherein the security detection request comprises detection object information; generating a first prompt text based on the security detection request; the first prompt text is input into a machine learning model, so that the machine learning model generates a first reply, and the first reply indicates a security detection result or an information acquisition strategy; in response to the first reply, indicating an information acquisition strategy, and repeatedly executing the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to execute an information acquisition operation, and inputting an information acquisition result into the machine learning model to enable the machine learning model to generate an updated first reply; the preset condition comprises the updated first reply indication safety detection result; and outputting a security detection result in response to the first reply indicating the security detection result.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to a security detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] Virus hijacking risk poses a significant threat to application security and user interests. For example, some viruses illegally hijack user accounts and perform malicious operations such as publishing fraudulent information, endangering user property and information security. Related solutions mostly use security detection methods based on preset rules to identify security risks by comparing the matching degree of operation behavior and preset rules. However, this solution has obvious defects: first, the rule maintenance cost is high, because of the dynamic evolution of virus attacks, manual long-term rule updates are required, which not only consumes a lot of manpower, but also has the problem of update lag; second, the detection robustness is insufficient, because the judgment logic depends on fixed rules, and it is difficult to accurately detect the virus behavior after slight variation. Therefore, how to efficiently and accurately detect security risks is a problem to be solved. SUMMARY

[0003] This summary is provided to introduce a selection of concepts that are further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0004] In a first aspect, according to one or more embodiments of the present disclosure, a security detection method is provided, comprising:

[0005] receiving a security detection request, the security detection request containing detection object information;

[0006] generating a first prompt text based on the security detection request;

[0007] inputting the first prompt text into a machine learning model, so that the machine learning model generates a first reply, the first reply indicating a security detection result or an information acquisition strategy;

[0008] in response to the first reply indicating an information acquisition strategy, repeatedly performing the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting an information acquisition result into the machine learning model to make the machine learning model generate an updated first reply; the preset condition includes that the updated first reply indicates a security detection result;

[0009] in response to the first reply indicating a security detection result, outputting the security detection result. In a second aspect, according to one or more embodiments of the present disclosure, a security detection device is provided, comprising:

[0010] request receiving unit configured to receive a security detection request, the security detection request comprising detection object information;

[0011] prompt generating unit configured to generate a first prompt text based on the security detection request;

[0012] reply generating unit configured to input the first prompt text into a machine learning model, so that the machine learning model generates a first reply, the first reply indicating a security detection result or an information acquisition strategy;

[0013] information acquiring unit configured to, in response to the first reply indicating an information acquisition strategy, repeatedly perform the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting an information acquisition result into the machine learning model to obtain an updated first reply; the preset condition comprises that the updated first reply indicates a security detection result;

[0014] result output unit configured to, in response to the first reply indicating a security detection result, output the security detection result.

[0015] In a third aspect, an electronic device is provided according to one or more embodiments of the present disclosure, and includes at least one memory and at least one processor; the memory is configured to store program code, and the processor is configured to invoke the program code stored in the memory to cause the electronic device to perform the method provided according to one or more embodiments of the present disclosure.

[0016] In a fourth aspect, a non-transitory computer storage medium is provided according to one or more embodiments of the present disclosure, and the non-transitory computer storage medium stores program code, which, when executed by a computer device, causes the computer device to perform the method provided according to one or more embodiments of the present disclosure.

[0017] According to one or more embodiments of the present disclosure, for a security detection request, an information acquisition strategy is first generated by a machine learning model and corresponding information is acquired, and then a security detection result is generated by the machine learning model based on the information acquisition result, which can improve the accuracy of security detection. Compared with the security risk judgment method based on preset rules, the present scheme has the following advantages: (1) does not depend on fixed rules, historical data and manual intervention; (2) can automatically discover new security risk events and resist abnormal behavior variants, and has strong robustness; (3) has low modification cost, and if a new information acquisition type is needed, only the information acquisition method needs to be adjusted or the knowledge base needs to be imported, and the prompt text needs to be modified, without adjusting the preset rules and their codes; (4) has wide application scope, and can be reused in other security detection scenarios by extending the model knowledge base and the prompt text. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above-described and other features, advantages, and aspects of the present disclosure will become more apparent as various embodiments of the present disclosure are described in greater detail. It will be appreciated that the present disclosure can be embodied in various forms, not just the embodiments described in the specification. Therefore specific embodiments disclosed should not be construed as limiting the present disclosure, but as providing an insight into the present disclosure.

[0019] Figure 1 A flowchart of a security detection method according to an embodiment of the present disclosure is shown in FIG. 1.

[0020] Figure 2 A flowchart of a security detection method according to another embodiment of the present disclosure is shown in FIG. 2.

[0021] Figure 3 A structure diagram of a security detection device according to an embodiment of the present disclosure is shown in FIG. 3.

[0022] Figure 4 A structure diagram of an electronic device according to an embodiment of the present disclosure is shown in FIG. 4. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings. While several embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be construed as being limited to the embodiments set forth herein, but rather should be construed to encompass all alternatives and modifications falling within the scope of the present disclosure. It is to be understood that the drawings are designed for the purpose of illustration only and are not intended to limit the scope of the present disclosure.

[0024] It is to be understood that the steps recited in the embodiments of the present disclosure can be performed in different orders and / or in parallel. In addition, the embodiments can include additional steps and / or omit performing the steps shown. The scope of the present disclosure is not limited in this regard.

[0025] As used herein, the term "includes" and its variants are meant to be open-ended and mean "comprises" or "comprises but is not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment." The term "another embodiment" means "at least one additional embodiment." The term "some embodiments" means "at least some embodiments." The term "responsive to" and related terms, mean that a signal or event is influenced at least in part by another signal or event but not necessarily directly or immediately responsive to it. If event x is "responsive to" event y, x can be directly or indirectly responsive to y. For example, y can cause some chain of events leading to x, but there can be intervening events that x is ultimately responsive to. In other cases, y can not cause x, and x can occur even if y never occurs. In addition, the term "responsive to" can also mean "at least partially responsive to."

[0026] The term "determining" encompasses a wide variety of actions and, therefore, "determining" can include calculating, computing, processing, deriving, investigating, looking up (such as looking up in a table, a database or another data structure), ascertaining and the like. Additionally, "determining" can include receiving (such as receiving information), accessing (such as accessing data in a memory) and the like. Also, "determining" can include resolving, selecting, choosing, establishing and the like.

[0027] It should be noted that the terms "first", "second", and the like, used in the description and in the claims of the present disclosure are used only to distinguish different objects, devices, modules or units, and are not meant to limit the sequence or the interdependency of the functions of these objects, devices, modules or units.

[0028] It should be noted that the terms "one", "multiple", and the like, used in the description and in the claims of the present disclosure are illustrative and not limiting, and it should be understood by those skilled in the art that, unless otherwise explicitly stated in the context, "one" or "multiple" should be understood as "one or more".

[0029] For the purpose of the present disclosure, the phrase "A and / or B" means (A), (B), or (A and B).

[0030] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present disclosure are used only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0031] The inventors have found that for security risk behaviors in software applications, such as virus hijacking risks, the security risk identification method based on preset rules has many defects: (1) highly dependent on expert rules and historical data, requiring manual analysis of events and configuration of rules; (2) unable to automatically discover new security risk events; (3) event collection relies on user voluntary reporting, and the collection and disposal process does not form a closed loop; (4) hard rules are easy to crack and cannot detect abnormal behavior variants; (5) high modification cost, increasing or modifying existing rules requires code modification; (6) since the rules are customized for specific security risk behaviors, other security risk behaviors cannot reuse the rules.

[0032] Reference Figure 1 To solve at least one of the above problems, an embodiment of the present disclosure provides a security detection method based on a large model, comprising steps S1-S5:

[0033] Step S1, receiving a security detection request, wherein the security detection request contains detection object information.

[0034] In some embodiments, the security detection request can be triggered in response to a user's instruction. For example, the user can issue an instruction through a control interface provided by the client to actively trigger the security detection request. In some specific embodiments, a user instruction input module can be provided, which is configured to receive multi-modal input content, format convert different forms of input, and generate a unified structure of the security detection request to facilitate subsequent processing units for semantic analysis and response generation. In some specific embodiments, a multi-modal input interaction component can be provided, which includes a text editing box, a picture upload control, and a voice collection control; wherein the text editing box is used to receive user input text instructions, the picture upload control supports image file import and preview, and the voice collection control can collect and convert voice signals into text format in real time.

[0035] In some embodiments, the security detection request can be automatically triggered based on a preset period. The preset period can be pre-set by a configuration module of the software application, for example, set to initiate a security detection request every 1 hour, every 12 hours, or every 24 hours. When the security detection request is triggered based on the preset period, the security detection request can contain detection object information generated in the recent preset period. The recent preset period may, for example, be the last 1 hour, the last 12 hours, or the last 24 hours, which can or can not correspond to the preset period, and the present disclosure does not limit this.

[0036] In some embodiments, the detection object information can include one or more of an event type identifier, an event identifier, and an operation subject identifier. The event type identifier refers to a certain type of event, the event identifier refers to a specific event, and the operation subject identifier refers to the subject performing the operation behavior. The event refers to a certain state change or behavior of the system or program during the running process, which can be triggered by user interaction (such as clicking a button) or automatically by the system.

[0037] Step S2, generating a first prompt text based on the security detection request.

[0038] The first prompt text is a prompt text generated based on the security detection request. The prompt text is an instruction, question or task description for inputting to the artificial intelligence model. In some embodiments, the prompt text can be generated by the prompt engineering (PE) technology. The prompt engineering refers to a technical method of designing and optimizing the prompt text input to the model to guide the model to output more accurate and efficient results that meet the requirements. In some specific embodiments, a standardized prompt text template can be pre-set to reduce the operation complexity of manual input by the user and guide the model to carry out the reasoning process according to the pre-set task direction or reasoning path. For example, the first prompt text can be “check XX, judge whether there is a virus hijacking risk, event_id = ABC”.

[0039] Step S3, inputting the first prompt text into the machine learning model to make the machine learning model generate a first reply indicating a security detection result or an information acquisition strategy.

[0040] In some embodiments, the machine learning model is a large language model (LLM). The large language model learns the statistical rules and semantic representations inherent in the text, uses the self-attention mechanism to realize the dynamic coding of the context-aware word vector, and uses the multi-layer stacked decoder and encoder module to build the deep semantic understanding ability. Through pre-training on a large-scale data set, the large language model has strong general modeling ability and generalization ability, and can process various natural language processing tasks, including but not limited to text generation, question and answer system, logical reasoning, semantic parsing, etc.

[0041] In some embodiments, the information acquisition strategy can include information to be acquired and its acquisition method. For example, the content of the first reply can include “according to the event_id provided by the user, call the batch_query_XX function to query the related XX”, but the present disclosure is not limited thereto.

[0042] Step S4, in response to the first reply indicating information acquisition strategy, repeatedly performing the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting the information acquisition result into the machine learning model to make the machine learning model generate an updated first reply; the preset condition includes that the updated first reply indicates a security detection result.

[0043] It can be understood that when step S4 is first performed, the information acquisition strategy relied on by the information acquisition operation comes from the first reply generated in step S3; when step S4 is performed for the i-th time (i>1), the information acquisition strategy relied on by the information acquisition operation comes from the updated first reply obtained based on the information acquisition result in the (i-1)-th execution of step S4.

[0044] By repeatedly performing step S4, when the currently acquired information is insufficient for the machine learning model to give a security detection result, the machine learning model can give further information acquisition strategy to acquire other supplementary information, and so on until the machine learning model can generate a first reply indicating a security detection result based on the acquired information.

[0045] It can be understood that the "repeatedly performing" of the present disclosure can include the case of performing one or more rounds of step S4. For example, in some cases, the model can only need one round of information to obtain a security detection result, so that when the first round of step S4 is performed, the updated first reply generated can indicate a security detection result, and then step S5 can be performed without performing step S4 again.

[0046] In some embodiments, in addition to the first prompt text or the second prompt text mentioned below, the input of the machine learning model can also include context information and system prompt text. The context information includes one or more rounds of historical interaction records related to the current task. The system prompt text is a pre-set instruction text for defining the role, rules or behavior boundary of the model.

[0047] In some embodiments, the system prompt text can include role task information, task decomposition logic, information collection logic, or tool calling specification. The role task information is used to assign a role identity and / or a task to the machine learning model, for example, the role task information can tell the machine learning model that it is an assistant for detecting security risks, and the task is to perform security detection based on relevant evidence. The task decomposition logic is used to guide the model to decompose the main task into multiple executable subtasks, for example, based on the type of security detection involved in the first prompt text, the main task can be decomposed into hierarchical subtasks by referring to the judgment framework of the security detection in the knowledge base. The information collection logic is used to define the priority of information collection. The tool calling specification is used to tell the model which tools can be called to acquire relevant information and their usage rules.

[0048] In some embodiments, the calling the tool associated with the information acquisition strategy to perform the information acquisition operation comprises: generating a tool calling request based on the first reply, and calling a corresponding tool to acquire the information acquisition result based on the tool calling request. The tool calling request comprises a tool calling name and a calling parameter. In some embodiments, the calling parameter can comprise one or more of an event type identifier, an event identifier, and an operation subject identifier.

[0049] For example, in the tool calling request A, the tool calling name is batch_query_XXXX, and the calling parameter is {"event_id": ABC}. For another example, in the tool calling request B, the calling parameter is {"operator_id": 123, "event_name_id": 20}. The "event_id" represents an event identifier, the "operator_id" represents an operation subject identifier, and the "event_name_id" represents an event type identifier. It can be understood that in the present example, the tool calling request A aims to investigate a specific event (the event ID of the event is ABC), and the tool calling request B aims to investigate a certain type of event (the event type ID is 20) implemented by the operation subject 123.

[0050] In one specific embodiment, a corresponding MCP (Model Context Protocol) service can be called based on the tool calling request to acquire corresponding evidence. MCP is an open protocol designed for models to provide external services and information. Developers can develop specialized MCP services to provide specific tools and resources according to the standard, and platforms integrated with models can discover and call these services through the MCP protocol, thereby safely and standardizedly extending the capabilities of the models to enable them to utilize external services and information.

[0051] It can be understood that the data (including but not limited to the data itself, the acquisition or use of the data) involved in the technical solution of the present technical solution should comply with the relevant legal regulations. Before using the technical solution disclosed in each embodiment of the present disclosure, the type of personal information involved in the present disclosure, the use range, the use scenario, etc. should be informed to the user and the authorization of the user should be obtained through appropriate means. For example, when responding to the active request of the user, a prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will need to obtain and use the personal information of the user, so that the user can voluntarily choose whether to provide the personal information to the electronic device, application program, server or storage medium, etc. software or hardware that performs the operation of the technical solution of the present disclosure according to the prompt information.

[0052] As an optional but non-limiting implementation manner, in response to receiving the active request of the user, the prompt information can be sent to the user in the manner of a pop-up window, in which the prompt information can be presented in the form of text. In addition, the pop-up window can also carry a selection control for the user to select "agree" or "disagree" to provide the personal information to the electronic device.

[0053] It can be understood that the above notification and user authorization obtaining process is only illustrative and does not limit the implementation manners of the present disclosure, and other manners meeting the relevant laws and regulations can also be applied to the implementation manners of the present disclosure.

[0054] In step S5, the security detection result is output in response to the first reply indicating the security detection result.

[0055] In some embodiments, the first reply for indicating the security detection result can include a security detection conclusion and its reason. In one or more embodiments of the present disclosure, by repeatedly performing step S4, one or more rounds of information can be provided to the machine learning model as evidence to help it make a security risk judgment, and after the machine learning model obtains sufficient evidence, it can make an inference combining the information in the knowledge base (such as known security risk cases) and give a security detection conclusion.

[0056] In some embodiments, the security detection result can be sent to the relevant user (such as a management user) in a manner such as system message pushing, in-site notification, pop-up window prompting, etc., so that the user can know the security risk situation in time and carry out subsequent disposal work.

[0057] According to one or more embodiments of the present disclosure, for a security detection request, the information acquisition strategy is generated by a model and the corresponding information is acquired, and then the security detection result is generated by the model based on the information acquisition result, which can improve the accuracy of security detection. Compared with the security risk judgment method based on preset rules, the present scheme has the following advantages: (1) does not depend on fixed rules, historical data and manual intervention; (2) can automatically discover new security risk events and resist abnormal behavior variants, and has strong robustness; (3) low modification cost, if a new information acquisition type needs to be added, only the information acquisition method needs to be adjusted or the knowledge base needs to be imported, the prompt text needs to be modified, and the preset rules and their codes do not need to be adjusted; (4) wide application range, which can be reused in other security detection scenarios by extending the model knowledge base and prompt text.

[0058] In some embodiments, the information includes a conclusion of a special model. The special model is a model for detecting a specific type of security risk. In a specific implementation manner, if the machine learning model judges that a detection object is suspected of a known type of security risk, the conclusion of the corresponding special model can be called as evidence to assist the machine learning model in making a security risk judgment.

[0059] In some embodiments, two or more prompt text templates can be pre-set, each corresponding to at least one type of information acquisition result; and the inputting of the information acquisition result into the machine learning model to enable the machine learning model to generate an updated first reply comprises: generating a second prompt text based on the information acquisition result and its corresponding prompt text template; and inputting the second prompt text into the machine learning model to enable the machine learning model to generate an updated first reply. In this way, by specially setting the prompt text template corresponding to the information type, the machine learning model can be guided to understand and process different types of information in a suitable manner, thereby helping the model to better extract key information from different types of evidence, and further to more accurately make a security risk judgment. In a specific embodiment, different types of services (such as MCP services) can also be pre-set for different types of information acquisition results to call the corresponding evidence. By establishing a mapping relationship between the information type, the service type and the prompt text template, when different types of services are called to acquire the corresponding information, the prompt text template corresponding to the evidence type can be matched based on the currently called service type.

[0060] In some embodiments, the first reply indicating the security detection result can further include a security detection result output strategy, which is used to indicate the query manner of the receiver of the security detection result and the output manner of the security detection result. For example, the security detection result output strategy contains the following content: "call the query_tenant_admin function to query the administrator user, and then send an alarm to the administrator user through the send_alarm function", and then according to the guidance, the ID of the administrator user is queried and the security detection result is sent to the administrator user.

[0061] Reference Figure 2The method for security detection provided by another implementation of the present disclosure is shown in FIG. 1. First, a security detection request is received, and a first prompt text is generated from the security detection request via a prompt text engineering. The first prompt text is input into a machine learning model to obtain a first reply. If the first reply indicates a security detection result, the security detection result is output. If the first reply indicates an information acquisition strategy, an information acquisition operation is performed by invoking a tool associated with the information acquisition strategy to obtain an information acquisition result. The information acquisition result is converted into a second prompt text via a corresponding prompt text engineering, and the second prompt text is input into the machine learning model. If the machine learning model determines that the current information is sufficient, a first reply indicating a security detection result is output. Otherwise, the machine learning model outputs an updated first reply indicating a further information acquisition strategy based on the second prompt text, and the steps of acquiring information, generating a second prompt text, and inputting the model to generate an updated first reply are continuously performed until the machine learning model generates an updated first reply indicating a security detection result. Then, the security detection result is output to a relevant user based on the first reply. Next, in response to confirmation of the security detection result by a recipient (such as an administrator user), training data for training a special model is generated based on security risk data generated in the security detection process. The special model is a model for specifically detecting a specific security risk type. After the recipient (such as an administrator user) confirms the security detection result, the associated security risk data can be supplemented to the training data set of the special model, so that the special model can learn new security risk features and improve the identification ability of similar or similar security risk events. As described above, the conclusion of the special model can be used as one of the evidences to assist the general machine learning model in security risk judgment. In this way, the whole process automatically forms a closed loop, which not only does not need human intervention, but also improves the security detection accuracy.

[0062] In some embodiments, the security risk data includes at least one of the following: the security detection request, the first prompt text, the information acquisition result, the second prompt text, and the first reply.

[0063] Correspondingly, with reference to Figure 3 According to an embodiment of the present disclosure, a security detection device 400 is provided, which includes:

[0064] A request receiving unit 401 is configured to receive a security detection request, and the security detection request contains detection object information.

[0065] A prompt generating unit 402 is configured to generate a first prompt text based on the security detection request.

[0066] A reply generating unit 403 is configured to input the first prompt text into a machine learning model, so that the machine learning model generates a first reply, and the first reply indicates a security detection result or an information acquisition strategy.

[0067] The information acquisition unit 404 is configured to, in response to the first reply indicating the information acquisition strategy, repeatedly perform the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting an information acquisition result into the machine learning model to obtain an updated first reply; the preset condition includes the updated first reply indicating a security detection result.

[0068] The result output unit 405 is configured to, in response to the first reply indicating the security detection result, output the security detection result.

[0069] In some embodiments, the information acquisition strategy is used to indicate the information to be acquired and the way to acquire the information.

[0070] In some embodiments, the security detection request is triggered in response to a user instruction or based on a preset period.

[0071] In some embodiments, the detection object information includes at least one of the following: an event type identifier, an event identifier, and an operation subject identifier.

[0072] In some embodiments, the calling the tool associated with the information acquisition strategy to perform the information acquisition operation includes: generating a tool calling request based on the information acquisition strategy, wherein the tool calling request includes a tool calling name and a calling parameter; and calling a corresponding tool based on the tool calling request to obtain the information acquisition result.

[0073] In some embodiments, the information acquisition result includes a conclusion of a special model.

[0074] In some embodiments, the security detection device further includes:

[0075] The template preset unit is configured to preset two or more prompt text templates, each prompt text template corresponding to at least one type of information acquisition result.

[0076] The inputting the information acquisition result into the machine learning model to enable the machine learning model to generate an updated first reply includes: generating a second prompt text based on the information acquisition result and the prompt text template corresponding thereto; and inputting the second prompt text into the machine learning model to enable the machine learning model to generate an updated first reply.

[0077] In some embodiments, the first reply indicating the security detection result includes a security detection result output strategy, and the security detection result output strategy is used to indicate a query method of a recipient of the security detection result and an output method of the security detection result.

[0078] In some embodiments, the security detection apparatus further comprises:

[0079] a training data generation unit configured to generate training data for training the special model based on the security risk data generated in the current security detection process in response to the confirmation of the security detection result by the receiver of the security detection result.

[0080] For the embodiments of the apparatus, since they basically correspond to the embodiments of the method, the relevant parts are described in the part of the description of the embodiments of the method. The apparatus embodiments described above are merely illustrative, and the modules described as separate modules can or can not be separate. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments. Those skilled in the art can understand and implement without creative labor.

[0081] Accordingly, according to one or more embodiments of the present disclosure, an electronic device is provided, comprising:

[0082] at least one memory and at least one processor;

[0083] The memory is configured to store program code, and the processor is configured to invoke the program code stored in the memory to cause the electronic device to perform the security detection method according to one or more embodiments of the present disclosure.

[0084] Accordingly, according to one or more embodiments of the present disclosure, a non-transitory computer storage medium is provided, which stores program code executable by a computer device to cause the computer device to perform the security detection method according to one or more embodiments of the present disclosure.

[0085] Reference is made below to Figure 4 which shows a structural schematic diagram of an electronic device (such as a terminal device or a server) 800 suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure can include but is not limited to terminal devices such as extended reality devices (such as head-mounted displays), mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablets), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), digital TVs, desktop computers, etc. It should be noted that, Figure 4 The electronic device shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0086] As Figure 4As shown, the electronic device 800 can include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 802 or loaded into a random access memory (RAM) 803 from a storage device 808. Various programs and data required for the operation of the electronic device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0087] Generally, the following devices can be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication devices 809 can allow the electronic device 800 to communicate wirelessly or wired with other devices to exchange data. Although Figure 4 The electronic device 800 is shown with various devices, but it should be understood that all of the illustrated devices are not required to implement or practice the present disclosure. More or less devices can be implemented or otherwise utilized.

[0088] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication devices 809, or installed from the storage devices 808, or installed from the ROM 802. When the computer program is executed by the processing device 801, the above-described functions defined in the methods of the embodiments of the present disclosure are performed.

[0089] It should be noted that the computer-readable medium described above can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the foregoing. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device. In the disclosure, the computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, in which the computer-readable program code is contained. Such a propagated data signal can take any of a variety of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the foregoing. The computer-readable signal medium can also be any computer-readable medium that is not a storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including, but not limited to, wire, cable, RF (radio frequency), or the like, or any suitable combination of the foregoing.

[0090] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0091] The computer-readable medium described above can be included in the electronic device described above; or can exist separately from the electronic device described above.

[0092] The computer-readable medium described above carries one or more programs that, when executed by the electronic device described above, cause the electronic device to perform the method of the disclosure described above.

[0093] Computer program code for carrying out operations of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0094] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0095] The units described in the embodiments of the present disclosure can be implemented by hardware, software, or a combination of hardware and software. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0096] The functions described in this specification can be implemented in part or in whole through one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0097] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more of: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0098] According to one or more embodiments of the present disclosure, a security detection method is provided, including: receiving a security detection request, the security detection request containing detection object information; generating a first prompt text based on the security detection request; inputting the first prompt text into a machine learning model to make the machine learning model generate a first reply, the first reply indicating a security detection result or an information acquisition strategy; in response to the first reply indicating an information acquisition strategy, repeatedly performing the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting an information acquisition result into the machine learning model to make the machine learning model generate an updated first reply; the preset condition includes that the updated first reply indicates a security detection result; and in response to the first reply indicating a security detection result, outputting the security detection result.

[0099] According to one or more embodiments of the present disclosure, the information acquisition strategy is used to indicate information to be acquired and a manner of acquiring the information.

[0100] According to one or more embodiments of the present disclosure, the security detection request is triggered in response to an instruction of a user or triggered based on a preset period.

[0101] According to one or more embodiments of the present disclosure, the detection object information includes at least one of the following: an event type identifier, an event identifier, and an operation subject identifier.

[0102] According to one or more embodiments of the present disclosure, the calling of the tool associated with the information acquisition strategy to perform the information acquisition operation includes: generating a tool calling request based on the information acquisition strategy, wherein the tool calling request includes a tool calling name and a calling parameter; and calling a corresponding tool based on the tool calling request to obtain the information acquisition result.

[0103] According to one or more embodiments of the present disclosure, the information acquisition result includes a conclusion of the special model.

[0104] According to one or more embodiments of the present disclosure, the security detection method further includes: setting two or more prompt text templates in advance, each prompt text template corresponding to at least one type of information acquisition result; and inputting the information acquisition result into the machine learning model to enable the machine learning model to generate an updated first reply, including: generating a second prompt text based on the information acquisition result and its corresponding prompt text template; and inputting the second prompt text into the machine learning model to enable the machine learning model to generate an updated first reply.

[0105] According to one or more embodiments of the present disclosure, the first reply indicating the security detection result includes a security detection result output strategy, which is used to indicate a query manner of a recipient of the security detection result and an output manner of the security detection result.

[0106] According to one or more embodiments of the present disclosure, the security detection method further includes: in response to confirmation of the security detection result by the recipient of the security detection result, generating training data for training the special model based on security risk data generated in the current security detection process.

[0107] According to one or more embodiments of the present disclosure, the special model is a model for specifically detecting a specific security risk type.

[0108] According to one or more embodiments of the present disclosure, a security detection apparatus is provided, including: a request receiving unit configured to receive a security detection request, the security detection request containing detection object information; a prompt generating unit configured to generate a first prompt text based on the security detection request; a reply generating unit configured to input the first prompt text into a machine learning model to enable the machine learning model to generate a first reply, the first reply indicating a security detection result or an information acquisition strategy; an information acquisition unit configured to, in response to the first reply indicating an information acquisition strategy, repeatedly perform the following steps until a preset condition is met: calling a tool associated with the information acquisition strategy to perform an information acquisition operation, and inputting an information acquisition result into the machine learning model to obtain an updated first reply; and the preset condition including the updated first reply indicating a risk result; and a result output unit configured to, in response to the first reply indicating a security detection result, output the security detection result.

[0109] According to one or more embodiments of the present disclosure, an electronic device is provided, comprising: at least one memory and at least one processor; wherein the memory is configured to store program code, and the processor is configured to invoke the program code stored in the memory to cause the electronic device to perform the method according to one or more embodiments of the present disclosure.

[0110] According to one or more embodiments of the present disclosure, a non-transitory computer storage medium is provided, which stores program code, and the program code is executed by a computer device to cause the computer device to perform the method according to one or more embodiments of the present disclosure.

[0111] The above description is merely preferred embodiments of the present disclosure and a description of principles of applied technologies. It should be understood by those skilled in the art that the disclosed scope of the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and also covers other technical solutions formed by the combinations of the above technical features or equivalent features without departing from the above disclosed concept. For example, the technical solutions formed by the mutual replacement of the above features and the technical features disclosed in the present disclosure (but not limited to) having similar functions.

[0112] In addition, although each operation is depicted in a particular order, this should not be understood as requiring the operations to be performed in the particular order shown or in sequential order. In certain circumstances, multitasking and parallel processing can be advantageous. Likewise, although specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be combined in a single embodiment. Conversely, various features described in the context of a single embodiment can also be separated and implemented in multiple embodiments.

[0113] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A security detection method, characterized in that, include: Receive a security detection request, the security detection request containing information about the detection object; A first prompt text is generated based on the security detection request; The first prompt text is input into a machine learning model to generate a first response, which indicates a security detection result or an information acquisition strategy. In response to the first response indicating an information acquisition strategy, the following steps are repeated until a preset condition is met: invoke a tool associated with the information acquisition strategy to perform an information acquisition operation, and input the information acquisition result into the machine learning model so that the machine learning model generates an updated first response; the preset condition includes the updated first response indicating a security detection result. In response to the first reply indicating the security detection result, the security detection result is output.

2. The method according to claim 1, characterized in that, The information acquisition strategy is used to indicate the information that needs to be acquired and the method of acquisition.

3. The method according to claim 1, characterized in that, The security detection request is triggered by a user's command or based on a preset period.

4. The method according to claim 1, characterized in that, The detection object information includes at least one of the following: event type identifier, event identifier, and operation subject identifier.

5. The method according to claim 1, characterized in that, The step of invoking the tool associated with the information acquisition strategy to perform the information acquisition operation includes: A tool invocation request is generated based on the information acquisition strategy, wherein the tool invocation request includes a tool invocation name and invocation parameters; The tool call request is used to invoke the corresponding tool to obtain the information acquisition result.

6. The method according to claim 1, characterized in that, The information acquisition results include the conclusions of the specialized model.

7. The method according to claim 1, characterized in that, Also includes: Two or more prompt text templates are pre-set, and each prompt text template corresponds to at least one type of information retrieval result; The step of inputting the information acquisition result into the machine learning model to enable the machine learning model to generate an updated first response includes: generating a second prompt text based on the information acquisition result and its corresponding prompt text template; The second prompt text is input into the machine learning model so that the machine learning model generates an updated first response.

8. The method according to claim 1, characterized in that, The first response indicating the security detection result includes a security detection result output strategy, which is used to indicate the query method of the recipient of the security detection result and the output method of the security detection result.

9. The method according to claim 1, characterized in that, The method further includes: In response to the recipient's confirmation of the security detection result, training data for training the specialized model is generated based on the security risk data generated during this security detection process.

10. The method according to claim 6 or 9, characterized in that, The specialized model is a model specifically designed to detect certain types of security risks.

11. A safety detection device, characterized in that, include: A request receiving unit is configured to receive a security detection request, wherein the security detection request includes detection object information; A prompt generation unit is used to generate a first prompt text based on the security detection request; The response generation unit is used to input the first prompt text into a machine learning model so that the machine learning model generates a first response, wherein the first response indicates a security detection result or an information acquisition strategy. An information acquisition unit is configured to, in response to the first reply indicating an information acquisition strategy, repeatedly execute the following steps until a preset condition is met: invoke a tool associated with the information acquisition strategy to perform an information acquisition operation, and input the information acquisition result into the machine learning model to obtain an updated first reply; the preset condition includes the updated first reply indicating a security detection result. The result output unit is used to output the security detection result in response to the first reply indicating the security detection result.

12. An electronic device, characterized in that, include: At least one memory and at least one processor; The memory is used to store program code, and the processor is used to call the program code stored in the memory to cause the electronic device to perform the method of any one of claims 1 to 10.

13. A non-transitory computer storage medium, characterized in that, The non-transitory computer storage medium stores program code, which, when executed by a computer device, causes the computer device to perform the method according to any one of claims 1 to 10.

Images