A large model-based active defense method and system

Abstract

This application discloses a proactive defense method and system based on a large model, relating to the field of security protection technology. The method includes: intercepting malicious requests from external attackers and cleaning sensitive information and adversarial samples from the malicious requests to output standardized data; injecting the standardized data as training data into training adversarial samples to optimize the protection model and ensuring the traceability of the protection model by embedding digital watermarks; deploying honeypot interfaces to lure attackers and trigger countermeasures; generating dynamic defense rules using the protection model; and updating the training adversarial samples in real time for continuous optimization of the protection model. By intercepting and cleaning malicious requests and using honeypot luring and countermeasures, proactive attack detection and early blocking are achieved. Combined with dynamic defense rule generation and continuous optimization of the protection model to adapt to attack iterations, along with a digital watermark traceability mechanism, a closed-loop full-link of "interception-protection-optimization" is constructed, improving the security defense capability of the protection model.

Description

Technical Field

[0001] This application relates to the field of security protection technology, specifically to an active defense method and system based on a large model. Background Technology

[0002] With the widespread application of large-scale artificial intelligence models in various fields, they have become the core infrastructure supporting the digital transformation of industries. However, with the expansion of the depth and breadth of applications, the security threats faced by large-scale models are becoming increasingly severe. Various targeted attack methods are emerging one after another, which may not only cause the model to output incorrect results and leak sensitive information, but also threaten the normal operation of key scenarios such as financial transaction security and medical diagnosis reliability.

[0003] To address these security challenges, the industry has conducted research on relevant defense technologies and proposed some solutions. Regarding model parameter protection, Chinese patent CN120654254A proposes a deep learning-based large model parameter protection scheme. This scheme uses gradient signature perturbation, inference behavior monitoring, and dynamic perturbation injection to resist malicious inference attacks and protect model parameter security. Chinese patent CN120597308A proposes an adaptive enhanced information security protection system for large AI models. This system achieves closed-loop protection through vulnerability perception covering the entire model lifecycle and a reinforcement learning-driven dynamic defense strategy. In data poisoning defense research, some scholars have compared the detection performance of traditional machine learning models and quantized large models, finding that traditional models such as random forests and XGBoost perform better in detecting tag-flipping poisoning in wearable AI systems, while the detection accuracy of existing quantized large models is still less than 70%. Other research has proposed a gradient-guided backdoor-triggered learning algorithm, revealing the data poisoning risk during the fine-tuning stage of large models, and attempting to build defense strategies through contextual learning and continuous learning.

[0004] While existing technologies have achieved some protection in specific security scenarios, they still have significant shortcomings and are insufficient to address the complex and ever-changing security threats posed by large-scale models. Most existing defense solutions adopt a passive approach; for example, many technologies in the aforementioned patents and papers still rely on pre-set rule bases, signature detection, or post-incident perturbation correction. They lack effective detection capabilities against novel attacks such as prompt word injection and adversarial examples, causing defenses to lag behind the iteration of attack methods. This results in attackers achieving extremely low costs and high returns, further exacerbating the security risks of large-scale model applications. Therefore, how to achieve proactive defense methods that can actively detect, accurately predict, and preemptively block various types of large-scale model attacks has become a critical technical problem that urgently needs to be solved in the field of large-scale model security. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems, this application proposes the following technical solution:

[0006] In a first aspect, embodiments of this application provide a proactive defense method based on a large model, comprising:

[0007] Intercept malicious requests from external attackers and clean up sensitive information and adversarial samples from the malicious requests to output standardized data.

[0008] The standardized data is used as training data and injected into the training adversarial samples to optimize the protection model. The traceability of the protection model is ensured by embedding digital watermarks.

[0009] By deploying honeypot interfaces to lure attackers and trigger countermeasures, the protection model generates dynamic defense rules and updates the training adversarial samples in real time for continuous optimization of the protection model.

[0010] In one possible implementation, intercepting malicious requests from external attackers and cleaning sensitive information and adversarial sample output standardized data from the malicious requests includes:

[0011] Receiving malicious requests from external attackers via HTTP or WebSocket;

[0012] The request header and request body of the malicious request are verified for protocol compliance, and the abnormal protocol characteristics of the malicious request are marked to obtain the original request data carrying the preliminary mark.

[0013] Sensitive fields are identified in the original request data using sensitive detection technology, and then a dynamic blurring strategy is used to desensitize the data to obtain the first data after desensitizing the sensitive information.

[0014] Simultaneously with data desensitization, the original request data is detected to see if there is an adversarial sample payload. The detection results are combined to perform adversarial filtering to obtain the second data after adversarial sample filtering.

[0015] The first data and the second data are aggregated into fused data for use in training the protection model.

[0016] In one possible implementation, the step of identifying sensitive fields in the original request data using sensitivity detection technology, and then using a dynamic obfuscation strategy to desensitize the data and obtain the first data after desensitizing the sensitive information, includes:

[0017] Based on the rule engine, the fields and text of the original request data are structured and matched to filter out sensitive fields with high confidence, and the rule matching score is output:

[0018]

[0019] in: For rule matching scores, a successful match for a single rule is scored as 1, and a failure as 0. The weight of a single rule matching is assigned based on the accuracy of the rule, with regular expression rules having higher weights and keyword rules having lower weights.

[0020] For fields and texts not matched by the rule engine, NLP semantic recognition is used to mine unstructured privacy semantics and output semantically sensitive scores:

[0021]

[0022] in: For semantic sensitivity scores, the sensitivity probability output by the BERT model is the model's classification probability of text privacy semantics, which is obtained by fine-tuning BERT using an labeled dataset; the semantic scenario weights are defined according to the business scenario.

[0023] By combining contextual correlation with business metadata supplementary judgment, the fields and texts that were not matched in the first two steps are subjected to contextual supplementary judgment, and the context sensitivity score is output. Finally, the scores from the three steps are combined to determine whether a field is sensitive.

[0024]

[0025]

[0026] in: Context-sensitive scoring Metadata-sensitive weights For business scenario-sensitive weights, Metadata weighting coefficient, For scene weighting coefficients, To achieve a comprehensive sensitivity score, Assign coefficients to the rule matching score weights. Assign coefficients to the semantically sensitive score weights. Assign context-sensitive score weights;

[0027] Adaptively select mask replacement, fake data filling, and hash encryption desensitization algorithms for different types of sensitive fields, and output the desensitized value of a single field.

[0028] All anonymized fields are encapsulated in a standardized format, and the format adaptability is evaluated using a quantitative formula, ultimately outputting structured anonymized data.

[0029] In one possible implementation, the adaptive selection of mask replacement, fake data filling, and hash encryption desensitization algorithms for different types of sensitive fields, and the output of the desensitized value for a single field, includes:

[0030] Mask replacement: ;

[0031] in: The field value after masking. Preserve characters for the prefix. For fixed mask characters, To preserve characters in the suffix, , The length of the original field value. This is a function for calculating the length of a string.

[0032] Fake data filling: ;

[0033] Where: F and L represent different fill data selected. Indicates random selection;

[0034] Hash-based encryption de-identification includes irreversible and reversible de-identification:

[0035] Irreversible desensitization: ;

[0036] in: To de-identify data using hash encryption, For hash encryption operation, The original desensitization value. This is a 32-bit random salt value, and || is for string concatenation.

[0037] Reversible desensitization:

[0038]

[0039]

[0040] in: The encrypted value, Indicates the encryption function. For encryption key, As the initial vector, The mask value after AES encryption. A function for extracting a string. To expose the first and last digits of the encrypted string, balancing security and recognizability.

[0041] In one possible implementation, detecting whether the original request data contains an adversarial payload, and performing adversarial filtering based on the detection result to obtain the second data after adversarial filtering, includes:

[0042] Maintain an adversarial sample fingerprint database covering image and text scenarios, calculate the matching degree between the original request data and the adversarial sample fingerprint database, output feature matching scores, and quickly intercept known adversarial samples:

[0043]

[0044] in: For Hamming distance, The feature vector of the input data is the pixel perturbation feature string for images and the synonym replacement pattern vector for text. The feature vector of the adversarial sample in the fingerprint database. is the length of the feature vector, which is the perturbation pixel length for images and the word vector dimension for text; Represents cosine similarity. It is the vector norm 2;

[0045] By using isolated forests and Autoencoder reconstruction errors to detect whether the input deviates from the normal data distribution, or by using adversarial training shadow models to determine whether the input has been misclassified, anomaly scores are output, and unknown adversarial samples are identified.

[0046] A comprehensive risk score is calculated by combining the feature matching score and the anomaly score. Based on the threshold, the decision is made to intercept or clean up the system. The cleanup requires reverse restoration to counteract the disturbance.

[0047] Finally, the filtered data is packaged in a standardized format and aligned with the sensitive data desensitization branch format.

[0048] In one possible implementation, the step of injecting the standardized data as training data into training adversarial examples to optimize the protection model and ensuring the traceability of the protection model by embedding a digital watermark includes:

[0049] Generate adversarial examples, dynamically adjust the perturbation intensity according to the training stage, and regulate the proportion of adversarial examples injected into the training data to provide diverse adversarial examples for adversarial training;

[0050] Introducing an adversarial loss term into the loss function allows the protective model to fit both normal and adversarial samples simultaneously. Training heterogeneous models and using weighted voting decisions reduces the vulnerability of a single model, including:

[0051] Determine the total loss function for adversarial training: ,in: For the total loss, The baseline loss for normal samples, For the input sample, For model parameters, For real labels, To counteract the loss of weight, To combat sample loss, For adversarial examples;

[0052] The voting decision for heterogeneous model fusion is determined to be used to achieve model fusion: ,in: The final inference result is given, where M represents the number of heterogeneous models. Let m be the voting weight. To predict the probability of label c for model m, where C is the set of classes. For the category set constraint function;

[0053] Paillier additive homomorphic encryption is used to protect the privacy of model parameters. In the federated learning scenario, differential privacy noise is added through DP-SGD to avoid leakage of original parameters.

[0054] Embedding visible or invisible watermarks and verifying the watermarks through a challenge-response mechanism enables model traceability and prevents tampering or theft, including:

[0055] Visible watermark: ,in: To output the preset watermark, For watermark neurons with fixed weights, To trigger input, For bias terms, Use the Sigmoid activation function;

[0056] Invisible watermark: ,in: For the weight after embedding the watermark, For the disturbance amplitude, This is the watermark encoding vector;

[0057] Validate the watermark score of the model: ,in: To verify the score, For the actual watermark output of the model, Output the preset watermark.

[0058] In one possible implementation, the generation of adversarial examples dynamically adjusts the perturbation intensity according to the training phase and regulates the proportion of adversarial examples injected into the training data, providing diverse adversarial examples for adversarial training, including:

[0059] Generate adversarial examples based on FGSM or PGD algorithms:

[0060] FGSM generates adversarial examples, including: ,in: Adversarial examples generated for FGSM For the disturbance amplitude, For symbolic functions, This represents the model loss on the input samples. gradient, The basic loss function;

[0061] PGD ​​generates adversarial examples, including: ,in: This is a zero-order iterative adversarial example. This is the adversarial example after the (k+1)th iteration. for Sphere projection function, B is Unit ball, This is the adversarial example after the k-th iteration. Let k be the iteration step size. The gradient of the loss function with respect to the adversarial example in the kth round;

[0062] Adversarial examples generated based on FGSM or PGD are dynamically injected into the training data.

[0063] In one possible implementation, the step of deploying a honeypot interface to lure attackers and trigger countermeasures, using the protection model to generate dynamic defense rules, and updating the training adversarial samples in real time for continuous optimization of the protection model includes:

[0064] Attack anomalies are identified through protocol anomaly detection and behavioral baseline modeling. A comprehensive threat score is calculated by combining a rule engine and dynamic risk prediction, and a two-branch control instruction is output, including: parsing HTTP request headers through protocol anomaly detection and behavioral baseline modeling; marking inconsistent CL-TE features as anomalous behavior; and determining the comprehensive threat score of the anomalous behavior. ,in: To score the rules engine, To score the protection model, For the weight of the rules engine, To protect the model weights; k is the total number of rules. Let i be the weight of the i-th rule. The matching result for the i-th rule is determined; the comprehensive threat score is compared with a preset threshold, and a control command is output based on the comparison result.

[0065] Based on the threat score, the permission adjustment coefficient is calculated, and the permissions of high-risk user roles are temporarily downgraded. The permission declaration in the JWT token is refreshed through the API gateway to achieve real-time permission control.

[0066] By simulating high-value vulnerabilities / sensitive interfaces with honeypots to lure attackers, attack behavior data is collected, network logs are integrated to reconstruct the attack path, and the source data is hashed and stored on the blockchain for evidence, thus realizing a closed loop of attack countermeasures and evidence collection.

[0067] Newly captured attack features are synchronized to training adversarial samples to continuously optimize the parameters of the protection model, forming a closed-loop defense system of detection, countermeasure, and optimization.

[0068] In one possible implementation, the process involves using honeypots to simulate high-value vulnerabilities / sensitive interfaces to lure attackers, collecting attack behavior data, integrating network logs to reconstruct the attack path, and hashing the source data for blockchain storage, thus achieving a closed loop of attack countermeasures and evidence collection. This includes:

[0069] Set the honeypot trigger probability: ,in: Weights for abnormal behavior. Scoring for behavioral anomalies Scoring based on attack feature matching;

[0070] When the trigger probability is greater than or equal to the trigger threshold, the collected data will be combined with the reconstructed attack path for hash-based on-chain evidence storage. ,in: For traceability data, Time is the evidence storage timestamp, and Nonce is a random number.

[0071] Secondly, an active defense system based on a large model provided in this application includes:

[0072] The data cleaning module is used to intercept malicious requests from external attackers and clean the sensitive information and adversarial samples in the malicious requests to output standardized data.

[0073] The model protection module is used to inject the standardized data as training data into the training adversarial samples to optimize the protection model and to ensure the traceability of the protection model by embedding digital watermarks.

[0074] The application defense module is used to lure attackers and trigger countermeasures by deploying honeypot interfaces. It uses the protection model to generate dynamic defense rules and updates the training adversarial samples in real time for continuous optimization of the protection model.

[0075] In this embodiment, the limitations of passive defense in existing large-scale models are overcome. By intercepting and cleaning malicious requests and trapping honey spots, attacks are proactively detected and blocked in advance. Combined with dynamic defense rule generation and continuous optimization of the protection model to adapt to attack iterations, and a digital watermarking traceability mechanism, the attack cost is significantly increased and the attack benefits are reduced to curb malicious motives. This constructs a closed-loop full-link of "interception-protection-optimization" and improves the security defense capability of the protection model. Attached Figure Description

[0076] Figure 1 A flowchart illustrating a proactive defense method based on a large model, provided for an embodiment of this application;

[0077] Figure 2 This is a schematic diagram of a large-model-based active defense system provided in an embodiment of this application. Detailed Implementation

[0078] The present solution will now be described in conjunction with the accompanying drawings and specific embodiments.

[0079] See Figure 1 The active defense method based on a large model provided in this embodiment includes:

[0080] S101, intercept malicious requests from external attackers and clean up sensitive information and adversarial samples from the malicious requests to output standardized data.

[0081] In this embodiment, to intercept malicious requests from external attackers, malicious requests are received via HTTP or WebSocket. Protocol compliance checks are performed on the request headers and request bodies of the malicious requests, and abnormal protocol characteristics of the malicious requests are flagged to obtain raw request data carrying preliminary flags.

[0082] To obtain the fused data, the original request data is first analyzed using sensitivity detection technology to identify sensitive fields. Then, a dynamic obfuscation strategy is employed to de-identify the data, resulting in the first data after de-identification. Simultaneously with the de-identification, the original request data is checked for adversarial payloads. Based on the detection results, adversarial filtering is performed to obtain the second data after adversarial filtering. The first and second data are then combined into fused data for training the protection model.

[0083] Specifically, the original request data is analyzed using sensitivity detection technology to identify sensitive fields, and then a dynamic obfuscation strategy is employed to desensitize the data, resulting in the first data after desensitization of sensitive information, including:

[0084] Based on the rule engine, the fields and text of the original request data are structured and matched to filter out sensitive fields with high confidence, and the rule matching score is output:

[0085]

[0086] in: The score is determined by the rule matching result. A successful match for a single rule is scored as 1, and a failure is scored as 0. The weight of a single rule matching is assigned based on the accuracy of the rule. The weight assignment logic is that regular expression rules have higher weights and keyword rules have lower weights.

[0087] For fields and texts not matched by the rule engine, NLP semantic recognition is used to mine unstructured privacy semantics and output semantically sensitive scores:

[0088]

[0089] in: For semantic sensitivity scores, the sensitivity probability output by the BERT model is the model's classification probability of text privacy semantics, which is obtained by fine-tuning BERT using an labeled dataset; the semantic scenario weights are defined according to the business scenario.

[0090] By combining contextual correlation with business metadata supplementary judgment, the fields and texts that were not matched in the first two steps are subjected to contextual supplementary judgment, and the context sensitivity score is output. Finally, the scores from the three steps are combined to determine whether a field is sensitive.

[0091]

[0092]

[0093] in: Context-sensitive scoring Metadata-sensitive weights For business scenario-sensitive weights, Metadata weighting coefficient, For scene weighting coefficients, To achieve a comprehensive sensitivity score, Assign coefficients to the rule matching score weights. Assign coefficients to the semantically sensitive score weights. Assign context-sensitive score weights.

[0094] The algorithm adaptively selects mask replacement, fake data filling, and hash encryption de-identification algorithms for different types of sensitive fields, and outputs the de-identified value for each field. Specifically, this includes:

[0095] Mask replacement: ;

[0096] in: The field value after masking. Preserve characters for the prefix. For fixed mask characters, To preserve characters in the suffix, , The length of the original field value. This is a function for calculating the length of a string.

[0097] Fake data filling: ;

[0098] Where: F and L represent different fill data selected. Indicates random selection;

[0099] Hash-based encryption de-identification includes irreversible and reversible de-identification:

[0100] Irreversible desensitization: ;

[0101] in: To de-identify data using hash encryption, For hash encryption operation, The original desensitization value. This is a 32-bit random salt value, and || is for string concatenation.

[0102] Reversible desensitization:

[0103]

[0104]

[0105] in: The encrypted value, Indicates the encryption function. For encryption key, As the initial vector, The mask value after AES encryption. A function for extracting a string. To expose the first and last digits of the encrypted string, balancing security and recognizability.

[0106] All anonymized fields are encapsulated in a standardized format, and the format adaptability is evaluated using a quantitative formula, ultimately outputting structured anonymized data.

[0107] In this embodiment, detecting whether the original request data contains an adversarial sample payload, and performing adversarial filtering based on the detection results to obtain the second data after adversarial sample filtering, includes: maintaining an adversarial sample fingerprint database covering image and text scenes, calculating the matching degree between the original request data and the adversarial sample fingerprint database, outputting a feature matching score, and quickly intercepting known adversarial samples.

[0108]

[0109] in: For Hamming distance, The feature vector of the input data is the pixel perturbation feature string for images and the synonym replacement pattern vector for text. The feature vector of the adversarial sample in the fingerprint database. is the length of the feature vector, which is the perturbation pixel length for images and the word vector dimension for text; Represents cosine similarity. It is the vector 2 norm.

[0110] By using isolated forests and Autoencoder reconstruction errors to detect whether the input deviates from the normal data distribution, or by using adversarial-trained shadow models to determine whether the input has been misclassified, anomaly scores are output, and unknown adversarial examples are identified:

[0111] Isolated Forest Anomaly Score: ,in: For input samples The average path length isolated in an isolated forest. Let L be the average path length of the dataset of length L;

[0112] Autoencoder reconstruction error: ,in: For the total number of features, Let i be the i-th feature of the input data. The i-th feature after reconstruction by the Autoencoder is the one with the larger reconstruction error. The larger the input deviates from the normal distribution, the more likely it is to be an adversarial example.

[0113] Shadow model misclassification probability: ,in: To train a shadow model against input The higher the probability of correct classification, the more likely the input is to be an adversarial example.

[0114] A comprehensive risk score is calculated by combining the feature matching score and the anomaly score. Based on the threshold, the decision is made to intercept or clean up the system. The cleanup requires reverse restoration to counteract the disturbance.

[0115] Finally, the filtered data is packaged in a standardized format and aligned with the sensitive data desensitization branch format.

[0116] S102, the standardized data is injected as training data into the training adversarial samples to optimize the protection model, and the traceability of the protection model is ensured by embedding a digital watermark.

[0117] Specifically, in this embodiment, adversarial examples can be generated based on the FGSM or PGD algorithm:

[0118] FGSM generates adversarial examples, including: ,in: Adversarial examples generated for FGSM For the disturbance amplitude, For symbolic functions, This represents the model loss on the input samples. gradient, For model parameters, For real labels, The basic loss function is used.

[0119] PGD ​​generates adversarial examples, including: ,in: This is a zero-order iterative adversarial example. This is the adversarial example after the (k+1)th iteration. for Sphere projection function, B is Unit ball, This is the adversarial example after the k-th iteration. Let k be the iteration step size. The gradient of the loss function with respect to the adversarial example in the k-th round. Adversarial examples generated based on FGSM or PGD are dynamically injected into the training data.

[0120] In this embodiment, adversarial examples are first generated, the perturbation intensity is dynamically adjusted according to the training stage, and the proportion of adversarial examples injected into the training data is controlled to provide diverse adversarial examples for adversarial training.

[0121] As shown in Table 1, in the early stage of training the protection model, this embodiment uses FGSM to generate adversarial examples, producing low-intensity adversarial examples, which are mixed into the training set in small quantities to allow the model to adapt to basic adversarial features. In the middle stage of training, FGSM+PGD is used to generate adversarial examples, mixing high and low intensity adversarial examples to gradually improve the model's anti-perturbation ability. In the later stage of training, PGD is used to generate adversarial examples, producing high-intensity adversarial examples, which are mixed into the training set in large proportion to enhance the model's robustness.

[0122] Table 1 Adjustment of training samples for adversarial models

[0123]

[0124] Introducing an adversarial loss term into the loss function allows the protective model to fit both normal and adversarial samples simultaneously. Training heterogeneous models and making decisions through weighted voting reduces the vulnerability of a single model.

[0125] In this embodiment, the total loss function for adversarial training is determined as follows:

[0126]

[0127] in: For the total loss, The baseline loss for normal samples, To counteract the loss of weight, To combat sample loss, For adversarial examples.

[0128] The voting decision for heterogeneous model fusion is determined to be used to achieve model fusion: ,in: The final inference result is given, where M represents the number of heterogeneous models. Let m be the voting weight. To predict the probability of label c for model m, where C is the set of classes. This is a constraint function for the category set.

[0129] Paillier additive homomorphic encryption is used to protect the privacy of model parameters. In the federated learning scenario, differential privacy noise is added through DP-SGD to avoid leakage of original parameters.

[0130] Embed visible or invisible watermarks and verify the watermarks through a challenge-response mechanism to achieve model traceability and prevent tampering or theft.

[0131] Specifically, the watermark is visible: ,in: To output the preset watermark, For watermark neurons with fixed weights, To trigger input, For bias terms, This is the Sigmoid activation function.

[0132] Invisible watermark: ,in: For the weight after embedding the watermark, For the disturbance amplitude, This is the watermark encoding vector.

[0133] Validate the watermark score of the model: ,in: To verify the score, For the actual watermark output of the model, Output the preset watermark.

[0134] S103, by deploying honeypot interfaces to lure attackers and trigger countermeasures, dynamic defense rules are generated using the protection model, and the training adversarial samples are updated in real time for continuous optimization of the protection model.

[0135] In this embodiment, attack anomalies are first identified through protocol anomaly detection and behavioral baseline modeling. A comprehensive threat score is then calculated using a rule engine and dynamic risk prediction, outputting a dual-branch control command. Based on the threat score, a permission adjustment coefficient is calculated, temporarily lowering the permissions of high-risk user roles. The permission declaration in the JWT token is refreshed via the API gateway to achieve real-time permission control. Attackers are lured using honeypots to simulate high-value vulnerabilities / sensitive interfaces, attack behavior data is collected, and network logs are integrated to reconstruct the attack path. The source data is hashed and stored on the blockchain for evidence, achieving a closed loop of attack countermeasures and evidence collection. Newly captured attack features are synchronized to training adversarial samples, continuously optimizing the protection model parameters to form a detection-countermeasure-optimization defense closed loop. More refined adversarial samples are used for subsequent optimization of the protection model.

[0136] Specifically, in this embodiment, HTTP request headers are parsed through protocol anomaly detection and behavioral baseline modeling. Inconsistent CL-TE characteristics are flagged as anomalous behavior. The comprehensive threat score for this anomalous behavior is then determined. ,in: To score the rules engine, To score the protection model, For the weight of the rules engine, To protect the model weights; k is the total number of rules. Let i be the weight of the i-th rule. This represents the matching result for the i-th rule. The comprehensive threat score is compared with a preset threshold, and a control command is output based on the comparison result.

[0137] See Table 2 for rule matching used to calculate the comprehensive threat score for several anomalous behaviors.

[0138]

[0139] In Table 2, the rule scores The protection model score has a risk value of 57. In this embodiment, it will be... Assign a value of 0.4. Assigning a value of 0.6, the final overall threat score is determined to be 57. Of course, the above is just an example; in specific situations, the score for each rule can be adjusted according to the established rules.

[0140] To implement access control, first determine the access adjustment coefficient:

[0141]

[0142] in: Adjust the coefficient for permissions. The low-risk threshold The threshold for medium risk is [missing information]. This is a high-risk threshold. Based on the determined... Perform real-time access control: , For basic user permissions, The actual level of privileges after being demoted.

[0143] When using honeypots to simulate high-value vulnerabilities / sensitive interfaces to lure attackers, set the honeypot trigger probability: ,in: Weights for abnormal behavior. Scoring for behavioral anomalies Attack signature matching scores are assigned. When the trigger probability is greater than or equal to the trigger threshold, the collected data is combined with the reconstructed attack path for hash-based on-chain evidence storage. ,in: For traceability data, Time is the evidence storage timestamp, and Nonce is a random number.

[0144] Corresponding to the active defense method based on a large model provided in the above embodiments, this application also provides an embodiment of an active defense system based on a large model.

[0145] join Figure 2 The active defense system 20 based on a large model provided in this embodiment includes:

[0146] The data cleaning module 201 is used to intercept malicious requests from external attackers and clean the sensitive information and adversarial samples in the malicious requests to output standardized data.

[0147] The model protection module 202 is used to inject the standardized data as training data into the training adversarial examples to optimize the protection model and to ensure the traceability of the protection model by embedding a digital watermark.

[0148] The application defense module 203 is used to lure attackers and trigger countermeasures by deploying honeypot interfaces, generate dynamic defense rules using the protection model, and update the training adversarial samples in real time for continuous optimization of the protection model.

[0149] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0150] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A proactive defense method based on a large model, characterized in that, include: Intercepting malicious requests from external attackers and cleaning sensitive information and adversarial sample outputs standardized data from those malicious requests, including: Receiving malicious requests from external attackers via HTTP or WebSocket; The request header and request body of the malicious request are verified for protocol compliance, and the abnormal protocol characteristics of the malicious request are marked to obtain the original request data carrying the preliminary mark. Sensitive fields are identified in the original request data using sensitivity detection technology, and then a dynamic obfuscation strategy is used to de-sensitize the data to obtain the first data after de-sensitization of sensitive information, including: Based on the rule engine, the fields and text of the original request data are structured and matched to filter out sensitive fields with high confidence, and the rule matching score is output: in: For rule matching scores, a successful match for a single rule is scored as 1, and a failure as 0. The weight of a single rule matching is assigned based on the accuracy of the rule, with regular expression rules having higher weights and keyword rules having lower weights. For fields and texts not matched by the rule engine, NLP semantic recognition is used to mine unstructured privacy semantics and output semantically sensitive scores: in: For semantic sensitivity scores, the sensitivity probability output by the BERT model is the model's classification probability of text privacy semantics, which is obtained by fine-tuning BERT using an labeled dataset; the semantic scenario weights are defined according to the business scenario. By combining contextual correlation with business metadata supplementary judgment, the fields and texts that were not matched in the first two steps are subjected to contextual supplementary judgment, and the context sensitivity score is output. Finally, the scores from the three steps are combined to determine whether a field is sensitive. in: Context-sensitive scoring Metadata-sensitive weights For business scenario-sensitive weights, Metadata weighting coefficient, For scene weighting coefficients, To achieve a comprehensive sensitivity score, Assign coefficients to the rule matching score weights. Assign coefficients to the semantically sensitive score weights. Assign context-sensitive score weights; Adaptively select mask replacement, fake data filling, and hash encryption desensitization algorithms for different types of sensitive fields, and output the desensitized value of a single field. All anonymized fields are encapsulated in a standardized format, and the format adaptability is evaluated using a quantitative formula to finally output structured anonymized data. Simultaneously with data desensitization, the original request data is detected to see if there is an adversarial sample payload. The detection results are combined to perform adversarial filtering to obtain the second data after adversarial sample filtering. The first data and the second data are aggregated into fused data for use in training the protection model; The standardized data is used as training data and injected into the training adversarial samples to optimize the protection model. The traceability of the protection model is ensured by embedding digital watermarks. By deploying honeypot interfaces to lure attackers and trigger countermeasures, the protection model generates dynamic defense rules and updates the training adversarial samples in real time for continuous optimization of the protection model.

2. The active defense method based on a large model according to claim 1, characterized in that, The adaptive selection of mask replacement, fake data filling, and hash encryption de-identification algorithms for different types of sensitive fields outputs the de-identified value for a single field, including: Mask replacement: ; in: The field value after masking. Preserve characters for the prefix. For fixed mask characters, To preserve characters in the suffix, , The length of the original field value. This is a function for calculating the length of a string. Fake data filling: ; Where: F and L represent different fill data selected. Indicates random selection; Hash-based encryption de-identification includes irreversible and reversible de-identification: Irreversible desensitization: ; in: To de-identify data using hash encryption, For hash encryption operations, The original desensitization value. This is a 32-bit random salt value, and || is for string concatenation. Reversible desensitization: in: The encrypted value, Indicates the encryption function. For encryption key, As the initial vector, The mask value after AES encryption. A string slicing function. To expose the first and last digits of the encrypted string, balancing security and recognizability.

3. The active defense method based on a large model according to claim 1, characterized in that, The process of detecting whether the original request data contains an adversarial payload, and then performing adversarial filtering based on the detection results to obtain the second data after adversarial filtering, includes: Maintain an adversarial sample fingerprint database covering image and text scenarios, calculate the matching degree between the original request data and the adversarial sample fingerprint database, output feature matching scores, and quickly intercept known adversarial samples: in: For Hamming distance, The feature vector of the input data is the pixel perturbation feature string for images and the synonym replacement pattern vector for text. The feature vector of the adversarial sample in the fingerprint database. is the length of the feature vector, which is the perturbation pixel length for images and the word vector dimension for text; Represents cosine similarity. It is the vector norm 2; By using isolated forests and Autoencoder reconstruction errors to detect whether the input deviates from the normal data distribution, or by using adversarial training shadow models to determine whether the input has been misclassified, anomaly scores are output, and unknown adversarial samples are identified. A comprehensive risk score is calculated by combining the feature matching score and the anomaly score. Based on the threshold, the decision is made to intercept or clean up the system. The cleanup requires reverse restoration to counteract the disturbance. Finally, the filtered data is packaged in a standardized format and aligned with the sensitive data desensitization branch format.

4. The active defense method based on a large model according to claim 1, characterized in that, The step of injecting the standardized data as training data into the training adversarial examples to optimize the protection model and ensuring the traceability of the protection model by embedding digital watermarks includes: Generate adversarial examples, dynamically adjust the perturbation intensity according to the training stage, and regulate the proportion of adversarial examples injected into the training data to provide diverse adversarial examples for adversarial training; Introducing an adversarial loss term into the loss function allows the protective model to fit both normal and adversarial samples simultaneously. Training heterogeneous models and using weighted voting decisions reduces the vulnerability of a single model, including: Determine the total loss function for adversarial training: ,in: For the total loss, The baseline loss for normal samples, For the input sample, For model parameters, For real labels, To counteract the loss of weight, To combat sample loss, For adversarial examples; The voting decision for heterogeneous model fusion is determined to be used to achieve model fusion: ,in: The final inference result is given, where M represents the number of heterogeneous models. Let m be the voting weight. To predict the probability of label c for model m, where C is the set of classes. For the category set constraint function; Paillier additive homomorphic encryption is used to protect the privacy of model parameters. In the federated learning scenario, differential privacy noise is added through DP-SGD to avoid leakage of original parameters. Embedding visible or invisible watermarks and verifying the watermarks through a challenge-response mechanism enables model traceability and prevents tampering or theft, including: Visible watermark: ,in: To output the preset watermark, For watermark neurons with fixed weights, To trigger input, For bias terms, Use the Sigmoid activation function; Invisible watermark: ,in: For the weight after embedding the watermark, For the amplitude of the disturbance, This is the watermark encoding vector; Validate the watermark score of the model: ,in: To verify the score, For the actual watermark output of the model, Output the preset watermark.

5. The active defense method based on a large model according to claim 4, characterized in that, The generation of adversarial examples dynamically adjusts the perturbation intensity according to the training phase and regulates the proportion of adversarial examples injected into the training data, providing diverse adversarial examples for adversarial training, including: Generate adversarial examples based on FGSM or PGD algorithms: FGSM generates adversarial examples, including: ,in: Adversarial examples generated for FGSM For the amplitude of the disturbance, For symbolic functions, This represents the model loss on the input samples. gradient, The basic loss function; PGD ​​generates adversarial examples, including: ,in: This is a zero-order iterative adversarial example. This is the adversarial example after the (k+1)th iteration. for Sphere projection function, B is Unit ball, This is the adversarial example after the k-th iteration. Let k be the iteration step size. The gradient of the loss function with respect to the adversarial example in the kth round; Adversarial examples generated based on FGSM or PGD are dynamically injected into the training data.

6. The active defense method based on a large model according to claim 1, characterized in that, The process of deploying honeypot interfaces to lure attackers and trigger countermeasures, generating dynamic defense rules using the protection model, and updating the training adversarial samples in real time for continuous optimization of the protection model includes: Attack anomalies are identified through protocol anomaly detection and behavioral baseline modeling. A comprehensive threat score is calculated by combining a rule engine and dynamic risk prediction, and a two-branch control instruction is output, including: parsing HTTP request headers through protocol anomaly detection and behavioral baseline modeling; marking inconsistent CL-TE features as anomalous behavior; and determining the comprehensive threat score of the anomalous behavior. ,in: To score the rules engine, To score the protection model, For the weight of the rules engine, To protect the model weights; k is the total number of rules. Let i be the weight of the i-th rule. The matching result for the i-th rule is determined; the comprehensive threat score is compared with a preset threshold, and a control command is output based on the comparison result. Based on the threat score, the permission adjustment coefficient is calculated, and the permissions of high-risk user roles are temporarily downgraded. The permission declaration in the JWT token is refreshed through the API gateway to achieve real-time permission control. By simulating high-value vulnerabilities / sensitive interfaces with honeypots to lure attackers, attack behavior data is collected, network logs are integrated to reconstruct the attack path, and the source data is hashed and stored on the blockchain for evidence, thus realizing a closed loop of attack countermeasures and evidence collection. Newly captured attack features are synchronized to training adversarial samples to continuously optimize the parameters of the protection model, forming a closed-loop defense system of detection, countermeasure, and optimization.

7. The active defense method based on a large model according to claim 6, characterized in that, The process involves using honeypots to simulate high-value vulnerabilities / sensitive interfaces to lure attackers, collecting attack behavior data, integrating network logs to reconstruct the attack path, and hashing and storing the source data on the blockchain for evidence collection, thus achieving a closed loop for attack countermeasures and evidence gathering. This includes: Set the honeypot trigger probability: ,in: Weights for abnormal behavior. Scoring for behavioral anomalies Scoring based on attack feature matching; When the trigger probability is greater than or equal to the trigger threshold, the collected data will be combined with the reconstructed attack path for hash-based on-chain evidence storage. ,in: For traceability data, Time is the evidence storage timestamp, and Nonce is a random number.

Images