Security detection method and device of business model and computer program product

Abstract

The invention discloses a security detection method and device for a business model and a computer program product. The method relates to the field of artificial intelligence, and comprises the steps that a deployed business model is determined, the business model is obtained by training an original sample data set and a sample data set combined by adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample data set; under the condition that the application request of the target user for the service model is detected, detecting the access behavior of the target user in the process of applying the service model, and detecting the input data of the target user in the process of applying the service model; and under the condition that the access behavior and the input data pass the detection, determining that the target user has no risk on the current application behavior of the business model. Through the method and the device, the problem that security risks exist in the application process of the business model in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a security detection method, apparatus, and computer program product for a business model. Background Technology

[0002] With the widespread application of large-scale models across various fields, the level of intelligence has been significantly improved. However, the application of large-scale models faces a series of security risks, such as adversarial attacks, data tampering, and unauthorized access. Adversarial attacks, through artificially designed inputs, cause large-scale models to produce erroneous outputs, seriously threatening the security and reliability of the models. Furthermore, unauthorized access can not only lead to data leaks and violations of user privacy, but may also cause system instability due to illegal operations, especially in sensitive fields such as finance and banking, where the impact may be even greater. Adversarial attacks directly cause model errors, increasing false positives and false negatives, reducing the practicality of the models, and posing a serious threat to the normal operation of business.

[0003] There is currently no effective solution to the security risks that exist in the application of business models in related technologies. Summary of the Invention

[0004] The main purpose of this application is to provide a security detection method, device, and computer program product for business models, so as to solve the problem of security risks in the application of business models in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a security detection method for a business model is provided. The method includes: identifying a deployed business model, wherein the business model is trained using a sample dataset combining an original sample dataset and adversarial samples, and the adversarial samples are generated using an adversarial sample generation algorithm and the original sample dataset; detecting the target user's access behavior during the application of the business model, and detecting the input data during the application of the business model, upon detecting a target user's application request to the business model; and determining that the target user's current application behavior to the business model is risk-free if both the access behavior and the input data pass detection.

[0006] Optionally, before detecting the access behavior of the target user during the application of the business model, the method further includes: verifying whether the account and password entered by the target user are correct; determining that the target user's authentication has failed if the account or password is incorrect; determining whether the target user has access to the business model if the account and password are correct; determining that the target user's authentication has failed if the target user does not have access to the business model; and determining that the target user's authentication has passed if the target user has access to the business model.

[0007] Optionally, detecting the access behavior of the target user during the application of the business model includes: detecting whether the target user exhibits abnormal behavior during the application of the business model, wherein the abnormal behavior includes at least one of the following: the frequency of input data is greater than or equal to a first input data frequency threshold, and the frequency of data modification is greater than or equal to a first data modification frequency threshold; if the target user exhibits abnormal behavior during the application of the business model, the access behavior detection is determined to fail; if the target user does not exhibit abnormal behavior during the application of the business model, the access behavior detection is determined to pass.

[0008] Optionally, after determining that the access behavior detection fails, the method further includes: determining whether the frequency of input data is greater than or equal to a second input data frequency threshold, or whether the frequency of data modification is greater than or equal to a second data modification frequency threshold; issuing a first alarm message if the frequency of input data is less than the second input data frequency threshold and the frequency of data modification is less than the second data modification frequency threshold, wherein the first alarm message is used to instruct the administrator to call a backup service model to provide services to the target user; issuing a second alarm message if the frequency of input data is greater than or equal to the second input data frequency threshold, or if the frequency of data modification is greater than or equal to the second data modification frequency threshold, wherein the second alarm message is used to instruct the administrator to suspend processing the application requests of the target user.

[0009] Optionally, the detection of input data in the process of applying the business model of the target user includes: determining the format and data type of the input data, determining whether the format is a preset format, and determining whether the data type is a preset type; if the format is not a preset format, or the data type is not a preset type, determining that the input data detection fails; if the format is a preset format and the data type is a preset type, determining that the input data detection passes.

[0010] Optionally, after determining that the input data has passed detection, the method further includes: detecting outliers in the input data using an outlier detection algorithm; issuing a first prompt message if an outlier is found in the input data, wherein the first prompt message is used to prompt the target user to remove the outlier from the input data; inputting the input data into a large language model for semantic analysis if no outlier is found in the input data, obtaining a semantic analysis result; and issuing a second prompt message if the semantic analysis result indicates that an outlier exists in the input data, wherein the second prompt message is used to prompt the target user that an outlier exists in the input data.

[0011] Optionally, after detecting the access behavior and input data of the target user in the process of applying the business model, the method further includes: if the access behavior or input data fails the detection, recording the access behavior and input data through the access log; extracting abnormal access records from the access log at preset intervals, and updating the access list of the business model based on the abnormal access records, wherein the access list records the users allowed to access the business model.

[0012] To achieve the above objectives, according to another aspect of this application, a security detection device for a business model is provided. The device includes: a first determining unit, configured to determine a deployed business model, wherein the business model is trained from a sample dataset consisting of an original sample dataset and adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset; a detection unit, configured to detect the access behavior of the target user during the application of the business model and to detect the input data during the application of the business model when an application request from a target user is detected; and a second determining unit, configured to determine that the target user's current application behavior of the business model is risk-free if both the access behavior and the input data pass detection.

[0013] In this embodiment, a deployed business model is determined. The business model is trained using a sample dataset combining the original sample dataset and adversarial samples. The adversarial samples are generated using an adversarial sample generation algorithm and the original sample dataset. Upon detecting a target user's application request to the business model, the system detects the target user's access behavior and input data during the application process. If both the access behavior and input data pass detection, the system determines that the target user's current application behavior to the business model is risk-free. By strengthening the training with adversarial samples, the system checks the access behavior and input data during the application process, thereby improving the model's robustness and preventing illegal input and unauthorized access. This achieves the technical effect of improving the security of the business model during application, thus solving the technical problem of security risks associated with the application of the business model. Attached Figure Description

[0014] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0015] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a security detection method for a business model is shown.

[0016] Figure 2 This is a flowchart of a security detection method for a business model provided in an embodiment of this application;

[0017] Figure 3 This is a schematic diagram of a security detection device for a business model provided in an embodiment of this application;

[0018] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding operation entry points for them to choose to agree to or refuse automated decision results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0022] Example 1

[0023] According to an embodiment of this application, a method embodiment for security detection of a business model is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a security detection method for a business model is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as MCU (Microcontroller Unit) or FPGA (Field-Programmable Gate Array), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a USB (Universal Serial Bus) port (which may be included as one of the ports of a BUS (Business Bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0025] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the security detection method of the business model in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned security detection method of the business model. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0027] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0028] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0029] Under the aforementioned operating environment, this application provides a security detection method for a business model. Figure 2 This is a flowchart of a security detection method for a business model provided in an embodiment of this application, such as... Figure 2 As shown, the method includes:

[0030] Step S201: Determine the deployed business model, wherein the business model is trained by a sample dataset consisting of a combination of the original sample dataset and adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset.

[0031] In step S201, adversarial examples are generated on the training dataset using an adversarial example generation algorithm to simulate potential attacks. These generated adversarial examples are then combined with the original sample dataset to expand the dataset into a new one, increasing the model's "experience" with adversarial examples. This allows the business model to learn how to resist adversarial attacks during training, enhancing its robustness. The model's robustness is evaluated using an adversarial test set to ensure it can effectively resist attacks when faced with new adversarial examples.

[0032] The business model's performance metrics, such as accuracy and recall, are evaluated using a non-adversarial test dataset. An adversarial test set is used to verify the model's resistance to adversarial attacks and assess its robustness. A comparison is made with a model trained without adversarial examples to verify whether adding adversarial example training improves the model's robustness and security. The business model is comprehensively evaluated based on factors such as performance, robustness, training time, and resource consumption. After passing the evaluation and meeting the preset metrics, the business model is deployed in a security-compliant environment.

[0033] Step S202: If a target user's application request for the business model is detected, the access behavior of the target user in the process of applying the business model is detected, and the input data of the target user in the process of applying the business model is detected.

[0034] In step S202, access behavior detection may include checking the frequency of user access to the business model; excessively high frequency may indicate automated attacks or abnormal usage. It involves analyzing user operation patterns using the business model, such as query and prediction request patterns, to identify any abnormal operations or attempts to bypass security mechanisms. It also involves recording and analyzing user IP addresses to identify signs such as rapid switching between multiple locations or IP address pool usage. Furthermore, it involves monitoring the duration of user sessions; abnormally long sessions may indicate improper use. Finally, it involves monitoring the consumption of model resources by user requests to prevent excessive use from causing service degradation or downtime.

[0035] Input data inspection can include ensuring that data input conforms to the expected format, preventing data processing anomalies or security vulnerabilities caused by formatting errors; verifying data integrity, ensuring that no critical fields are missing or tampered with, and maintaining data consistency; identifying outliers in the data through statistical analysis or machine learning, and eliminating possible illegal input or erroneous data; verifying that input data is within a reasonable numerical range, as exceeding the range may indicate attack attempts; filtering text input for keywords to prevent the input of sensitive content, maintaining data security and compliance; and analyzing the syntax and logical structure of input data to ensure its rationality and avoid abnormal code or syntax vulnerabilities.

[0036] Step S203: If both the access behavior and the input data pass the detection, it is determined that the target user's current application behavior of the business model poses no risk.

[0037] In step S203, if the frequency of user access to the business model is within the normal range, and there are no signs of automated attacks or abnormal usage patterns; if the user's operations conform to expected behavioral patterns, such as query and prediction requests matching daily usage habits, with no abnormal requests or attempts to bypass security mechanisms; if the user's IP address matches the geographical location used for registration or authorization, with no suspicion of rapid switching between multiple locations or use of an IP address pool; if the duration of the user session is within the normal range, with no abnormally long periods of activity; and if the user's requests consume model resources within an acceptable range, with no signs of overuse leading to service degradation or model performance deterioration, then the access behavior detection is considered successful.

[0038] The input data fully conforms to the model's expected format requirements. There are no missing data, and all key fields are present and have not been tampered with. There are no statistically significant outliers or values ​​that deviate significantly from the normal range. The numerical values ​​in the input data are within the defined reasonable range, with no values ​​exceeding the limits, and no attempts to input sensitive data have been made. The text input does not contain sensitive keywords, ensuring the compliance and security of the data content. The syntax and logical structure of the input data are reasonable, with no abnormal code or syntax errors. This indicates that the input data detection has passed. A comprehensive security assessment is conducted based on all the above detection results. If there are no abnormalities in the access behavior and input data, and no known security risks exist, it can be confirmed that the target user's current application behavior to the business model poses no risk.

[0039] The security detection method for business models provided in this application determines the deployed business model, which is trained from a sample dataset consisting of an original sample dataset and adversarial samples. The adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset. Upon detecting a target user's application request to the business model, the method detects the target user's access behavior and input data during the application process. If both the access behavior and input data pass detection, the method determines that the target user's current application behavior to the business model is risk-free. By strengthening the training with adversarial samples, the method checks the access behavior and input data during the application process of the business model, thereby improving the robustness of the model and preventing illegal input and unauthorized access. This achieves the technical effect of improving the security of the business model during application, and solves the technical problem of security risks in the application process of the business model.

[0040] To ensure the secure application of the business model and to authenticate target users, optionally, in the security detection method for the business model provided in this application embodiment, before detecting the access behavior of the target user in the process of applying the business model, the method further includes: verifying whether the account and password entered by the target user are correct; if the account or password is incorrect, determining that the target user's authentication has failed; if the account and password are correct, determining whether the target user has access to the business model; if the target user does not have access to the business model, determining that the target user's authentication has failed; if the target user has access to the business model, determining that the target user's authentication has passed.

[0041] In some embodiments, user authentication can verify user identity and prevent unauthorized access through methods such as user login, password verification, and two-factor authentication. Access is tiered according to user permissions, with different levels of access control set, such as restrictions on access to sensitive data and functions. User information, time, and data content for each access operation are recorded for easy retrospective tracking and security audits. Abnormal access behavior, such as frequent access and unauthorized operations, is detected in real time, and alerts are immediately triggered or restrictive measures are taken upon detection. Through multi-layered access control and authentication mechanisms, it is ensured that only authorized users can access and use the model.

[0042] This embodiment uses authentication to ensure that only verified and authorized users can access and use the business model, effectively preventing unauthorized access and protecting the security of the model and data.

[0043] After successful authentication, the access behavior of the target user also needs to be detected. Optionally, in the security detection method for the business model provided in this application embodiment, detecting the access behavior of the target user during the application of the business model includes: detecting whether the target user has abnormal behavior during the application of the business model, wherein the abnormal behavior includes at least one of the following: the frequency of input data is greater than or equal to a first input data frequency threshold, and the frequency of data modification is greater than or equal to a first data modification frequency threshold; if the target user has abnormal behavior during the application of the business model, it is determined that the access behavior detection fails; if the target user does not have abnormal behavior during the application of the business model, it is determined that the access behavior detection passes.

[0044] In some embodiments, the frequency of input data submitted by the target user is monitored in real time. If the frequency is greater than or equal to a first input data frequency threshold, it indicates that the user may be conducting automated attacks or abnormal data testing. The frequency of user data changes is monitored. If the frequency is greater than or equal to a first data change frequency threshold, it indicates that the user may be attempting to tamper with data or launching a denial-of-service attack. The target user's current behavior is compared with its past behavior patterns and with the behavior patterns of normal users. A sudden increase in frequency may indicate anomalies. Machine learning algorithms, such as isolated forests and autoencoders, are used to identify and classify anomalous behavior features. If the frequency of the target user's input or data changes exceeds a preset threshold, abnormal behavior is determined, and the access behavior detection fails. If the target user's behavior conforms to a normal pattern and no anomaly detection rules are triggered, the access behavior detection is determined to pass.

[0045] This embodiment protects the model and data from unauthorized access and potential security threats by detecting abnormal behavior of target users during the application of the business model, thus avoiding the risk of data leakage.

[0046] If the access behavior detection fails, an alarm needs to be issued promptly. Optionally, in the security detection method for the business model provided in this application embodiment, after determining that the access behavior detection fails, the method further includes: determining whether the frequency of input data is greater than or equal to a second input data frequency threshold, or whether the frequency of data modification is greater than or equal to a second data modification frequency threshold; issuing a first alarm message when the frequency of input data is less than the second input data frequency threshold and the frequency of data modification is less than the second data modification frequency threshold, wherein the first alarm message is used to instruct the administrator to call a backup business model to provide services to the target user; issuing a second alarm message when the frequency of input data is greater than or equal to the second input data frequency threshold, or when the frequency of data modification is greater than or equal to the second data modification frequency threshold, wherein the second alarm message is used to instruct the administrator to suspend processing the application requests of the target user.

[0047] In some embodiments, adversarial attack behaviors (such as frequent abnormal inputs, rapid input switching, etc.) are identified by monitoring model inputs and behavior. When an anomaly is detected, defense mechanisms are triggered, such as suspending the processing of suspicious requests or calling a backup security model for handling. Different levels of alarms are triggered based on the severity of the attack, notifying the administrator to take appropriate measures. Attack detection logs are analyzed regularly, and detection rules and defense strategies are continuously updated to improve the system's defense capabilities. Potential attack behaviors are detected in real time, and alarms are issued promptly to ensure the security of the model during operation.

[0048] For example, continuously monitor the frequency of data submitted by target users and compare it with a second input data frequency threshold. Monitor the frequency of user data changes and compare it with a second data change frequency threshold. If the frequency of input data changes is less than the second input data frequency threshold and the frequency of data changes is less than the second data change frequency threshold, it indicates that although the user behavior does not meet the abnormal criteria, it may be approaching the system's processing capacity limit or foreshadowing potential future abnormal behavior. In this case, issue a first alarm message, prompting the administrator to consider calling up backup service models to provide services, in order to prevent potential overload risks or ensure service continuity.

[0049] If the frequency of input data is greater than or equal to the second input data frequency threshold, or the frequency of data modification is greater than or equal to the second data modification frequency threshold, it indicates that the user's behavior has exceeded the normal range and may pose a direct threat to system stability and security. A second alarm message is issued, instructing the administrator to immediately suspend processing the target user's application requests to prevent further potential damage or attacks. Simultaneously, the second alarm message triggers a more in-depth security investigation to determine the nature of the behavior and subsequent response strategies.

[0050] This embodiment, by implementing an alarm and response mechanism, can promptly identify and address potential security risks, ensure the normal operation of the business model, protect users' legitimate rights and interests, and reduce the impact of unauthorized access or operations on the system.

[0051] In addition to detecting user access behavior, the method can also detect user input data. Optionally, in the security detection method for the business model provided in this application embodiment, detecting the input data of the target user in the process of applying the business model includes: determining the format and data type of the input data, determining whether the format is a preset format, and determining whether the data type is a preset type; if the format is not a preset format, or the data type is not a preset type, determining that the input data detection fails; if the format is a preset format and the data type is a preset type, determining that the input data detection passes.

[0052] In some embodiments, the format and data type of the input data are validated to ensure that the input conforms to the model's expectations and prevent potential attacks caused by format anomalies. Statistical methods and anomaly detection algorithms are used to identify outliers or abnormal behaviors in the input data and filter out potentially sensitive inputs. For input data involving text or images, semantic analysis and feature extraction methods are used to detect whether the input content is abnormal, preventing potentially risky data. Detected suspicious inputs are marked and recorded in the system log for subsequent analysis.

[0053] This embodiment effectively verifies input data to prevent data with incorrect format or mismatched type from entering, protecting the business model from interference by abnormal data, while providing accurate and efficient services to legitimate users.

[0054] To improve the application efficiency of the business model and remove outliers from the input data, optionally, in the security detection method for the business model provided in this application embodiment, after determining that the input data has passed detection, the method further includes: detecting outliers in the input data using an outlier detection algorithm; issuing a first prompt message if an outlier exists in the input data, wherein the first prompt message is used to prompt the target user to remove the outlier from the input data; if no outlier exists in the input data, inputting the input data into a large language model for semantic analysis to obtain a semantic analysis result; and issuing a second prompt message if the semantic analysis result indicates that an outlier exists in the input data, wherein the second prompt message is used to prompt the target user that an outlier exists in the input data.

[0055] In some embodiments, the received input data is preprocessed to ensure that it can be correctly interpreted by the outlier detection algorithm. Outlier detection algorithms such as Local Anomaly Factor (LAB) and Isolation Forest are used to analyze the data and identify whether values ​​outside the normal range exist. If the algorithm detects outliers in the input data, it generates a first prompt message to remind the target user to check the data and remove outliers. If no outliers are found in the input data, the data is fed into a large language model for semantic analysis. The analysis results indicate whether the data contains sensitive information, inappropriate language, or content inconsistent with the expected input. If these issues are present, the semantic analysis results will indicate an anomaly in the input data. When the semantic analysis results indicate an anomaly in the input data, a second prompt message is sent to the target user, informing them that the input data contains inappropriate or potentially security-related content and guiding them to make corrections.

[0056] Ensure users receive prompts and have the opportunity to resubmit corrected data, while recording user responses to these prompts to provide data support for subsequent optimizations. After the input data passes outlier detection and semantic analysis, it is confirmed to be reliable and secure, and can be formally used for processing and prediction in large language models.

[0057] This embodiment ensures the quality of input data and prevents potential security risks by removing outliers and performing semantic analysis of anomalies. It also provides users with timely feedback to help correct errors and improve data accuracy.

[0058] The access list of the business model is updated in a timely manner based on the abnormal access records in the access log. Optionally, in the security detection method of the business model provided in this application embodiment, after detecting the access behavior of the target user in the process of applying the business model and detecting the input data of the target user in the process of applying the business model, the method further includes: if the access behavior or input data fails the detection, the access behavior and input data are recorded in the access log; abnormal access records are extracted from the access log at preset intervals, and the access list of the business model is updated based on the abnormal access records, wherein the access list records the users who are allowed to access the business model.

[0059] In some embodiments, when an access behavior or input data fails detection, detailed information about the access is recorded, including but not limited to the access time, user ID, anomaly type, and anomaly data sample. The abnormal access information is added to the access log to ensure that each abnormal access is recorded in detail for subsequent analysis and auditing. A preset period (e.g., 24 hours, one week, or one month) is defined for periodic review and analysis of the access log. At the end of each period, the system automatically extracts abnormal access records from the access log, including all access events that failed detection. Based on the abnormal access records, the user's historical behavior patterns are evaluated, the access list for the business model is updated, and users who repeatedly trigger anomalies are removed from the access list, restricting their access to the business model. For users who occasionally trigger anomalies, a warning is recorded, and they are educated via the user interface or email about their inappropriate behavior, but their access is temporarily retained.

[0060] This embodiment, by regularly updating the access list, enables the business model to not only respond to abnormal access in real time, but also dynamically adjust the access list through periodic log analysis, thereby building a more secure, reasonable, and user-friendly access environment.

[0061] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0062] Example 2

[0063] This application also provides a security detection device for a business model. It should be noted that this security detection device can be used to execute the security detection method for business models provided in this application. The following describes the security detection device for a business model provided in this application.

[0064] According to an embodiment of this application, an apparatus for implementing the security detection method of the above-described business model is also provided. Figure 3 This is a schematic diagram of a security detection device for a business model provided in an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0065] The first determining unit 301 is used to determine the deployed business model, wherein the business model is trained by a sample dataset consisting of a combination of original sample dataset and adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset.

[0066] The detection unit 302 is used to detect the access behavior of the target user in the process of applying the business model and to detect the input data of the target user in the process of applying the business model when the target user's application request to the business model is detected.

[0067] The second determining unit 303 is used to determine that the target user's current application behavior of the business model is risk-free if both the access behavior and the input data are detected and passed.

[0068] The security detection device for the business model provided in this application embodiment determines the deployed business model through a first determining unit 301. The business model is trained from a sample dataset consisting of an original sample dataset and adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset. The detection unit 302 detects the access behavior and input data of the target user during the application of the business model when a target user's application request to the business model is detected. The second determining unit 303 determines that the target user's current application behavior to the business model is risk-free when both the access behavior and input data are detected. By strengthening the training with adversarial samples, the access behavior and input data during the application of the business model are checked, thereby improving the robustness of the model and preventing illegal input and unauthorized access. This achieves the technical effect of improving the security of the business model during application and solves the technical problem of security risks in the application of the business model.

[0069] Optionally, in the security detection device for the business model provided in this application embodiment, the device further includes: a verification unit for verifying whether the account and password entered by the target user are correct; a third determination unit for determining that the target user's authentication has failed if the account or password is incorrect; a first judgment unit for determining whether the target user has access to the business model if the account and password are correct; a fourth determination unit for determining that the target user's authentication has failed if the target user does not have access to the business model; and a fifth determination unit for determining that the target user's authentication has passed if the target user has access to the business model.

[0070] Optionally, in the security detection device for the business model provided in this application embodiment, the detection unit 302 includes: a detection module, used to detect whether the target user exhibits abnormal behavior during the application of the business model, wherein the abnormal behavior includes at least one of the following: the frequency of input data is greater than or equal to a first input data frequency threshold, and the frequency of data modification is greater than or equal to a first data modification frequency threshold; a first determination module, used to determine that the access behavior detection fails when the target user exhibits abnormal behavior during the application of the business model; and a second determination module, used to determine that the access behavior detection passes when the target user does not exhibit abnormal behavior during the application of the business model.

[0071] Optionally, in the security detection device for the business model provided in this application embodiment, the device further includes: a second judgment unit, used to judge whether the frequency of input data is greater than or equal to a second input data frequency threshold, or whether the frequency of data modification is greater than or equal to a second data modification frequency threshold; a first alarm unit, used to issue a first alarm message when the frequency of input data is less than the second input data frequency threshold and the frequency of data modification is less than the second data modification frequency threshold, wherein the first alarm message is used to instruct the administrator to call a backup business model to provide services to the target user; and a second alarm unit, used to issue a second alarm message when the frequency of input data is greater than or equal to the second input data frequency threshold, or when the frequency of data modification is greater than or equal to the second data modification frequency threshold, wherein the second alarm message is used to instruct the administrator to suspend processing the application request of the target user.

[0072] Optionally, in the security detection device for the business model provided in this application embodiment, the detection unit 302 includes: a third determining module, used to determine the format and data type of the input data, determine whether the format is a preset format, and determine whether the data type is a preset type; a fourth determining module, used to determine that the input data detection fails when the format is not a preset format or the data type is not a preset type; and a fifth determining module, used to determine that the input data detection passes when the format is a preset format and the data type is a preset type.

[0073] Optionally, in the security detection device for the business model provided in this application embodiment, the device further includes: a first prompting unit, configured to detect outliers in the input data using an outlier detection algorithm, and issue a first prompting message when an outlier exists in the input data, wherein the first prompting message is used to prompt the target user to remove the outlier from the input data; an input unit, configured to input the input data into a large language model for semantic analysis when no outliers exist in the input data, and obtain a semantic analysis result; and a second prompting unit, configured to issue a second prompting message when the semantic analysis result indicates that an outlier exists in the input data, wherein the second prompting message is used to prompt the target user that an outlier exists in the input data.

[0074] Optionally, in the security detection device for the business model provided in this application embodiment, the device further includes: a recording unit, used to record the access behavior and input data through the access log when the access behavior or input data fails detection; and an extraction unit, used to extract abnormal access records from the access log every preset period and update the access list of the business model based on the abnormal access records, wherein the access list records users who are allowed to access the business model.

[0075] It should be noted that the first determining unit 301, the detection unit 302, and the second determining unit 303 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0076] Example 3

[0077] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0078] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0079] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: determine the deployed business model, wherein the business model is trained from a sample dataset consisting of a combination of original sample datasets and adversarial samples, and the adversarial samples are generated by an adversarial sample generation algorithm and the original sample dataset; upon detecting a target user's application request to the business model, detect the target user's access behavior during the application of the business model, and detect the input data during the application of the business model; if both the access behavior and the input data pass the detection, determine that the target user's current application behavior to the business model is risk-free.

[0080] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: verifying whether the account and password entered by the target user are correct; determining that the target user's authentication has failed if the account or password is incorrect; determining whether the target user has access to the business model if the account and password are correct; determining that the target user's authentication has failed if the target user does not have access to the business model; and determining that the target user's authentication has passed if the target user has access to the business model.

[0081] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: detecting whether the target user exhibits abnormal behavior during the application business model, wherein the abnormal behavior includes at least one of the following: the frequency of input data is greater than or equal to a first input data frequency threshold, and the frequency of data modification is greater than or equal to a first data modification frequency threshold; if the target user exhibits abnormal behavior during the application business model, determining that the access behavior detection fails; if the target user does not exhibit abnormal behavior during the application business model, determining that the access behavior detection passes.

[0082] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: determining whether the frequency of input data is greater than or equal to a second input data frequency threshold, or the frequency of data modification is greater than or equal to a second data modification frequency threshold; issuing a first alarm message if the frequency of input data is less than the second input data frequency threshold and the frequency of data modification is less than the second data modification frequency threshold, wherein the first alarm message is used to instruct the administrator to call a backup service model to provide services to the target user; issuing a second alarm message if the frequency of input data is greater than or equal to the second input data frequency threshold, or the frequency of data modification is greater than or equal to the second data modification frequency threshold, wherein the second alarm message is used to instruct the administrator to suspend processing the application requests of the target user.

[0083] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the format and data type of the input data, determine whether the format is a preset format, and determine whether the data type is a preset type; if the format is not a preset format, or the data type is not a preset type, determine that the input data detection fails; if the format is a preset format and the data type is a preset type, determine that the input data detection passes.

[0084] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: detecting outliers in the input data using an outlier detection algorithm; issuing a first prompt message if an outlier is found in the input data, wherein the first prompt message is used to prompt the target user to remove the outlier from the input data; inputting the input data into a large language model for semantic analysis if no outlier is found in the input data, obtaining the semantic analysis result; and issuing a second prompt message if the semantic analysis result indicates that an outlier exists in the input data, wherein the second prompt message is used to prompt the target user that an outlier exists in the input data.

[0085] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the access behavior or input data fails the detection, record the access behavior and input data through the access log; extract abnormal access records from the access log at preset intervals, and update the access list of the business model based on the abnormal access records, wherein the access list records the users who are allowed to access the business model.

[0086] This application provides a method for determining a deployed business model. The business model is trained using a sample dataset combining original and adversarial samples. The adversarial samples are generated using an adversarial sample generation algorithm and the original sample dataset. Upon detecting a target user's application request to the business model, the application detects the target user's access behavior and input data during the application process. If both the access behavior and input data pass detection, the application is deemed risk-free. By reinforcing the model with adversarial samples and checking the access behavior and input data during the application process, the robustness of the model is improved, preventing illegal input and unauthorized access. This enhances the security of the business model during application, thus addressing the technical problem of security risks associated with business models during application.

[0087] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0088] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0089] Example 4

[0090] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the security detection method of the business model provided in Embodiment 1.

[0091] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0092] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing security detection method steps of a business model.

[0093] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0094] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0096] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0098] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0099] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A security detection method of a business model, characterized by, The method comprises the following steps: determining a deployed business model, wherein the business model is trained by a combination of an original sample data set and an adversarial sample, and the adversarial sample is generated by an adversarial sample generation algorithm and the original sample data set; detecting access behavior in the process of applying the business model to a target user and detecting input data in the process of applying the business model to the target user when a request for applying the business model to the target user is detected; determining that the current application behavior of the target user to the business model is risk-free when both the access behavior and the input data are detected to be passed.

2. The method of claim 1, wherein, Before detecting the access behavior in the process of applying the business model to the target user, the method further comprises the following steps: verifying whether the account and password input by the target user are correct; determining that the identity verification of the target user fails when the account or the password input is incorrect; judging whether the target user has access rights to the business model when the account and the password input are correct; determining that the identity verification of the target user fails when the target user does not have access rights to the business model; determining that the identity verification of the target user passes when the target user has access rights to the business model.

3. The method of claim 1, wherein, Detecting the access behavior in the process of applying the business model to the target user comprises the following steps: detecting whether there is abnormal behavior during the application of the business model by the target user, wherein the abnormal behavior comprises at least one of the following: the frequency of input data is greater than or equal to a first input data frequency threshold, and the frequency of changed data is greater than or equal to a first changed data frequency threshold; determining that the access behavior detection fails when the target user has the abnormal behavior during the application of the business model; determining that the access behavior detection passes when the target user does not have the abnormal behavior during the application of the business model.

4. The method of claim 3, wherein, After determining that the access behavior detection fails, the method further comprises the following steps: judging whether the frequency of the input data is greater than or equal to a second input data frequency threshold, or the frequency of the changed data is greater than or equal to a second changed data frequency threshold; issuing a first alarm information when the frequency of the input data is less than the second input data frequency threshold and the frequency of the changed data is less than the second changed data frequency threshold, wherein the first alarm information is used to instruct an administrator to call a backup business model to provide services to the target user; issuing a second alarm information when the frequency of the input data is greater than or equal to the second input data frequency threshold, or the frequency of the changed data is greater than or equal to the second changed data frequency threshold, wherein the second alarm information is used to instruct an administrator to suspend processing the application request of the target user.

5. The method of claim 1, wherein, Detecting the input data in the process of applying the business model to the target user comprises the following steps: determining a format and a data type of the input data, judging whether the format is a preset format and whether the data type is a preset type; in a case where the format is not the preset format or the data type is not the preset type, determining that the input data fails the detection; in a case where the format is the preset format and the data type is the preset type, determining that the input data passes the detection.

6. The method of claim 5, wherein, After determining that the input data passes the detection, the method further comprises: detecting an abnormal value of the input data by an abnormal value detection algorithm, and in a case where the abnormal value exists in the input data, issuing a first prompt information, wherein the first prompt information is used to prompt the target user to exclude the abnormal value from the input data; in a case where the abnormal value does not exist in the input data, inputting the input data into a large language model for semantic analysis to obtain a semantic analysis result; in a case where the semantic analysis result indicates that there is an abnormality in the input data, issuing a second prompt information, wherein the second prompt information is used to prompt the target user that there is an abnormality in the input data.

7. The method of claim 1, wherein, After detecting the access behavior in the process of applying the business model by the target user and detecting the input data in the process of applying the business model by the target user, the method further comprises: in a case where the access behavior or the input data fails the detection, recording the access behavior and the input data by an access log; extracting abnormal access records in the access log every preset period, and updating an access list of the business model based on the abnormal access records, wherein the access list records users allowed to access the business model.

8. A security detection apparatus of a service model, characterized by, comprise: a first determination unit configured to determine a deployed business model, wherein the business model is trained by a combined sample data set of original sample data set and adversarial sample, and the adversarial sample is generated by an adversarial sample generation algorithm and the original sample data set; a detection unit configured to, in a case where a request for applying the business model by a target user is detected, detect an access behavior in a process of applying the business model by the target user, and detect input data in the process of applying the business model by the target user; a second determination unit configured to, in a case where the access behavior and the input data both pass the detection, determine that a current application behavior of the target user on the business model is risk-free.

9. An electronic device, comprising: comprise: a memory storing an executable program; a processor configured to run the program, wherein the program performs the safety detection method of the business model in any one of claims 1 to 7 when running.

10. A computer program product comprising computer instructions, characterized in that, The computer instructions are executed by the processor to implement the steps of the safety detection method of the business model in any one of claims 1 to 7.

Images