URL (Uniform Resource Locator) security analysis method and device for browser-side large language model and medium

Abstract

The invention discloses a URL (Uniform Resource Locator) security analysis method and device for a browser-side large language model and a medium, and relates to a network information security technology, the method comprises the following steps: determining a session-level security contract based on terminal performance and user preference; page static scripts, dynamic behaviors, network requests and text information are collected and packaged into a unified evidence unit, and an attack causal graph is constructed; based on the risk ontology and the rule atom library, mapping the evidence into basic probability distribution for the hypothesis set, and generating evidence constraints; under the constraint of a session contract, performing multiple rounds of attack and defense games on a causal graph through a defense agent and an attack simulation agent which are realized by an end-side large language model; calculating a session risk value through a risk quantification model on the basis of a game result in combination with scores fused by a D-S evidence theory and subjected to multi-prompt LLM conjunctive calibration, and making a decision according to a self-adaptive threshold value; and high-confidence, explainable and sustainable-evolution end-side URL security analysis in an off-network environment is realized.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, specifically to a method, apparatus, and medium for URL security analysis of a large language model on the browser side. Background Technology

[0002] With the widespread adoption of web applications and cloud services, URL-based network access has become a primary entry point for various attacks. Current security detection solutions largely rely on single or combined methods such as static feature matching, dynamic behavior monitoring, or text / image content recognition, but they still have the following significant limitations: First, security evidence from different sources (such as code structure, behavior sequence, page content, etc.) varies in form and quality, and lacks a unified representation model and fusion framework, making it difficult to form robust and interpretable judgments when evidence conflicts.

[0003] Secondly, most existing edge detection solutions rely on lightweight heuristic rules or require real-time calls to cloud models for inference. They cannot independently complete high-confidence security analysis in offline, weak network, or privacy-restricted environments, and often lack the ability to interpret the judgment results.

[0004] Furthermore, although large language models have begun to be used for content-safe understanding, reasoning results under single prompts are prone to topic drift or logical inconsistencies, and lack effective calibration and co-verification mechanisms with existing structured evidence within the system.

[0005] Therefore, there is an urgent need for a client-side URL security analysis solution that can be fully implemented locally in the browser, with evidence standardization, fusion, calibration, and interpretability forming a closed loop, and works in conjunction with a multi-prompt large language model, so as to achieve reliable, transparent, and adaptive security protection without cloud dependence. Summary of the Invention

[0006] This invention aims to solve the problem of unified modeling and quantitative fusion of multi-source heterogeneous evidence such as static code features, dynamic behavior sequences and page text semantics on the browser side. It also achieves high-confidence, interpretable and adaptive URL security determination by using multi-cue collaborative reasoning with the client-side large language model for calibration and decision optimization, thereby completely freeing it from the constraints of cloud services.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A method for URL security analysis of a large language model on the browser side includes the following steps: The session-level security contract is determined based on the terminal device performance parameters and user risk preferences. The session-level security contract includes: an upper bound on session risk. Session detection budget and session resource budget ; Collect page behavior information related to the target URL, encapsulate the page behavior information into evidence units with a unified data structure, and construct an attack causal graph; Based on the attack causal graph, and combined with the risk ontology and rule atomic library, the evidence unit is mapped to the basic probability assignment of the hypothesis set, and the evidence constraint set is generated. Under the constraints of the session contract, the system security status is evaluated by conducting multiple rounds of attack and defense game on the attack causality graph through the defense agent and the attack simulation agent; Based on the game results, combined with the evidence synthesis output and risk quantification model, the session risk value is calculated, and a graded security decision is made according to the preset threshold. The system dynamically adjusts the evidence quality weights and proxy decision-making strategies based on user feedback to achieve local adaptive optimization.

[0008] Furthermore, the page behavior information includes at least: Static script information, including script files, abstract syntax tree nodes, and sensitive API calls; Dynamic behavior information, including DOM structure changes, pop-up creation, redirection, and timer callbacks; Network request information, including requests to third-party domains, cross-origin resource loading, and file download behavior; Visual text information on the page; Semantic analysis results output by the edge-side large language model; The attack causal graph is constructed in the form of a directed graph G=(V,E), where, The node V in the attack causal graph includes: An identity node indicating login status, session token status, or authorization status; Resource nodes that indicate the access status of local resources such as clipboard, file system, camera, and microphone; External nodes that represent external domain names, IP addresses, or download targets; This refers to a business node on a key business page or payment page. Edge E records the state transition relationships caused by script execution, network requests, or user interactions.

[0009] Furthermore, the evidence unit includes a source field, observation key-value pairs, a quality score, a timestamp, and a visual anchor. The source field identifies that the evidence originates from static code, dynamic behavior, page text, or the output of a large language model. The quality score is calculated using different methods depending on the evidence source type. The visual anchor is used to locate specific lines of code, DOM elements, text fragments, or network request endpoints. The quality score of the evidence unit is calculated as follows: The quality score of static code evidence = AST completeness × path credibility; The quality score of dynamic behavioral evidence = Hook coverage rate × Hit rate; The quality score of the page text evidence = OCR confidence level × character restoration rate; The quality score of the evidence output by the large language model equals the completeness of the structured output; In the aforementioned risk ontology and rule atomic library: The rule atom contains the fields id, pattern, weight, threshold, version, and notes, where the value of weight ranges from [0,2] and the value of threshold ranges from [0,1]. The risk ontology maintains the mapping relationship between the four types of phishing websites, malware, data leakage, and benign pages and the rule atoms in the assumption set; The pattern supports AST, DOM, string or behavior graph matching expression, and calculates the basic probability allocation of various hypotheses by multiplying the evidence source coefficient, evidence quality score and rule atomic pattern matching degree. The remaining probabilities are assigned to the unknown set and then normalized.

[0010] Furthermore, before or during the execution of the attack and defense game, the basic probability assignments obtained by the mapping of evidence units are synthesized using the DS evidence theory in a two-level evidence synthesis. First, the basic probability assignments within the same source are synthesized, and then the synthesis results across sources are synthesized a second time to obtain the global belief function and likelihood function and output the candidate type score. When the conflict factor exceeds a preset threshold during the synthesis process, a conflict suppression mechanism is triggered. All evidence units currently participating in the synthesis are sorted in ascending order according to their quality scores, and the evidence unit with the lowest quality score is removed to form a new evidence set. The DS evidence theory synthesis is then performed again based on the new evidence set.

[0011] Furthermore, each evidence item in the evidence constraint set includes the evidence source type, the corresponding node or edge identifier, the quality weight, and a constraint condition expressed in a logical expression; the constraint condition is used to limit the allowed or prohibited behavioral patterns on the attack causal graph. Furthermore, before calculating the session risk value based on the game results combined with the evidence synthesis output and the risk quantification model, the method further includes a step of multi-model deliberation and calibration of the candidate type scores, specifically including: Multi-cue deliberation steps: Construct at least three parallel cues with different focuses, perform collaborative reasoning on the edge large language model, and generate structured semantic evidence; Calculate the consistency measure C of the multi-cue inference results: C = 0.5 × (1 - JSD(type)) + 0.5 × cosSim(explanation), Where: JSD(type) is the Jensen-Shannon divergence of the type label of each parallel prompt output, and cosSim(explanation) is the cosine similarity of the explanatory text field of each parallel prompt output; when the consistency metric C is lower than the preset threshold γ, the candidate type score is multiplied by the reduction factor η and the handling level is downgraded from interception to warning or release, with a value range of [0.5, 0.8]. Confidence calibration step: Obtain the candidate type score vector after processing by the multi-hint deliberation step; Divide each element of the candidate type score vector by the temperature parameter T to obtain the scaled score vector. ; the scaled fraction vector The calibrated probability scores for each hypothesis type are obtained by normalizing the data using the Softmax function. Adaptive threshold strategy: A validation set containing both white and black samples is continuously collected and maintained locally, with a time window of a preset number of days. Based on this validation set, the accuracy P and the overall false positive rate FPR at the current interception threshold are periodically calculated. With the constraints of simultaneously meeting preset accuracy and false alarm rate targets, and based on the statistical quantiles of the calibrated scores of black and white samples in the validation set, the values ​​of the interception threshold and warning threshold are calculated and determined using a quantile matching algorithm. Furthermore, under the constraints of the session contract, the evaluation of the system security status involves multiple rounds of attack-defense game between the defense agent and the attack simulation agent on the attack causality graph, including: Maintain defense agent D and attack simulation agent A locally on the terminal; The defense agent D, based on the current attack causality graph state, the evidence constraint set, and the session-level security contract, selects to instrument observations, add log entries, or set blocking points on some nodes or edges of the attack causality graph, consuming the session detection budget. With session resource budget ; Under the premise of satisfying the evidence constraint set, the attack simulation agent A searches for feasible attack paths from the entry node to the target sensitive resource node on the attack causal graph, and proposes candidate attack paths in each game round. The defensive agent D and the attack simulation agent A engage in a finite-round attack-defense game on the attack causality graph in a turn-based manner. When the session detection budget... and session resource budget If the game is not exhausted and the number of rounds has not reached the preset limit, the iteration continues; otherwise, the game is terminated. Wherein, at least one of the defense agent D and / or the attack simulation agent A is implemented by a client-side large language model deployed locally in the browser; The process of calculating session risk values ​​based on game results, evidence synthesis output, and risk quantification models, and making tiered security decisions based on preset thresholds, includes: When the attack-defense game ends, if the attack simulation agent A is in the session detection budget Session resource budget Given the evidence constraint set, if no successful attack path from the entry node to the target sensitive resource node can be constructed, then the current browsing session is deemed to satisfy the session-level security contract, and the session risk value is output as not exceeding the upper bound of the session risk. Safety conclusions; If the attack simulation agent A constructs at least one successful attack path under the above conditions, the session risk value R is calculated based on the node risk weight, edge risk weight, and path length on the attack path. Relate the session risk value R to the upper bound of the session risk. Compare the data and choose a decision action based on the comparison results: block access, display a warning, or allow access. The decision-making action is corrected by combining the candidate type scores generated by evidence synthesis and deliberation by the edge-side large language model.

[0012] Furthermore, the local feedback loop and policy update include: When a user confirms an attack, increase the quality weight of evidence items related to that browsing session and enhance the blocking tendency of the defense agent D on the same or similar attack causal graph structure; When a user flags a false alarm, reduce the quality weight of evidence items related to that browsing session and decrease the blocking frequency of the defense agent D in the same or similar context; Before performing statistical analysis on the local feedback cache and using it to update defense or attack strategies, differential privacy noise is applied to the count or probability values ​​in the feedback data. When a user selects to enable the cloud-based collaborative optimization mode, only statistical parameters processed with differential privacy are uploaded, without uploading specific URLs, page content, or attack causal graph structures.

[0013] A browser-side URL security analysis device for large language models includes: Including memory and processor; The memory stores computer programs; When the processor executes the computer program, it performs the functions of the following modules: The session contract management module is used to determine session-level security contracts based on terminal device performance parameters and user risk preferences. The cause-effect graph and evidence collection module is used to collect page behavior information related to the target URL, encapsulate the information into evidence units with a unified data structure, and construct an attack cause-effect graph. The evidence constraint generation module is used to map evidence units to basic probability assignments of the hypothesis set based on the attack causal graph, combined with the risk ontology and rule atom library, and generate an evidence constraint set. The dual-agent game module is used to evaluate the system security status by having a defense agent and an attack simulation agent engage in multiple rounds of attack and defense game on the attack causality graph under the constraints of the session contract. The risk decision module is used to calculate the session risk value based on the output of the game module, combined with the evidence synthesis and risk quantification results, and make a graded security decision according to a preset threshold. The local optimization module is used to dynamically adjust the evidence quality weight and proxy decision-making strategy based on user feedback, thereby achieving local adaptive optimization.

[0014] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0015] Compared with the prior art, the beneficial effects achieved by the present invention are: Compared to existing technologies, this invention constructs a browser-localized "evidence collection-fusion-game-decision-optimization" closed-loop system, achieving high-confidence and highly interpretable URL security analysis without cloud dependence. The system uses session-level security contracts to adaptively regulate resource and risk perception, accurately models page behavior and state transitions through attack causal graphs, and actively infers potential attack paths using a dual-agent attack-defense game, significantly improving the detection sensitivity and assessment accuracy of complex and hidden threats. At the decision-making core, it employs DS evidence theory to fuse multi-source heterogeneous evidence, combined with conflict suppression mechanisms to ensure robust conclusions even in noisy environments. It introduces multi-cue large language model deliberation and consistency verification to effectively suppress single-model inference drift. Furthermore, through temperature-based placement confidence calibration and a statistically-based adaptive threshold strategy, it maintains high detection accuracy while keeping the false alarm rate extremely low. In addition, relying on local feedback closed-loop and differential privacy protection technology, the system can continuously optimize evidence weights and proxy strategies based on user feedback without uploading specific page content, achieving personalized adaptive evolution of privacy and security, forming an autonomous and continuously enhanced security protection capability on the client side. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0017] Figure 1 This is the overall flowchart of the system of the present invention; Figure 2 This is a schematic diagram of the confidence calibration curve provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 To implement the technical solution of this invention, a corresponding execution environment needs to be configured on the browser side. In this invention, the large language model specifically refers to an optimized autoregressive language model that is deployed and run locally on the user's browser. This method is implemented within the browser environment of the user's terminal, specifically deployed in a same-origin sandbox iframe or browser extension / Service Worker environment. The page and the sandbox communicate through the postMessage channel. This design ensures the isolation between the analysis process and the main page environment. All outgoing network requests are first intercepted by the Service Worker and subjected to security auditing, effectively preventing data leakage. The client-side large language model runs in a WebAssembly / WebGPU environment. On devices without GPU support, it uses int4 / ggml quantization technology to run on the CPU. This design ensures complete independence from cloud inference services and supports use in offline environments.

[0020] Furthermore, in order to achieve effective management of multi-source evidence, a standardized evidence collection and processing procedure needs to be established in this embodiment. The system continuously collects multi-source behavioral information from the target URL page and encapsulates it into a unified evidence unit e = {src, key, value, quality, ts, anchor, meta}. Here, src identifies the source of the evidence (static code, dynamic behavior, page text, or LLM output), key / value pairs are specific observations, quality is the quality score based on the source, ts is the timestamp, anchor is the visual location point (such as a line of code, DOM selector, text fragment, or network endpoint), and meta is auxiliary metadata. This unified data structure lays the foundation for subsequent evidence fusion.

[0021] In terms of evidence quality assessment, differentiated calculation methods are used for different types of evidence; The quality score of static code evidence is calculated by multiplying AST completeness and path credibility. AST completeness is evaluated based on the success rate of syntax tree construction and node coverage, while path credibility considers the analysis depth and source reliability of the code path. The quality score of dynamic behavior evidence is determined by multiplying Hook coverage and hit rate. Hook coverage reflects the completeness of the monitored API interfaces, while the hit rate reflects the effectiveness of monitoring. The quality score of page text evidence combines OCR confidence and character restoration rate, specifically optimized for the characteristics of web page text. The quality score of LLM output evidence is evaluated based on the completeness and logical consistency of the structured output.

[0022] In this embodiment, based on the collected continuous behavior sequence, the system dynamically constructs an attack causal graph G=(V, E), where nodes (V) represent key page states, including identity nodes representing login / token states, resource nodes representing access states of local resources (such as clipboard, camera), external nodes representing external domain names or download targets, and business nodes representing key pages such as payment; edges (E) represent transitions between states, triggered by specific script execution, network requests, or user interaction behaviors.

[0023] Furthermore, in this embodiment, regarding the construction of the risk knowledge base, in order to achieve automation and interpretability from evidence to risk determination, the system constructs a structured risk knowledge base. This knowledge base adopts a two-layer structure of rule atoms and risk ontology, is stored and distributed in JSON format, and supports offline updates and signature verification. Specifically, it includes: A rule atom is the smallest logical unit in a knowledge base, used to describe a specific, observable pattern of malicious evidence. Each rule atom contains the following fields: id (string): A unique identifier for the rule, such as "hidden_iframe_login"; pattern (object): Defines the matching pattern for evidence, supporting multiple expression methods: AST pattern: used to match specific code structures in an abstract syntax tree; DOM mode: used to match specific elements and their attributes in the Document Object Model; String pattern: Text matching based on regular expressions or keywords; Behavioral graph patterns: used to describe a series of ordered API call or network request behaviors; weight (numerical value): Weight coefficient, with a value range of [0, 2], representing the support strength of this rule atom for the mapped risk type; the default value is 1.0, greater than 1.0 indicates strong support, and less than 1.0 indicates weak support; threshold (numerical value): The decision threshold, ranging from [0, 1]; the rule will only be activated if the matching degree s(pattern, e) between the evidence and the rule is not lower than this threshold; version (string): Rule version number, used for subsequent updates and tracking; notes (string): Explanatory notes that describe the intent and use case of the rule; The risk ontology layer is responsible for organizing and classifying rule atoms. It defines four core malicious hypothesis types and attaches (maps) related rule atoms to the corresponding types, forming a complete threat classification system: Phishing (phishing websites): Mapping is a set of rule atoms designed to detect identity spoofing and credential theft, such as: Brand impersonation; Credentials collection (credential_harvesting); Hide the login dialog box (hidden_iframe_login); Malware: Mappings are rule atoms designed to detect malicious code execution or system destructive behavior, for example: Self-decoding execution; Code obfuscation chain; Dangerous API dynamic calls; exfil (data leakage): Mappings are rules atoms designed to detect the unauthorized outflow of sensitive data, for example: Cross-domain POST request. WebSocket bulk reporting (websocket_bulk_reporting); Local storage exfiltration. benign (benign page): Used as a benchmark. Rule atoms are typically not actively attached to this category; the determination is based on a lack of evidence of malicious intent or inference through specific whitelist rules.

[0024] Using this knowledge base, the system maps each evidence unit to a basic probability assignment (BPA) for the four types of hypotheses mentioned above. The mapping calculation comprehensively considers the inherent weight coefficients of the evidence source (e.g., dynamic behavior evidence has a weight of 1.0, and static code has a weight of 0.9), the quality score of the evidence itself, and the matching degree between the evidence and the atomic pattern of the rule. After the calculation is completed, normalization is performed, and the remaining probability is assigned to the "unknown" set. At the same time, an evidence item is generated for each security-related observation, which contains constraints defined by logical expressions. All evidence items constitute an evidence constraint set, which is used to limit the allowed or prohibited behavioral patterns on the attack causal graph in subsequent games.

[0025] Furthermore, in this embodiment, to achieve the mapping from evidence to risk assessment, the system employs the Basic Probability Allocation (BPA) method; during the BPA calculation process, the system uses the formula... (h) = × quality× s(pattern,e) maps each unit of evidence to a basic probability assignment for each type in the hypothesis set. The specific definitions and calculation methods of the parameters in this formula are as follows: : Evidence source weighting coefficient, an empirical weight value set based on the type of evidence source; this coefficient reflects the inherent reliability differences of different evidence sources, and its specific value is: static (static code evidence) is 0.9; dynamic (dynamic behavior evidence) is 1.0; text (page text evidence) is 0.8; llm (large language model output evidence) is 0.7; These weight values ​​are based on extensive experimental verification. Dynamic behavioral evidence is given the highest weight because it directly reflects actual operational behavior, followed by static code evidence. Textual evidence is given a slightly lower weight due to its OCR accuracy, while LLM output has the lowest weight due to the possibility of illusion problems.

[0026] quality: Evidence quality score, ranging from [0,1], calculated using different methods depending on the type of evidence source. Static code evidence: AST completeness × path credibility; Dynamic behavioral evidence: Hook coverage × hit rate; Page text evidence: OCR confidence level × font restoration rate; LLM output evidence: Structured output completeness; s(pattern,e): Rule pattern matching degree, ranging from [0,1], representing the degree of matching between the rule atomic pattern and the evidence observation; calculation methods include: For string patterns: use edit distance similarity or regular expression matching degree; For DOM mode: calculation is based on a combination of selector matching degree and attribute matching degree; For AST patterns: consider syntactic structure similarity and node matching degree; For behavioral graph patterns: assessment of the completeness of matching based on behavioral sequences; After completing the basic probability allocation calculation, the system performs residual probability allocation and normalization processing. The specific steps are as follows: Calculate the probability assignment of the unknown set Θ: (Θ) = 1 - Σ[ [(h)], where h ∈ {phishing, malware, exfil,benign}; This value represents the degree of uncertainty that the current evidence cannot distinguish between different types of hypotheses.

[0027] The normalization process is as follows: If Σ[ (h)] + If (Θ) > 1, then normalize all probability assignments: '(h) = (h) / [Σ[ (h)] + (Θ)]; '(Θ) = (Θ) / [Σ[ [(h)] + m_i(Θ)]; The integrity of the verification probability is as follows: Ensure that the normalized probability satisfies: Σ[ '(h)] + '(Θ) = 1; The calculation example is as follows: Suppose that the quality score of a certain static code evidence is quality=0.8, and the matching degree s(pattern,e) with a certain malware rule is 0.6, then: (malware) = × quality × s(pattern,e) = 0.9 × 0.8 × 0.6= 0.432; Assuming the sum of the basic probability assignments of this evidence to other hypothesis types is 0.3, then: (Θ) = 1 - (0.432 + 0.3) = 0.268; After normalization, the final basic probability distribution is: '(malware) = 0.432 / (0.432 + 0.3 + 0.268) = 0.432; '(Θ) = 0.268 / 1.0 = 0.268; This calculation method ensures the rationality and completeness of the probability distribution, providing reliable input for subsequent evidence synthesis.

[0028] Furthermore, in this embodiment, before executing the attack-defense game, the system uses Dempster-Shafer evidence theory to perform two-level evidence synthesis on the multiple basic probability assignments generated by the mapping. The specific implementation process is as follows: Level 1: Synthesis of Evidence from the Same Source: First, multiple pieces of evidence from the same source are synthesized to eliminate conflicts within the source. For multiple pieces of evidence from the same source, Dempster's combination rule is used for pairwise synthesis. This rule calculates the combination of the basic probability assignments of the two pieces of evidence to each subset of hypotheses and normalizes them using a conflict factor. The synthesis order is based on the time stamps of the evidence collection. First, two pieces of evidence with adjacent times are synthesized. Then, the synthesis result is synthesized with the next piece of evidence until all evidence from the source is synthesized. Each source ultimately yields a synthesized basic probability assignment function.

[0029] Level 2: Cross-source evidence synthesis: The synthesis results from different evidence sources are synthesized in a secondary manner; the synthesis results from the four sources of static, dynamic, text, and LLM are synthesized across sources using the same Dempster combination rule to obtain the global basic probability allocation function; during the synthesis process, the system calculates the global conflict factor in real time, which reflects the overall degree of conflict between evidence from different sources.

[0030] The specific implementation of the conflict suppression mechanism is as follows: When the global conflict factor is detected to exceed 0.6, the system triggers the conflict suppression mechanism and executes the following steps: Evidence quality assessment and ranking: Collect all evidence units currently involved in the synthesis, extract the quality score of each evidence unit, and rank them from low to high quality scores; Low-quality evidence removal: Calculate the number of pieces of evidence to be removed, with a minimum of 1 and a maximum of 10% of the total number of pieces of evidence to be removed. Remove the corresponding number of evidence units with the lowest quality scores from the sorting list to form a new set of evidence. Re-synthesis verification: Based on the new evidence set, re-execute the two-level evidence synthesis and calculate the new global conflict factor; if the new conflict factor does not exceed 0.6, the new synthesis result is accepted; if it still exceeds 0.6 and the cumulative elimination ratio does not exceed 20%, the above elimination and synthesis process is repeated; if the conflict factor still exceeds 0.6 after 3 consecutive eliminations, a conservative strategy is adopted, and only the top 50% of the evidence in terms of quality score is retained for the final synthesis.

[0031] After conflict suppression processing, the system outputs the following results: Global belief function: represents the minimum level of support for each hypothesis type; Global likelihood function: represents the maximum possible support for each hypothesis type; Candidate type score: The value of the corresponding single type in the belief function is taken as the candidate score for each type; Through this hierarchical synthesis and conflict suppression mechanism, the system can automatically eliminate low-quality evidence when there is a conflict, ensuring the robustness and reliability of the final decision.

[0032] Furthermore, in order to improve the reliability of LLM inference, this embodiment adopts a multi-prompt deliberation mechanism; by constructing three different emphases of prompts—comprehensive evaluation, phishing-specific, and code auditing—parallel inference is performed on the large language model on the edge side. The consistency of multi-cue results is evaluated using the consistency metric formula C = 0.5 × (1 - JSD(type)) + 0.5 × cosSim(explanation). When the consistency falls below a threshold, candidate scores are reduced and their rankings are downgraded. This method effectively suppresses the model illusion problem under single-cue conditions. The specific implementation is as follows: 1. Parallel prompting construction and execution The system simultaneously constructs and executes three prompt templates with different professional focuses: P1 Comprehensive Assessment Tips: Role description: "You are a professional security analyst who needs to analyze the potential risks of URLs from a holistic perspective." Output requirements: Strictly adhere to JSON format and include the following fields: type: Risk type (phishing / malware / exfil / benign); conf: Confidence level (a value between 0 and 1); evidences: An array describing key evidence; advice: suggestions for handling the situation; anchors: An array of evidence location anchors; P2 Fishing Tips: Character Setting: "You are a security expert specializing in phishing detection, paying particular attention to the following characteristics:" Specialized testing sites: Misuse of brand names (such as "Alipay", "Industrial and Commercial Bank of China", etc.); Detection of login form submissions from foreign domains; Analysis of the degree of visual imitation on the page; Use emergency rhetoric to induce responses (such as "your account is about to be frozen"). P3 code audit notes: Role description: "You are a code security auditor, specializing in analyzing the following malicious code patterns:" Audit focus: Dangerous API call chains (eval→Function→atob, etc.); Code obfuscation feature identification; Data collection and leakage risks; Dynamic code execution traces; The three hints are executed in parallel on the same end-side LLM instance, with a maximum of 256 tokens generated and an inference timeout of 2 seconds.

[0033] 2. Structured Output Parsing and Validation The system performs rigorous structured validation on the output of each prompt: JSON Schema Validation: Checks whether the output conforms to the predefined JSON format specification; Field integrity check: Ensure that required fields such as type, conf, and evidences exist; Numeric range validation: The conf field must be in the range [0,1]. Type enumeration validation: The type field must be one of four preset risk types; For outputs that do not conform to the schema, the system automatically marks the result as invalid and excludes it from subsequent consistency calculations.

[0034] 3. Consistency metric calculation The system calculates the consistency of multi-prompt results through the following steps: Type distribution consistency calculation: Extract the risk types from the three valid prompts and construct a type distribution vector; Calculate the Jensen-Shannon divergence (JSD) among the three distributions; The smaller the JSD value, the more consistent the type judgment; Explanation of text similarity calculation: Combine the evidences arrays from the three prompts into a complete explanatory text; Use edge-side text embedding models (such as MiniLM) to generate text vectors; Calculate the cosine similarity among three text vectors; The average of the three similarity values ​​is taken as the final text similarity score; Overall consistency score: C = 0.5 × (1 - JSD(type)) + 0.5 × cosSim(explanation) in: JSD(type) ∈ [0,1], is 0 when they are completely consistent, and is 1 when they are completely inconsistent; cosSim(explanation) ∈ [0,1], is 1 when they are completely similar and 0 when they are completely dissimilar; C ∈ [0,1], is 1 when completely consistent, and 0 when completely inconsistent; 4. Consistent handling strategy Different handling strategies are adopted based on the consistency score C: High consistency (C ≥ 0.8): The LLM consensus result is directly adopted, and the confidence level remains unchanged; Neutral consistency (0.6 ≤ C < 0.8): Slightly reduce candidate scores (×0.95); Low consistency (0.4 ≤ C < 0.6): Candidate scores are significantly reduced (×0.9); The handling level will be automatically downgraded (interception → warning, warning → release). Trigger a resampling inference; Extremely low consistency (C < 0.4): Candidate scores are severely reduced (×0.8); The handling level was forcibly downgraded to "release"; The report noted "Serious disagreements in the LLM consensus, manual review recommended".

[0035] 5. Semantic evidence fusion The LLM output that meets the consistency standard (C ≥ 0.6) is used as semantic evidence and re-injected into the evidence fusion process: Map the confidence scores of the LLM output to basic probability assignments; Evidence quality is calculated by taking the average structured completeness of the three prompts output; Participate in subsequent DS evidence synthesis to ensure unified processing of semantic evidence and traditional evidence.

[0036] In this embodiment, regarding confidence level calibration, the system employs temperature scaling technology to calibrate the original scores. The calibrated probability scores are obtained by dividing the candidate type score vector z by the temperature parameter T and then normalizing it using the Softmax function. The temperature parameter T ranges from 1.0 to 2.0, with a default value of 1.5. This range has been verified through extensive experiments and effectively balances calibration performance and stability. The specific implementation process is as follows: 1. Input Preparation Phase Collect candidate type score vector z = [ , , The vector contains raw scores for four dimensions, corresponding to the belief in phishing websites, malware, data leakage, and benign pages, respectively. 2. Temperature scaling processing Set the temperature parameter T, with a value range of [1.0, 2.0] and a default value of 1.5; Scale the original fraction vector: = z / T; Mechanism of action of temperature parameters: When T > 1: soften the probability distribution to alleviate the problem of model overconfidence; When T = 1: Equivalent to the original Softmax output; When T < 1: sharpen the probability distribution (not used in this system); 3. Probability Normalization The scaled scores are converted into a probability distribution using the Softmax function: Calculate the index value: = exp( [i]) Calculate the sum: = Σ( ), i ∈ {phishing, malware, exfil, benign} The probability after calibration is: ŝ(i) = / 4. Parameter optimization mechanism Optimize temperature parameters using a locally maintained validation set (containing labeled samples); The optimal T value is found in the range [1.0, 1.2, 1.4, 1.5, 1.6, 1.8, 2.0] using a grid search. Optimization objective: Minimize negative log-likelihood loss (NLL Loss); Optimization frequency: Once every 100 newly labeled samples or once a week; Please see Figure 2 This is a schematic diagram of the confidence calibration curve provided in an embodiment of the present invention. The calibration curve shows the process and effect of the system calibrating the original prediction score through the temperature scaling method. The horizontal axis in the figure represents the original prediction score of the model; the vertical axis represents the calibrated probability that reflects the true probability after calibration; the ideal diagonal serves as a reference benchmark, representing that the prediction score is completely consistent with the true probability; this embodies the core mechanism of the present invention to improve the credibility of the final safety decision through the confidence calibration module.

[0037] Furthermore, in this embodiment, to achieve an adaptive decision-making mechanism, the system maintains a local validation set for the past 30 days, including both white and black samples. Based on the validation set, accuracy and false alarm rate are periodically calculated, with the constraint of simultaneously satisfying preset accuracy and false alarm rate targets. The preset accuracy target is no less than 0.98, and the preset false alarm rate target is no more than 0.01, i.e., P... The constraint is that the threshold value is ≥ 0.98 and the FPR is ≤ 0.01. The interception threshold is dynamically adjusted. and warning threshold This adjustment strategy, based on actual performance feedback, ensures optimal system performance under different environments. The specific implementation is as follows: 1. Validation set management Time window: Rolling maintenance of judgment results for the most recent 30 days; Sample composition: White samples: Confirmed safe URLs, minimum size 1000; Black samples: Identify malicious URLs and collect them evenly by type; Sample characteristics: Record the calibrated score, final judgment result, and manual confirmation label for each sample; 2. Performance monitoring indicators Accuracy P At the interception threshold The accuracy of the following; P = TP / (TP + FP), where TP is a true positive and FP is a false positive; False Alarm Rate (FPR): Overall false alarm rate of the system; FPR = FP / (FP + TN), where TN is the true negative; 3. Threshold dynamic adjustment strategy Core constraint: P ≥ 0.98 and FPR ≤ 0.01; Adjustment basis: Quantile statistics of scores after validation set sample calibration; Specific adjustment logic: Interception threshold : Set near the 2nd percentile (P2) of the black sample score; Ensure that 98% of black samples are correctly blocked; Warning threshold : Set near the 99th percentile (P99) of the white sample score; Ensure that 99% of white samples do not receive false alerts; Adjust trigger conditions: Timed trigger: Automatically adjusts every 24 hours; Event trigger: Adjust immediately when 100 new validation samples are accumulated; Adjustment range limit: Each adjustment shall not exceed ±0.05 to avoid drastic fluctuations in the threshold; 4. Resource Adaptive Strategy The threshold is dynamically adjusted based on equipment performance. High-performance devices (RAM ≥ 8GB): = 0.85, = 0.65; Mid-performance devices (RAM ≥ 4GB): = 0.86, = 0.66; Low-performance devices (RAM < 4GB): = 0.87, = 0.67; In this embodiment, in order to dynamically and proactively evaluate the security status of the URL access process locally in the browser, after constructing the attack causal graph and generating the evidence constraint set, the system starts an attack and defense game simulation phase driven by two agents. This phase instantiates two agents locally on the terminal: defense agent D and attack simulation agent A, where at least one agent is driven by the client-side large language model that has been deployed in the browser environment to achieve semantic understanding and generation of complex strategies.

[0038] To make the attack and defense simulation closely resemble real-world confrontation and be subject to resource constraints, the core task of the defense agent D is to strategically choose to perform "instrumentation observation" (to record detailed behavioral parameters), "adding log entries," or directly "setting logical blocking points" at key nodes (such as call points to access camera APIs) or edges (such as requests to send data to external domains) in the causal graph based on the real-time state of the current attack causal graph, the established set of evidence constraints, and the remaining session detection budget and session resource budget. Each such operation consumes the corresponding budget, thereby simulating the resource costs of monitoring and protection in real-world security systems.

[0039] Meanwhile, in order to proactively uncover potential threats, attack simulation agent A runs a path search algorithm on the attack causal graph while strictly adhering to the evidence constraint set (i.e., without violating the observed security policy logic). The algorithm aims to find feasible attack paths from the initial entry node of the page to the target sensitive resource node (such as the local storage node storing user credentials). In each round of the game, attack agent A submits the candidate attack path that it finds and currently assesses as the most harmful to the system.

[0040] In order to obtain a stable evaluation conclusion through a limited number of simulations, the defense agent D and the attack simulation agent A interact in multiple rounds in an alternating round-based manner. The defender strengthens the monitoring or blocking of the corresponding nodes according to the path proposed by the attacker, while the attacker needs to find alternative paths under the new constraints. This iterative process continues until the detection budget and resource budget allocated to the session are exhausted, or the number of game rounds reaches the preset safety limit (e.g., 100 rounds), at which point the game process terminates.

[0041] To transform the results of the game simulation into quantifiable risk indicators and actionable decisions, the system performs a comprehensive assessment after the game ends. If attack simulation agent A fails to construct any attack path to sensitive resource nodes throughout the entire simulation, the system determines that the overall security of the current browsing session meets the preset session-level security contract and outputs the conclusion that the risk is controllable. Conversely, if attack agent A successfully constructs at least one attack path, the system calculates the synthetic risk value R of this session based on the preset risk weights of each node traversed on the path, the operational risk weights of the edges, and the total length of the path, using a risk quantification model.

[0042] Finally, this risk value R is compared with the initial risk upper bound of the session, and combined with the calibrated candidate type scores generated by previous evidence fusion and large language model deliberation for comprehensive correction, so as to make a final graded security decision among "block access", "show warning" and "allow access".

[0043] Through the aforementioned closed-loop game theory deduction and quantitative evaluation, the system achieves proactive detection of potential threats, probabilistic measurement of security status, and simulation verification of the effectiveness of protection strategies.

[0044] Furthermore, in order to continuously optimize the system based on user feedback on security decisions while strictly protecting user privacy, the system is designed with a local feedback learning and privacy protection mechanism.

[0045] When a user provides feedback of "confirm attack" to the system's blocking or warning decision, the system will extract all evidence items associated with the current browsing session and, based on the feedback, increase the quality weight of these evidence items by a preset increment. At the same time, the system will record the key structural features of the current attack causal graph (such as specific types of node connection patterns) and enhance the blocking tendency and budget allocation weight of the defense agent D when it encounters subsequent attacks with the same or similar graph structures.

[0046] Conversely, when a user "marks a false positive," the system reduces the quality weight of the relevant evidence item and decreases the default blocking frequency of the defense agent D in similar contexts, thereby reducing interference in benign scenarios in the future. To optimize privacy and security, the system stores all feedback data (including evidence item IDs, adjusted weights, causal graph feature hashes, etc.) in a locally encrypted feedback cache queue. Before statistically aggregating the cached data to update the local policy model, the system first applies random noise that meets differential privacy requirements to the values ​​involving counts, frequencies, or probabilities, ensuring that it is impossible to deduce any individual user's original browsing history from the published statistics.

[0047] In addition, if users voluntarily choose to join the "cloud collaborative optimization" mode, the system will only upload the aggregated statistical parameters (such as the average weight adjustment value of a certain type of rule atom, the trigger frequency of a specific attack mode, etc.) after adding differential privacy noise to the cloud server, and will never upload the specific URL, page text, code snippets or complete attack cause-effect graph structure.

[0048] Through the above mechanism, the system, while fully respecting and protecting user privacy, utilizes feedback to achieve personalized and adaptive evolution of evidence reliability assessment and agent decision-making strategies.

[0049] Ultimately, the system's interpretable output layer generates a structured security report that clearly displays the risk assessment conclusions, confidence levels, key evidence chains, and their visual anchor points (highlighted) in the original page, along with clear handling recommendations. The entire solution, through a closed-loop design, achieves highly confident, interpretable, and continuously evolving URL security analysis on the browser side while ensuring user privacy.

[0050] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0051] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A URL security analysis method based on a large language model on the browser side, characterized in that, Includes the following steps: The session-level security contract is determined based on the terminal device performance parameters and user risk preferences. The session-level security contract includes: an upper bound on session risk. Session detection budget and session resource budget ; Collect page behavior information related to the target URL, encapsulate the page behavior information into evidence units with a unified data structure, and construct an attack causal graph; Based on the attack causal graph, and combined with the risk ontology and rule atomic library, the evidence unit is mapped to the basic probability assignment of the hypothesis set, and the evidence constraint set is generated. Under the constraints of the session contract, the system security status is evaluated by conducting multiple rounds of attack and defense game on the attack causality graph through the defense agent and the attack simulation agent; Based on the game results, combined with the evidence synthesis output and risk quantification model, the session risk value is calculated, and a graded security decision is made according to the preset threshold. The system dynamically adjusts the evidence quality weights and proxy decision-making strategies based on user feedback to achieve local adaptive optimization.

2. The URL security analysis method for browser-side large language models according to claim 1, characterized in that, The page behavior information includes at least: Static script information, including script files, abstract syntax tree nodes, and sensitive API calls; Dynamic behavior information, including DOM structure changes, pop-up creation, redirection, and timer callbacks; Network request information, including requests to third-party domains, cross-origin resource loading, and file download behavior; Visual text information on the page; Semantic analysis results output by the edge-side large language model; The attack causal graph is constructed in the form of a directed graph G=(V,E), where, The node V in the attack causal graph includes: An identity node indicating login status, session token status, or authorization status; Resource nodes that indicate the access status of local resources such as clipboard, file system, camera, and microphone; External nodes that represent external domain names, IP addresses, or download targets; This refers to a business node on a key business page or payment page. Edge E records the state transition relationships caused by script execution, network requests, or user interactions.

3. The URL security analysis method for browser-side large language models according to claim 1, characterized in that, The evidence unit includes a source field, observation key-value pairs, a quality score, a timestamp, and a visual anchor. The source field identifies whether the evidence originates from static code, dynamic behavior, page text, or the output of a large language model. The quality score is calculated using different methods depending on the evidence source type. The visual anchor is used to locate specific lines of code, DOM elements, text fragments, or network request endpoints. The quality score of the evidence unit is calculated as follows: The quality score of static code evidence = AST completeness × path credibility; The quality score of dynamic behavioral evidence = Hook coverage rate × Hit rate; The quality score of the page text evidence = OCR confidence level × character restoration rate; The quality score of the evidence output by the large language model equals the completeness of the structured output; In the aforementioned risk ontology and rule atomic library: The rule atom contains the fields id, pattern, weight, threshold, version, and notes; The risk ontology maintains the mapping relationship between the four types of phishing websites, malware, data leakage, and benign pages and the rule atoms in the assumption set; The pattern supports AST, DOM, string or behavior graph matching expression, and calculates the basic probability allocation of various hypotheses by multiplying the evidence source coefficient, evidence quality score and rule atomic pattern matching degree. The remaining probabilities are assigned to the unknown set and then normalized.

4. The URL security analysis method for browser-side large language models according to claim 1, characterized in that, Before or during the execution of the attack and defense game, the basic probability assignments obtained by the mapping of evidence units are synthesized using the DS evidence theory in two levels. First, the basic probability assignments within the same source are synthesized, and then the synthesis results across sources are synthesized again to obtain the global belief function and likelihood function and output the candidate type score. When the conflict factor exceeds a preset threshold during the synthesis process, a conflict suppression mechanism is triggered. All evidence units currently participating in the synthesis are sorted in ascending order according to their quality scores, and the evidence unit with the lowest quality score is removed to form a new evidence set. The DS evidence theory synthesis is then performed again based on the new evidence set.

5. The URL security analysis method for a browser-side large language model according to claim 1, characterized in that, Each evidence item in the evidence constraint set includes the evidence source type, the corresponding node or edge identifier, the quality weight, and the constraint conditions expressed in a logical expression; the constraint conditions are used to limit the allowed or prohibited behavioral patterns on the attack causal graph.

6. The URL security analysis method for browser-side large language models according to claim 4, characterized in that, Before calculating the session risk value based on the game results, evidence synthesis output, and risk quantification model, the method further includes a step of multi-model deliberation and calibration of the candidate type scores, specifically including: Multi-cue deliberation steps: Construct at least three parallel cues with different focuses, perform collaborative reasoning on the edge large language model, and generate structured semantic evidence; Calculate the consistency measure C of the multi-cue inference results: C = 0.5 × (1 - JSD(type)) + 0.5 × cosSim(explanation), Where: JSD(type) is the Jensen-Shannon divergence of the type label of each parallel prompt output, and cosSim(explanation) is the cosine similarity of the explanatory text field of each parallel prompt output; when the consistency metric C is lower than the preset threshold γ, the candidate type score is multiplied by the reduction factor η and the handling level is downgraded from interception to warning or release; Confidence calibration step: Obtain the candidate type score vector after processing by the multi-hint deliberation step; Divide each element of the candidate type score vector by the temperature parameter T to obtain the scaled score vector. ; the scaled fraction vector The calibrated probability scores for each hypothesis type are obtained by normalizing the data using the Softmax function. Adaptive threshold strategy: A validation set containing white and black samples is continuously collected and maintained locally, with a time window of a preset number of days. Based on the validation set, the accuracy P and the overall false alarm rate FPR at the current interception threshold are calculated periodically. With the preset accuracy and false alarm rate targets as constraints, the values ​​of the interception threshold and the warning threshold are calculated and determined by a quantile matching algorithm based on the statistical quantiles of the calibrated scores of black and white samples in the validation set.

7. The URL security analysis method for a browser-side large language model according to claim 1, characterized in that, Under the constraints of the session contract, the system security status is evaluated by conducting multiple rounds of attack-defense game between the defense agent and the attack simulation agent on the attack causality graph, including: Maintain defense agent D and attack simulation agent A locally on the terminal; The defense agent D, based on the current attack causality graph state, the evidence constraint set, and the session-level security contract, selects to instrument observations, add log entries, or set blocking points on some nodes or edges of the attack causality graph, consuming the session detection budget. With session resource budget ; Under the premise of satisfying the evidence constraint set, the attack simulation agent A searches for feasible attack paths from the entry node to the target sensitive resource node on the attack causal graph, and proposes candidate attack paths in each game round. The defensive agent D and the attack simulation agent A engage in a finite-round attack-defense game on the attack causality graph in a turn-based manner. When the session detection budget... and session resource budget If the game is not exhausted and the number of rounds has not reached the preset limit, the iteration continues; otherwise, the game is terminated. Wherein, at least one of the defense agent D and / or the attack simulation agent A is implemented by a client-side large language model deployed locally in the browser; The process of calculating session risk values ​​based on game results, evidence synthesis output, and risk quantification models, and making tiered security decisions based on preset thresholds, includes: When the attack-defense game ends, if the attack simulation agent A is in the session detection budget Session resource budget Given the evidence constraint set, if no successful attack path from the entry node to the target sensitive resource node can be constructed, then the current browsing session is deemed to satisfy the session-level security contract, and the session risk value is output as not exceeding the upper bound of the session risk. Safety conclusions; If the attack simulation agent A constructs at least one successful attack path under the above conditions, the session risk value R is calculated based on the node risk weight, edge risk weight, and path length on the attack path. Relate the session risk value R to the upper bound of the session risk. Compare the data and choose a decision action based on the comparison results: block access, display a warning, or allow access. The decision-making action is corrected by combining the candidate type scores generated by evidence synthesis and deliberation by the edge-side large language model.

8. The URL security analysis method for a browser-side large language model according to claim 1, characterized in that, The local feedback loop and policy update include: When a user confirms an attack, increase the quality weight of evidence items related to that browsing session and enhance the blocking tendency of the defense agent D on the same or similar attack causal graph structure; When a user flags a false alarm, reduce the quality weight of evidence items related to that browsing session and decrease the blocking frequency of the defense agent D in the same or similar context; Before performing statistical analysis on the local feedback cache and using it to update defense or attack strategies, differential privacy noise is applied to the count or probability values ​​in the feedback data. When a user selects to enable the cloud-based collaborative optimization mode, only statistical parameters processed with differential privacy are uploaded, without uploading specific URLs, page content, or attack causal graph structures.

9. A URL security analysis device for a browser-side large language model, characterized in that, Including memory and processor; The memory stores computer programs; When the processor executes the computer program, it performs the functions of the following modules: The session contract management module is used to determine session-level security contracts based on terminal device performance parameters and user risk preferences. The cause-effect graph and evidence collection module is used to collect page behavior information related to the target URL, encapsulate the information into evidence units with a unified data structure, and construct an attack cause-effect graph. The evidence constraint generation module is used to map evidence units to basic probability assignments of the hypothesis set based on the attack causal graph, combined with the risk ontology and rule atom library, and generate an evidence constraint set. The dual-agent game module is used to evaluate the system security status by having a defense agent and an attack simulation agent engage in multiple rounds of attack and defense game on the attack causality graph under the constraints of the session contract. The risk decision module is used to calculate the session risk value based on the output of the game module, combined with the evidence synthesis and risk quantification results, and make a graded security decision according to a preset threshold. The local optimization module is used to dynamically adjust the evidence quality weight and proxy decision-making strategy based on user feedback, thereby achieving local adaptive optimization.

10. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the URL security analysis method for a browser-side large language model as described in any one of claims 1 to 8.

Images