Risk assessment and protection system of big data model

Abstract

The invention relates to the technical field of big data risk assessment, and discloses a risk assessment and protection system for a big data model, and the system comprises a collection module which is used for collecting an output entropy change rate, a video memory sudden increase rate and a call deviation degree of a model instance, and calculating a target risk value; and the limiting module is used for carrying out square weight reduction on the scheduling weight when the target risk value exceeds a first scheduling risk threshold value to obtain the scheduling weight after weight reduction, and carrying out proportion limitation on the CPU quota and the GPU quota when the target risk value exceeds a second scheduling risk threshold value to obtain the limited resource quota. According to the method, the real-time response of the scheduling level to the risk state is realized, the scheduling priority of the high-risk model instance is automatically reduced, and the risk propagation is controlled from the source, so that the complete traceability of the risk event and the automatic recovery capability of the service are realized, the operation and maintenance cost is reduced, and the fault response time is shortened.

Description

Technical Field

[0001] This invention relates to the field of big data risk assessment technology, and in particular to a risk assessment and protection system for big data models. Background Technology

[0002] As the scale of big data models in cloud computing environments continues to expand, online training and inference services face security threats. Existing risk assessment systems rely on single-dimensional resource monitoring metrics, making it difficult to accurately capture complex anomaly patterns during model operation and lacking effective protection mechanisms against gradient information leakage during model training. Furthermore, traditional resource isolation strategies employ static configuration, failing to dynamically adjust isolation strength based on the real-time risk status of model instances. This results in insufficient protection in high-risk scenarios and resource waste in low-risk scenarios. For model instances that have experienced anomalies, there is a lack of comprehensive behavioral auditing and tracing capabilities and automated recovery mechanisms, leading to low response efficiency and difficulty in ensuring business continuity. Summary of the Invention

[0003] This invention provides a risk assessment and protection system for big data models. This invention enables real-time response to risk status at the scheduling level, automatically reduces the scheduling priority of high-risk model instances, controls risk propagation from the source, and achieves complete traceability of risk events and automated business recovery capabilities, thereby reducing operation and maintenance costs and shortening fault response time.

[0004] In a first aspect, the present invention provides a risk assessment and protection system for big data models, the risk assessment and protection system for big data models comprising: The data acquisition module is used to collect the output entropy change rate, memory surge rate, and call deviation of model instances and calculate the target risk value. The restriction module is used to square down the scheduling weights when the target risk value exceeds the first scheduling risk threshold to obtain the downweighted scheduling weights, and to proportionally limit the CPU quota and GPU quota when the target risk value exceeds the second scheduling risk threshold to obtain the restricted resource quota.

[0005] In conjunction with the first aspect, in a first implementation of the first aspect of the present invention, the risk assessment and protection system for the big data model further includes: The queue creation module is used to obtain the number of CPU cores, GPU memory capacity, and network bandwidth of the model instance to obtain a resource triplet; calculate the scheduling weight based on the business weight of the model instance and the target risk value; use the identifier, business weight, and scheduling weight of the model instance as queue elements, and allocate computing resources to the model instance at the head of the queue according to the resource triplet to obtain a global priority queue.

[0006] In conjunction with the first aspect, in a second implementation of the first aspect of the present invention, the acquisition module is specifically used for: The output entropy change rate is calculated by statistically analyzing the continuous inference results of the model instances within the sampling period. Calculate the memory surge rate based on the peak and average values ​​of GPU memory; Calculate the deviation of API call counts from historical mean and standard deviation; The target risk value is obtained by weighted summing of the output entropy change rate, the memory surge rate, and the call deviation.

[0007] In conjunction with the first aspect, in a third implementation of the first aspect of the present invention, the risk assessment and protection system for the big data model further includes: The calculation module is used to calculate the noise figure based on the target risk value; The noise processing module is used to generate independent Gaussian noise with zero mean for each parameter component of the model gradient based on the square of the noise coefficient as the variance, to obtain a noise vector, and then add the noise vector to the model gradient to obtain the perturbation gradient.

[0008] In conjunction with the first aspect, in a fourth implementation of the first aspect of the present invention, the calculation module is specifically used for: When the target risk value is less than the first noise risk threshold, the reference noise figure is used as the noise figure; When the target risk value is between the first noise risk threshold and the second noise risk threshold, the first risk difference between the target risk value and the first noise risk threshold is calculated, and the first risk difference is multiplied by the linear enhancement coefficient plus one and then multiplied by the reference noise coefficient to obtain the noise coefficient; When the target risk value is greater than or equal to the second noise risk threshold, the second risk difference between the target risk value and the second noise risk threshold is calculated. The second risk difference is multiplied by the exponential amplification factor to obtain the power of the natural exponent, and then multiplied by the reference noise coefficient to obtain the noise coefficient.

[0009] In conjunction with the first aspect, in a fifth implementation of the first aspect of the present invention, the limiting module is specifically used for: When the target risk value exceeds the first scheduling risk threshold, the third risk difference between the target risk value and the first scheduling risk threshold is calculated, and the square of the third risk difference is multiplied by the scheduling weight to obtain the reduced scheduling weight. The reduced scheduling weight is then updated to the global priority queue. When the target risk value exceeds the second scheduling risk threshold, a fourth risk difference is calculated based on the target risk value and the second scheduling risk threshold. The CPU reduction ratio and GPU limitation ratio are calculated based on the fourth risk difference. The number of CPU cores in the resource triplet is multiplied by the CPU reduction ratio to obtain the limited CPU quota. The GPU memory capacity in the resource triplet is multiplied by the GPU limitation ratio to obtain the limited GPU quota. The limited CPU quota and limited GPU quota are applied as limited resource quotas to the model instance.

[0010] In conjunction with the first aspect, in the sixth implementation of the first aspect of the present invention, the risk assessment and protection system for the big data model further includes: The migration module is used to migrate the model instance from the original namespace to the sandbox namespace and configure network policies and independent resource quotas when the target risk value is detected to continuously exceed the isolation threshold for N consecutive sampling periods, so as to obtain the migrated model instance. The audit module is used to extract timestamps, input data hashes, output data hashes, and resource usage status from the API call events of the migrated model instance, concatenate them into the current audit record, and calculate the hash value based on the current audit record and the previous audit record to form a sandbox isolated instance.

[0011] In conjunction with the first aspect, in the seventh implementation of the first aspect of the present invention, the migration module is specifically used for: The target risk value is continuously monitored over N consecutive sampling periods. When the target risk value is detected to exceed the isolation threshold continuously over N consecutive sampling periods, a migration operation is triggered and the model instance to be migrated is determined. The model instance to be migrated is kept running and migrated from the original namespace to the sandbox namespace to obtain the model instance in the sandbox; Configure a network policy that allows communication only with the audit log service for the model instances in the sandbox, and allocate independent CPU quotas, GPU quotas, and bandwidth quotas to obtain the migrated model instances.

[0012] In conjunction with the first aspect, in the eighth implementation of the first aspect of the present invention, the risk assessment and protection system for the big data model further includes: The recovery trigger module is used to monitor the target risk value of the sandbox isolation instance. When the target risk value is lower than the recovery threshold for M consecutive monitoring periods, the recovery process is triggered and the sandbox isolation instance to be recovered is determined. The filtering module is used to retrieve historical snapshots of the sandbox isolation instance to be restored from the version repository, and filter historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous running time exceeding the stable running threshold as snapshot parameters; The recovery execution module is used to replace the current parameters of the sandbox isolated instance to be recovered with the snapshot parameters and migrate it back from the sandbox namespace to the normal namespace. At the same time, it restores the scheduling weight to the business weight and removes the resource quota limit to obtain the recovered model instance.

[0013] In conjunction with the first aspect, in the ninth implementation of the first aspect of the present invention, the filtering module is specifically used for: Access the version repository and retrieve the corresponding historical snapshot based on the identifier of the sandbox isolation instance to be restored; Read the comprehensive risk score and continuous runtime associated with the historical snapshot, filter historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous runtime exceeding the stable operation threshold to obtain stable parameter snapshots; Extract the model weight parameters and model bias parameters from the stable parameter snapshot, and use the model weight parameters and model bias parameters as snapshot parameters.

[0014] The technical solution provided by this invention achieves real-time response to risk states at the scheduling level through a dynamic scheduling mechanism based on resource triples and business weights. The scheduling priority of high-risk model instances is automatically reduced, controlling risk propagation from the source. A quantitative risk assessment system integrating three-dimensional feature vectors of output stability, resource anomalies, and call behavior offers higher anomaly detection accuracy and lower false positive rates compared to single-indicator monitoring. A risk value-driven hierarchical noise injection strategy maintains minimal noise levels in low-risk states to avoid impacting model performance, while exponentially amplifying noise intensity in high-risk states to prevent gradient information leakage, achieving a dynamic balance between privacy protection and model training efficiency. A progressive protection system, from reduced scheduling weights and resource quota restrictions to sandbox isolation, offers finer risk control granularity compared to the binary isolation methods of existing technologies, precisely controlling the impact range of high-risk instances while ensuring normal business continuity. A closed-loop risk management process, formed through hash chain auditing and version rollback mechanisms, achieves complete traceability of risk events and automated business recovery capabilities, reducing operational costs and shortening fault response time. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the risk assessment and protection system for big data models in an embodiment of the present invention. Detailed Implementation

[0017] This invention provides a risk assessment and protection system for a big data model. The terms "first," "second," "third," "fourth," etc. (if applicable) in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, systems, products, or devices.

[0018] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the risk assessment and protection system for big data models in this invention includes: The acquisition module 101 is used to acquire the output entropy change rate, memory surge rate and call deviation of the model instance and calculate the target risk value; Specifically, within each preset sampling period, the acquisition module statistically analyzes the output results of several consecutive inference tasks performed by the model instance. These output results are then categorized and counted to construct a category frequency distribution. Based on this distribution information, the output category entropy value for the current period is calculated, and combined with the output entropy of the previous sampling period, the entropy change rate is calculated to determine whether the model output exhibits abnormal drift or structural shift trends. The acquisition module interacts with the GPU driver layer to obtain real-time data on GPU memory usage within the current period, recording the peak and average memory usage values ​​for the current period. This data is then used to calculate the memory surge rate, which characterizes whether the model exhibits abnormal resource request behavior. Simultaneously, the acquisition module statistically analyzes the number of API calls made by the model instance per unit time, and calculates the mean and standard deviation of the model's API call frequency based on historical call data. Standardized deviation is used to calculate the current call deviation, reflecting whether the model's behavioral patterns differ significantly from historical stable behavior. The acquisition module multiplies the output entropy change rate, memory surge rate, and call deviation by preset weighting coefficients and then performs a weighted sum to obtain the target risk value reflecting the model's risk status within the current period.

[0019] The restriction module 102 is used to square down the scheduling weight when the target risk value exceeds the first scheduling risk threshold to obtain the downweighted scheduling weight, and to proportionally limit the CPU quota and GPU quota when the target risk value exceeds the second scheduling risk threshold to obtain the restricted resource quota.

[0020] Specifically, when the target risk value exceeds the first scheduling risk threshold, the limiting module calculates the third risk difference between the target risk value and the first scheduling risk threshold, and performs a square operation on the third risk difference to enhance the non-linear effect of the risk response. The squared value is then multiplied by the original scheduling weight of the model instance as an adjustment factor to obtain the reduced scheduling weight, and the reduced weight result is written into the global priority queue maintained by the scheduling system. When the target risk value exceeds the second scheduling risk threshold, the limiting module enters the resource enforcement limiting process, calculates the fourth risk difference between the target risk value and the second scheduling risk threshold, and uses this difference as input to calculate the CPU reduction ratio and GPU limiting ratio according to the set resource limiting function. The CPU reduction ratio shows a linear decreasing trend, while the GPU limiting ratio adopts maximum value protection logic to ensure that resources are not completely deprived. The limiting module multiplies the number of CPU cores in the original resource triplet by the CPU reduction ratio to obtain the limited CPU quota. At the same time, it multiplies the original GPU memory capacity by the GPU limitation ratio to obtain the limited GPU quota. The limited CPU quota and limited GPU quota are used as new resource allocation parameters and applied to the target model instance. The resource limit status is forcibly updated through the cloud platform's resource management interface.

[0021] In one specific embodiment, the risk assessment and protection system for big data models further includes: The queue creation module is used to obtain the number of CPU cores, GPU memory capacity, and network bandwidth of model instances to obtain resource triples; calculate scheduling weights based on the business weights and target risk values ​​of model instances; use the identifiers, business weights, and scheduling weights of model instances as queue elements, and allocate computing resources to the model instance at the head of the queue according to the resource triples to obtain a global priority queue.

[0022] Specifically, resource information extraction is performed on each model instance deployed in the cloud computing platform. This includes reading the number of CPU cores, GPU memory capacity, and network bandwidth allocated to the model instance in the current operating environment. These three resource metrics are then combined in a preset order to form a resource triplet. The number of CPU cores reflects the scale of the main processing unit, GPU memory capacity represents the graphics processing resources for accelerating computing tasks, and network bandwidth reflects the communication throughput capacity of the model under concurrent inference requests. The queue creation module obtains the business weight value corresponding to the model instance. The business weight is preset and graded according to the importance of the business type, and it participates in the calculation of the scheduling weight together with the target risk value currently calculated for the model instance. The scheduling weight is constructed using a set risk suppression function, such as a function that multiplies the business weight by the inverse ratio of the target risk value. The unique identifier of the model instance, its business weight, and the calculated scheduling weight are packaged as a scheduling element and inserted into the scheduling queue. The elements are then sorted from high to low according to their scheduling weights to form a global priority queue. In the global priority queue, the model instance at the top of the queue is selected first for computing resource allocation. The corresponding CPU cores, GPU memory and network bandwidth are automatically allocated to the instance through the resource quota defined in its resource triplet, so that scheduling resources are dynamically linked with model risk level and business value.

[0023] In one specific embodiment, the acquisition module 101 is specifically used for: Calculate the rate of change of output entropy from the continuous inference results of statistical model instances within the sampling period; Calculate the memory surge rate based on the peak and average values ​​of GPU memory; Calculate the deviation of API call counts from historical mean and standard deviation; The target risk value is obtained by weighted summation of the output entropy change rate, memory surge rate, and call deviation.

[0024] Specifically, a lightweight monitoring agent deployed in the inference service layer continuously collects the inference results of model instances within a set fixed sampling period. This continuous inference result undergoes structured statistical processing, extracting output category labels from continuous inference request responses. Frequency is counted according to category number to form the output category distribution within the current period. Based on this distribution, the output entropy value for the current period is calculated, with the natural logarithm as the base, quantifying the uncertainty of the model's current output. The output entropy value of the current period is then differiated from the output entropy value of the previous period and normalized to form the output entropy change rate, serving as an indicator of the stability of the model's inference behavior. Simultaneously, through interaction with GPU underlying interfaces such as CUDA drivers, the model is collected in real time. The sampling period records the peak and average memory usage, and calculates the memory surge rate. The memory surge rate effectively characterizes whether the model exhibits abnormal memory allocation behavior in the current period, thus identifying resource usage fluctuations caused by resource leaks, memory fragmentation, or illegal computation branches. Behavioral modeling analysis is performed on API call behavior. The number of API calls triggered by model instances is counted within the sampling period, and this statistical value is standardized against the mean and standard deviation of API calls recorded over a long period of model operation. The deviation of the current period's API call count is calculated, reflecting whether the model's behavior pattern is significantly abnormal. This is used to identify unexpected model behavior under conditions of data distribution drift, attack injection, or configuration errors. Using weighting coefficients determined through historical data fitting, the output entropy change rate, memory surge rate, and API call deviation are weighted and summed to construct a unified risk score representation, i.e., the target risk value. A normalization function is then used to map the target risk value to a preset risk scoring range.

[0025] In one specific embodiment, the risk assessment and protection system for big data models further includes: The calculation module is used to calculate the noise figure based on the target risk value; The noise processing module is used to generate independent Gaussian noise with zero mean for each parameter component of the model gradient based on the square of the noise coefficient as the variance, obtain the noise vector, and add the noise vector to the model gradient to obtain the perturbation gradient.

[0026] Specifically, the calculation module receives the target risk value output by the acquisition module, establishes a mapping relationship between the target risk value and a preset risk grading function, maintains the basic noise level in low-risk states to ensure model performance, and calculates a higher noise coefficient through a linear growth function or exponential function in medium-to-high-risk states, using the noise coefficient as the base value of the standard deviation of the Gaussian distribution sampling. The noise processing module receives the noise coefficient σ output by the calculation module, calculates the square of σ as the variance of the Gaussian distribution, and generates a model conforming to N(0,σ). 2The random variable sequence is distributed as follows: the noise processing module decomposes the gradient vector of the current training iteration of the model according to the parameter dimension, and independently generates a value with zero mean and variance σ for each parameter component. 2 The Gaussian noise values ​​are used to form a noise vector with the same length as the original gradient. After the noise is generated, the noise vector is added element-wise to the original model gradient vector to obtain the perturbation gradient vector.

[0027] In one specific embodiment, the calculation module is specifically used for: When the target risk value is less than the first noise risk threshold, the baseline noise figure is used as the noise figure. When the target risk value is between the first noise risk threshold and the second noise risk threshold, calculate the first risk difference between the target risk value and the first noise risk threshold, and multiply the first risk difference by the linear enhancement coefficient plus one, and then multiply it by the reference noise coefficient to obtain the noise coefficient; When the target risk value is greater than or equal to the second noise risk threshold, the second risk difference between the target risk value and the second noise risk threshold is calculated. The second risk difference is multiplied by the exponential amplification factor to obtain the power of the natural exponent, and then multiplied by the reference noise coefficient to obtain the noise coefficient.

[0028] Specifically, two noise risk thresholds are preset: a first noise risk threshold and a second noise risk threshold. These are used to divide the risk level into three intervals: low risk, medium risk, and high risk. A uniform baseline noise coefficient is set as the default perturbation intensity in the low-risk state. When the target risk value calculated by the acquisition module is less than the first noise risk threshold, the model is considered to be in a stable state with extremely low information leakage risk. At this time, the calculation module directly selects the baseline noise coefficient as the noise intensity parameter for differential privacy protection in the current training iteration, avoiding unnecessary perturbation under risk-free conditions to ensure that the model performance is not affected. When the target risk value is between the first and second noise risk thresholds, the medium-risk state adjustment logic is entered. The first risk difference between the target risk value and the first noise risk threshold is calculated and multiplied by a preset linear enhancement coefficient for... The response strength of risk changes to noise adjustment is amplified, and a linear scaling factor is added to the result. The linear scaling factor is then multiplied by the baseline noise coefficient to obtain the enhanced noise coefficient in the current state. This allows for a moderate enhancement of the gradient perturbation strength to prevent information leakage when the model is still somewhat controllable but the risk begins to rise. When the target risk value is greater than or equal to the second noise risk threshold, it is identified as a high-risk state. The second risk difference between the target risk value and the second noise risk threshold is calculated, and the second risk difference is multiplied by a preset exponential amplification factor as the power term of the natural exponential function. The risk difference is nonlinearly amplified through the exponential function to obtain a higher-order protection strength. The exponential amplification result is multiplied by the baseline noise coefficient to obtain the high-intensity noise coefficient for the current training round. Sufficient perturbation is applied in the high-risk state to prevent any form of leakage of sensitive gradient information.

[0029] In one specific embodiment, the limiting module 102 is specifically used for: When the target risk value exceeds the first scheduling risk threshold, calculate the third risk difference between the target risk value and the first scheduling risk threshold, multiply the square of the third risk difference by the scheduling weight to obtain the reduced scheduling weight, and update the reduced scheduling weight to the global priority queue. When the target risk value exceeds the second scheduling risk threshold, the fourth risk difference between the target risk value and the second scheduling risk threshold is used to calculate the CPU reduction ratio and GPU limitation ratio. The number of CPU cores in the resource triplet is multiplied by the CPU reduction ratio to obtain the limited CPU quota, and the GPU memory capacity in the resource triplet is multiplied by the GPU limitation ratio to obtain the limited GPU quota. The limited CPU quota and limited GPU quota are then applied as limited resource quotas to the model instance.

[0030] Specifically, when the target risk value exceeds the first scheduling risk threshold, the numerical difference between the current target risk value and the first scheduling risk threshold is calculated to obtain the third risk difference, which characterizes the degree to which the model deviates from the normal state. The third risk difference is squared to enhance the scheduling penalty effect of the risk using its non-linear amplification characteristics. The squared value is then multiplied by the original scheduling weight of the model instance to obtain the reduced scheduling weight after risk penalty adjustment. The reduced weight result is synchronously updated to the global priority queue maintained internally by the scheduler, placing it at a later position in the inference request allocation process, thereby reducing the probability of high-risk models being prioritized for scheduling and effectively limiting their service traffic sources. When the target risk value exceeds the second scheduling risk threshold, the resource enforcement limitation process is initiated. The numerical difference between the target risk value and the second scheduling risk threshold is calculated to obtain the fourth risk difference. Using the fourth risk difference as an input factor, the CPU reduction ratio and GPU limitation ratio are calculated according to the preset resource quota adjustment function, where the CPU reduction ratio is... A linear decay function from high to low is used to reduce the current CPU quota, while the GPU limit ratio adopts a maximum value protection mechanism to ensure that the minimum GPU allocation is not lower than the safety threshold. The CPU core count in the original resource triplet is multiplied by the calculated CPU reduction ratio to obtain the limited CPU quota, and the GPU memory capacity is multiplied by the GPU limit ratio to obtain the limited GPU quota. The limited CPU quota and the limited GPU quota are then combined to form a new resource triplet and replace the original quota configuration. This is applied to the runtime environment of the target model instance. The quota limit is enforced through the Kubernetes scheduling interface, container resource limit object, or underlying GPU allocation hook function to ensure that the model instance cannot occupy too many critical resources in a high-risk state, and to prevent its abnormal behavior from spreading to other instances.

[0031] In one specific embodiment, the risk assessment and protection system for big data models further includes: The migration module is used to migrate model instances from their original namespace to the sandbox namespace and configure network policies and independent resource quotas when the target risk value is detected to continuously exceed the isolation threshold for N consecutive sampling periods, so as to obtain the migrated model instances. The audit module is used to extract timestamps, input data hashes, output data hashes, and resource usage status from API call events of the migrated model instance, concatenate them into the current audit record, and calculate the hash value based on the current audit record and the previous audit record to form a sandbox isolated instance.

[0032] Specifically, the scheduler continuously monitors the target risk value calculated by the model instance in each sampling period, and sets a predefined isolation threshold and the number of consecutive sampling periods N as trigger conditions. When it is detected that the target risk value of a model instance is consistently higher than the isolation threshold for N consecutive sampling periods, it indicates that the model is in a continuously high-risk state and cannot be stably controlled by conventional resource restrictions or weight penalties. This triggers the migration module to execute the sandbox isolation process. In actual operation, the migration module calls the cloud platform's namespace management interface to create an independent sandbox namespace. The sandbox namespace has a runtime environment that is physically isolated from the business namespace. Then, through the stateful migration mechanism provided by a container orchestration platform such as Kubernetes, the high-risk model instance is completely migrated from the original namespace to the sandbox namespace. During the migration process, the original memory state, parameter configuration, and model context are preserved to ensure that the service is uninterrupted and the state consistency is maintained. The migration module configures a strict network access policy for the instance in the sandbox namespace. By defining a NetworkPolicy object, it only allows the instance to send outbound requests to the port where the audit service is located, and completely prohibits external inbound connections, blocking its lateral interaction path with other models or services. At the same time, it allocates an independent resource quota pool to the model in the sandbox, limiting its number of CPU cores, GPU memory capacity and network bandwidth, and uses the ResourceQuota mechanism to enforce it, forming a closed and controlled migrated model instance. After the migration is completed, the audit module is activated to perform fine-grained auditing of the operational behavior of isolated model instances. Specifically, this includes intercepting relevant call parameters and extracting call timestamps when each API call event occurs, using high-precision Unix epoch timestamps to mark the moment the event occurs, and then using hash algorithms such as SHA-256 to calculate hash digests for the input data and output results, recording them as input data hash and output data hash. At the same time, the resource usage status at the time of the call is collected synchronously, including the number of CPU cores and GPU memory usage. The above four data fields are concatenated into the current audit record string, and combined with the hash value of the previous audit record to recalculate and generate the hash value of the current event, constructing a chain audit structure to achieve tamper-proof tracking and a complete audit chain for all behaviors of high-risk instances in the sandbox.

[0033] In one specific embodiment, the migration module is specifically used for: The target risk value is continuously monitored over N consecutive sampling periods. When the target risk value is detected to exceed the isolation threshold continuously over N consecutive sampling periods, the migration operation is triggered and the model instance to be migrated is determined. The model instance to be migrated is kept running and migrated from the original namespace to the sandbox namespace to obtain the model instance in the sandbox; Configure a network policy that allows communication with the audit log service only for the model instances in the sandbox, and allocate independent CPU quotas, GPU quotas, and bandwidth quotas to obtain the migrated model instances.

[0034] Specifically, a risk value monitoring window is established with a sampling period as the unit. The window length is set to N consecutive sampling periods. In each sampling period, the target risk value of the model instance is acquired in real time and compared with a preset isolation threshold. When the target risk value of a model instance is detected to be continuously higher than the isolation threshold throughout the entire N periods, without any fluctuation below the isolation threshold, the model is determined to be in a continuously unstable high-risk operating state, which cannot be effectively controlled by conventional resource restrictions or scheduling demotion mechanisms. At this time, the scheduler immediately triggers a migration operation and marks the model instance as a target for migration. A namespace-level migration process is initiated, adopting a stateful service non-interruption migration strategy. The namespace management API interface of the cloud computing platform is called to dynamically migrate the model instance to be migrated from the original business namespace to the preset isolation dedicated sandbox namespace. During the migration process, its running state, memory context, and model parameters remain unchanged, ensuring that the model inference service is not interrupted and can immediately restore the original task processing capability after migration, forming an isolated model instance running in a sandbox environment. After migration, configure network access rules for the model instances within the sandbox. Create a network policy object using Kubernetes' NetworkPolicy mechanism. This policy only allows the instance to initiate outbound communication to the port where the audit log service resides (e.g., port 9200), while explicitly prohibiting the instance from receiving any inbound connections from other external model instances or service nodes, thus completely blocking its lateral propagation path at the network layer. Allocate an independent resource quota pool to the sandbox instance, using the ResourceQuota mechanism to limit its CPU quota to a preset number of cores, such as 2 cores, while limiting the GPU memory capacity to a preset value, such as 4GB, and restricting network bandwidth to within 10Mbps. This forms a sandbox isolation environment with triple constraints: resource capping, communication isolation, and controlled behavior.

[0035] In one specific embodiment, the risk assessment and protection system for big data models further includes: The recovery trigger module is used to monitor the target risk value of the sandbox isolation instance. When the target risk value is lower than the recovery threshold for M consecutive monitoring periods, the recovery process is triggered and the sandbox isolation instance to be recovered is determined. The filtering module is used to retrieve historical snapshots of sandbox isolation instances to be restored from the version repository, and filter historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous running time exceeding the stable running threshold as snapshot parameters; The recovery execution module is used to replace the current parameters of the sandbox isolated instance to be recovered with snapshot parameters and migrate it back from the sandbox namespace to the normal namespace. At the same time, it restores the scheduling weight to the business weight and removes the resource quota limit to obtain the recovered model instance.

[0036] Specifically, the recovery trigger module continuously performs periodic risk value monitoring on isolated model instances in the sandbox namespace, recalculating the target risk value of the instance within each fixed monitoring cycle. When it is detected that the target risk value of a sandbox isolated instance remains consistently below the system's preset recovery threshold for M consecutive monitoring cycles, it indicates that the abnormal behavior of the model has been effectively suppressed and restored to a controllable state. This triggers the recovery process and marks the sandbox isolated instance as a model instance to be recovered. The filtering module initiates the snapshot retrieval and parameter filtering process. This module accesses the model version repository, which stores all historical model parameters and corresponding runtime metadata in snapshot form. Based on the unique identifier of the instance to be recovered, it retrieves all historical version snapshots from the version repository and filters out a subset of snapshots with a comprehensive risk score below the risk assessment threshold. It then filters snapshot versions within this subset whose continuous runtime exceeds the stable operation threshold, thus ensuring that the selected snapshots exhibit stability and security in historical operation. Snapshot versions meeting these dual conditions are used as snapshot parameters. The recovery execution module is responsible for the specific state replacement and namespace migration operations. It calls the model hot update interface to replace the parameters of the currently running model with the selected snapshot parameters, allowing the model to immediately revert to a stable state without interrupting the inference service process or restarting the container. Through the Kubernetes namespace management mechanism, the model instance is migrated from the sandbox namespace back to the original normal business namespace. After the migration, the model's scheduling weight in the global scheduling priority queue is restored, resetting its weight value from a restricted state to its initial business weight, allowing it to re-participate in the normal task allocation process. Simultaneously, the resource quota restrictions previously imposed due to the high-risk state are removed, restoring its CPU core count, GPU memory, and network bandwidth to their original quota levels, ensuring that model performance is no longer limited. This completes the model's state recovery, resource unsealing, and business regression. The recovery log recording module synchronously writes the trigger time of the recovery process, recovery parameters, and risk changes into the audit log system.

[0037] In one specific embodiment, the filtering module is specifically used for: Access the version repository and retrieve the corresponding historical snapshot based on the identifier of the sandbox isolation instance to be restored; Read the comprehensive risk score and continuous runtime associated with the historical snapshot, filter the historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous runtime exceeding the stable operation threshold, and obtain the stable parameter snapshot; Extract the model weight parameters and model bias parameters from the stable parameter snapshot, and use the model weight parameters and model bias parameters as snapshot parameters.

[0038] Specifically, a path to read historical model snapshot data is established by accessing the version repository. The version repository adopts a structured storage architecture oriented towards instance identifier management, maintaining complete parameter snapshots of each model instance at different points in time based on Git-LFS or a similar version control system. By obtaining the unique identifier of the sandbox isolated instance to be recovered, a search operation is initiated in the version repository to locate and extract all historical snapshot records corresponding to the identifier. These records contain binary storage of the model's weight and bias parameters, as well as runtime metadata such as the comprehensive risk score calculated at the time of each snapshot generation and the corresponding runtime duration. A risk assessment threshold is set as a risk control standard, and a stable operation threshold is set as a baseline for duration judgment. Snapshot records with a comprehensive risk score lower than the risk assessment threshold and a cumulative runtime exceeding the stable operation threshold are selected from all historical snapshots. This indicates that the snapshot has demonstrated a low level of security risk in historical operation and has a sufficiently long period of continuous stable operation, thus possessing the credibility and representativeness of a recovery parameter source. After the screening is completed, the model parameters are extracted from the selected stable snapshots, including model weight parameters and model bias parameters. The weight parameters are the connection matrix or convolution kernel tensor in the neural network, while the bias parameters are the neuron offset vectors. These parameters are stored in the snapshot file in binary format. After decoding and structural reconstruction, they are loaded into the memory of the model instance to be restored as snapshot parameters. The rollback operation of the model state is completed through a non-disruptive hot parameter update mechanism, so that the model can switch to the verified stable running state in an instant without stopping the service.

[0039] The risk assessment and protection system for big data models also includes: obtaining a list of other model instances deployed on the same physical computing node as the high-risk model instance, and extracting the number of CPU cores and GPU memory capacity of each model instance to obtain a set of model instances on the same node; for each model instance in the set of model instances on the same node, calculating the absolute value of the difference between its number of CPU cores and the number of CPU cores of the high-risk model instance, divided by the upper limit of the number of CPU cores, and adding the absolute value of the difference between its GPU memory capacity and the GPU memory capacity of the high-risk model instance, divided by the upper limit of the GPU memory capacity, to obtain the resource contention distance; multiplying the normalized risk value of the high-risk model instance by the negative value of the resource contention distance as a power of the natural exponent, and then multiplying by the risk propagation coefficient to obtain the risk propagation penalty value; subtracting the corresponding risk propagation penalty value from the current scheduling weight of each model instance in the set of model instances on the same node to obtain the scheduling weight after propagation suppression, and updating it to the global priority queue.

[0040] The risk assessment and protection system for big data models includes: obtaining the current training epoch of the model, calculating the attenuation epoch ratio based on a preset noise attenuation factor, and using the attenuation epoch ratio as a power of the noise attenuation factor to obtain the attenuation factor; multiplying the noise coefficient by the attenuation factor to obtain the effective noise coefficient after considering attenuation; generating independent Gaussian noise with a mean of zero for each parameter component of the model gradient based on the square of the effective noise coefficient as the variance, and adding the independent Gaussian noise to the corresponding parameter components of the model gradient to obtain the perturbation gradient considering long-term privacy protection; calculating the ratio of the loss function sensitivity to the effective noise coefficient as the privacy leakage amount of the current epoch, accumulating the privacy leakage amounts of historical training epochs to obtain the cumulative privacy budget, and adjusting the noise attenuation factor to increase the effective noise coefficient of subsequent epochs when the cumulative privacy budget exceeds the preset privacy budget upper limit.

[0041] The risk assessment and protection system for big data models includes: marking recovered model instances as key monitoring targets and recording their recovery timestamps from the sandbox namespace back to the normal namespace, thus obtaining key monitoring identifiers and recovery timestamps; based on the time difference between the current time and the recovery timestamp, when the time difference is less than the preset key monitoring duration, shortening the sampling period of the recovered model instances from the standard sampling period to the enhanced sampling period, thus obtaining the dynamically adjusted sampling period; within the dynamically adjusted sampling period, collecting the output entropy change rate, memory surge rate, and call deviation of the recovered model instances and calculating the normalized risk value; lowering the first scheduling risk threshold used to trigger scheduling weight reduction by a preset reduction ratio, thus obtaining the reduced first scheduling risk threshold during the key monitoring period; when the normalized risk value of the recovered model instances exceeds the reduced first scheduling risk threshold, triggering the squared reduction of scheduling weights and resource quota restrictions in advance.

[0042] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and units described above can be referred to the corresponding processes in the foregoing system embodiments, and will not be repeated here.

[0043] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the system described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0044] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A risk assessment and protection system for a big data model, characterized in that, include: The data acquisition module is used to collect the output entropy change rate, memory surge rate, and call deviation of model instances and calculate the target risk value. The restriction module is used to square down the scheduling weights when the target risk value exceeds the first scheduling risk threshold to obtain the downweighted scheduling weights, and to proportionally limit the CPU quota and GPU quota when the target risk value exceeds the second scheduling risk threshold to obtain the restricted resource quota.

2. The risk assessment and protection system for big data models according to claim 1, characterized in that, The risk assessment and protection system of the big data model also includes: The queue creation module is used to obtain the number of CPU cores, GPU memory capacity, and network bandwidth of the model instance to obtain a resource triplet; calculate the scheduling weight based on the business weight of the model instance and the target risk value; use the identifier, business weight, and scheduling weight of the model instance as queue elements, and allocate computing resources to the model instance at the head of the queue according to the resource triplet to obtain a global priority queue.

3. The risk assessment and protection system for big data models according to claim 1, characterized in that, The acquisition module is specifically used for: The output entropy change rate is calculated by statistically analyzing the continuous inference results of the model instances within the sampling period. Calculate the memory surge rate based on the peak and average values ​​of GPU memory; Calculate the deviation of API call counts from historical mean and standard deviation; The target risk value is obtained by weighted summing of the output entropy change rate, the memory surge rate, and the call deviation.

4. The risk assessment and protection system for big data models according to claim 1, characterized in that, The risk assessment and protection system of the big data model also includes: The calculation module is used to calculate the noise figure based on the target risk value; The noise processing module is used to generate independent Gaussian noise with zero mean for each parameter component of the model gradient based on the square of the noise coefficient as the variance, to obtain a noise vector, and then add the noise vector to the model gradient to obtain the perturbation gradient.

5. The risk assessment and protection system for big data models according to claim 4, characterized in that, The calculation module is specifically used for: When the target risk value is less than the first noise risk threshold, the reference noise figure is used as the noise figure; When the target risk value is between the first noise risk threshold and the second noise risk threshold, the first risk difference between the target risk value and the first noise risk threshold is calculated, and the first risk difference is multiplied by the linear enhancement coefficient plus one and then multiplied by the reference noise coefficient to obtain the noise coefficient; When the target risk value is greater than or equal to the second noise risk threshold, the second risk difference between the target risk value and the second noise risk threshold is calculated. The second risk difference is multiplied by the exponential amplification factor to obtain the power of the natural exponent, and then multiplied by the reference noise coefficient to obtain the noise coefficient.

6. The risk assessment and protection system for big data models according to claim 1, characterized in that, The restriction module is specifically used for: When the target risk value exceeds the first scheduling risk threshold, the third risk difference between the target risk value and the first scheduling risk threshold is calculated, and the square of the third risk difference is multiplied by the scheduling weight to obtain the reduced scheduling weight. The reduced scheduling weight is then updated to the global priority queue. When the target risk value exceeds the second scheduling risk threshold, a fourth risk difference is calculated based on the target risk value and the second scheduling risk threshold. The CPU reduction ratio and GPU limitation ratio are calculated based on the fourth risk difference. The number of CPU cores in the resource triplet is multiplied by the CPU reduction ratio to obtain the limited CPU quota. The GPU memory capacity in the resource triplet is multiplied by the GPU limitation ratio to obtain the limited GPU quota. The limited CPU quota and limited GPU quota are applied as limited resource quotas to the model instance.

7. The risk assessment and protection system for big data models according to claim 1, characterized in that, The risk assessment and protection system of the big data model also includes: The migration module is used to migrate the model instance from the original namespace to the sandbox namespace and configure network policies and independent resource quotas when the target risk value is detected to continuously exceed the isolation threshold for N consecutive sampling periods, so as to obtain the migrated model instance. The audit module is used to extract timestamps, input data hashes, output data hashes, and resource usage status from the API call events of the migrated model instance, concatenate them into the current audit record, and calculate the hash value based on the current audit record and the previous audit record to form a sandbox isolated instance.

8. The risk assessment and protection system for big data models according to claim 7, characterized in that, The migration module is specifically used for: The target risk value is continuously monitored over N consecutive sampling periods. When the target risk value is detected to exceed the isolation threshold continuously over N consecutive sampling periods, a migration operation is triggered and the model instance to be migrated is determined. The model instance to be migrated is kept running and migrated from the original namespace to the sandbox namespace to obtain the model instance in the sandbox; Configure a network policy that allows communication only with the audit log service for the model instances in the sandbox and allocate independent CPU quotas, GPU quotas and bandwidth quotas to obtain the migrated model instances.

9. The risk assessment and protection system for big data models according to claim 7, characterized in that, The risk assessment and protection system of the big data model also includes: The recovery trigger module is used to monitor the target risk value of the sandbox isolation instance. When the target risk value is lower than the recovery threshold for M consecutive monitoring periods, the recovery process is triggered and the sandbox isolation instance to be recovered is determined. The filtering module is used to retrieve historical snapshots of the sandbox isolation instance to be restored from the version repository, and filter historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous running time exceeding the stable running threshold as snapshot parameters; The recovery execution module is used to replace the current parameters of the sandbox isolated instance to be recovered with the snapshot parameters and migrate it back from the sandbox namespace to the normal namespace. At the same time, it restores the scheduling weight to the business weight and removes the resource quota limit to obtain the recovered model instance.

10. The risk assessment and protection system for big data models according to claim 9, characterized in that, The filtering module is specifically used for: Access the version repository and retrieve the corresponding historical snapshot based on the identifier of the sandbox isolation instance to be restored; Read the comprehensive risk score and continuous runtime associated with the historical snapshot, filter historical snapshots with a comprehensive risk score lower than the risk assessment threshold and a continuous runtime exceeding the stable operation threshold to obtain stable parameter snapshots; Extract the model weight parameters and model bias parameters from the stable parameter snapshot, and use the model weight parameters and model bias parameters as snapshot parameters.

Images