Mobile terminal security communication method and system based on security GPT model

Abstract

The application provides a mobile terminal security communication method and system based on a security GPT model, which comprises the following steps: collecting initial communication data input by a user, filtering the initial communication data, and marking data that does not hit a whitelist as to-be-inspected data; splitting the to-be-inspected data into at least one behavior sequence unit, generating a corresponding behavior embedding vector for each behavior sequence unit, and compressing the behavior embedding vector into a semantic fingerprint; uploading the semantic fingerprint to a backend server through a dynamic token negotiation channel, so that the backend server decodes the received semantic fingerprint for attack intent, generates a security decision instruction according to the decoding result, and acquires the uploaded security decision instruction. Through the organic combination of local whitelist filtering, irreversible semantic fingerprint compression, dynamic token negotiation and manifold space anchor point matching, the application realizes accurate identification and adaptive protection of high-adversarial attacks under the premise of protecting user privacy.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a mobile terminal secure communication method and system based on the secure GPT model. Background Technology

[0002] Mobile communication security is an important research area in the field of cybersecurity. With the popularization of mobile internet, users face increasingly complex threats when communicating through mobile terminals such as smartphones and tablets, including phishing attacks, malicious links, spam messages, and various injection attacks.

[0003] Existing threat detection methods mainly fall into two categories. The first category is based on rule matching or traditional machine learning, which filters communication data in real-time by deploying keyword blacklists, regular expressions, or shallow classification models locally on the mobile device. These methods rely on manually predefined features or rules, making them ineffective at identifying adversarial attacks that have undergone obfuscation, encoding, or semantic mutation. Furthermore, they are easily bypassed by attackers through simple character transformations, resulting in significant deficiencies in detection accuracy and generalization ability. The second category is based on cloud-based large language models, which upload communication data collected from the mobile device to a server and utilize large-scale pre-trained models for semantic understanding and attack identification. While this method improves detection capabilities, it requires transmitting the user's original communication data to the cloud, posing a risk of user privacy data leakage. Summary of the Invention

[0004] The purpose of this invention is to provide a mobile terminal secure communication method and system based on the secure GPT model, aiming to solve the problems of low accuracy in communication threat detection, insufficient generalization ability, and easy leakage of user privacy data in existing technologies.

[0005] In a first aspect, the present invention provides a mobile terminal secure communication method based on the secure GPT model, the method comprising: Collect initial communication data input by the user, and call the locally deployed semantic-aware whitelist engine to filter the initial communication data, marking data that does not match the whitelist as data to be inspected; The data to be inspected is split into at least one behavioral sequence unit, and a corresponding behavioral embedding vector is generated for each behavioral sequence unit. The behavioral embedding vectors are then compressed into semantic fingerprints. The semantic fingerprint is uploaded to the backend server through a dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the secure GPT model and generate security decision instructions based on the decoding results. Obtain the security decision instruction uploaded via the dynamic token negotiation channel, and perform a baseline or rollback operation on the initial communication data based on the quality of the security decision.

[0006] Secondly, the present invention provides a mobile terminal secure communication system based on the secure GPT model, the system comprising: The data acquisition module is used to collect the initial communication data input by the user and call the locally deployed semantic awareness whitelist engine to filter the initial communication data, marking the data that does not hit the whitelist as data to be inspected. The data splitting module is used to split the data to be inspected into at least one behavior sequence unit, generate a corresponding behavior embedding vector for each behavior sequence unit, and compress the behavior embedding vectors one by one into a semantic fingerprint. The intent recognition module is used to upload the semantic fingerprint to the backend server through a dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the secure GPT model and generate security decision instructions based on the decoding results. The decision module is used to obtain security decision instructions uploaded via the dynamic token negotiation channel, and to perform baseline or rollback operations on the initial communication data according to the security decision instructions.

[0007] Thirdly, the present invention provides a storage medium that stores one or more programs, which, when executed by a processor, implement the above-described secure mobile communication method based on the secure GPT model.

[0008] Fourthly, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the above-described secure mobile communication method based on the secure GPT model.

[0009] Compared with the prior art, the present invention has the following advantages: This invention achieves accurate identification and adaptive protection against highly adversarial attacks by organically combining local whitelist filtering, irreversible semantic fingerprint compression, dynamic token negotiation, and manifold space anchor matching. It also ensures continuous security in weak network environments. Specifically, firstly, by converting raw communication data into irreversible semantic fingerprints before uploading to the cloud, it avoids the risk of user privacy leakage during transmission and processing, solving the problem of poor privacy security in existing cloud detection solutions. Secondly, by using a spiking neural network to extract behavioral embedding vectors and compressing them through chaotic mapping to generate semantic fingerprints, and combining this with anchor matching and weighted voting mechanisms in the intent manifold space for attack intent decoding, it effectively improves security without relying on a predefined rule base. The detection accuracy against highly obfuscated and highly variant adversarial attacks has been improved, overcoming the shortcomings of traditional rule matching and machine learning methods in terms of detection capabilities. Furthermore, a dynamic token is generated synchronously from environmental electromagnetic noise for channel encryption, without pre-setting a fixed key. The token value is dynamically generated for each communication, effectively resisting replay attacks and man-in-the-middle attacks, and compensating for the rigidity of existing key mechanisms. In addition, by deploying a semantically aware whitelist engine trained on the user's personal historical data on the mobile device, normal communication can be directly allowed even without a network, and the threshold can be dynamically adjusted based on user feedback. This ensures basic protection capabilities in weak or no-network environments while reducing the probability of false interception of normal communication, solving the problems of protection interruption and high false alarm rates in existing solutions under poor network conditions. Attached Figure Description

[0010] Figure 1 This is a flowchart of a mobile terminal secure communication method based on the secure GPT model proposed in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a mobile terminal secure communication system based on the secure GPT model proposed in an embodiment of the present invention.

[0011] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0013] like Figure 1 As shown, an embodiment of the present invention proposes a mobile terminal secure communication method based on the secure GPT model. The method includes steps S101 to S104, wherein: Step S101: Collect the initial communication data input by the user, and call the locally deployed semantic awareness whitelist engine to filter the initial communication data, marking the data that does not hit the whitelist as data to be inspected; It should be noted that this embodiment first obtains the communication data entered by the user on the mobile device, including but not limited to SMS messages, emails, instant messages, and URL links. Then, it calls a semantic-aware whitelist engine pre-deployed locally on the mobile device, which includes a self-encoding network.

[0014] Specifically, in some embodiments, the autoencoder network is a symmetric neural network consisting of an encoder and a decoder. The encoder compresses the input data layer by layer to a low-dimensional latent space, and the decoder then reconstructs the original data dimension by encoding the latent space layer by layer. This autoencoder network uses the user's personal historical communication data as the sole training source, completing training locally on the mobile device without relying on any external datasets or cloud data. The specific training process is as follows: Data from the user's confirmed normal communications over a past period (e.g., 30 days) is collected, including text content from SMS messages, emails, instant messages, etc., actively sent and received by the user. Each data point serves as a training sample. The text in each sample is encoded at the character level or word level and then input into the autoencoder network. The training objective is to minimize the reconstruction error between the input and output, using mean squared error or cross-entropy loss as the loss function. After multiple rounds of iterative training, the network converges. At this point, the parameters of the autoencoder network are fixed and used for subsequent whitelist detection.

[0015] After training, the initial communication data is input into the encoder of the autoencoder network to obtain the corresponding latent space encoding vector; then the latent space encoding vector is input into the decoder to obtain the reconstructed initial communication data; then the reconstruction error between the original initial communication data and the reconstructed initial communication data is calculated; if the reconstruction error is less than a preset user-specific threshold, the initial communication data is determined to be whitelisted and directly allowed; if the reconstruction error is greater than or equal to the user-specific threshold, the initial communication data is determined not to be whitelisted and is marked as data to be inspected.

[0016] Traditional whitelist matching methods rely on manually predefined keywords or regular expressions, which cannot adapt to the personalized communication habits of different users and are easily bypassed by attackers through simple character variations. This embodiment employs an autoencoder network, trained using a user's historical normal communication data, enabling the model to learn the user's unique language expression patterns and semantic distribution. During detection, the error between the original data and the reconstructed data is calculated to determine whether it conforms to user habits. Normal communication, because it conforms to the training data distribution, has a small reconstruction error; abnormal communication or attack content, because it deviates from the user's habitual distribution, has a large reconstruction error. This filtering mechanism based on personalized reconstruction error requires no manual rule configuration, can adaptively fit each user's unique communication pattern, and effectively identify potential threats that deviate from normal habits.

[0017] Furthermore, in some embodiments, the step of determining the preset user-specific threshold includes: Using normal samples from users' historical communication data as the training set, the historical reconstruction error of each sample in the training set is calculated. Sort all historical reconstruction errors in ascending order, calculate the index position corresponding to the preset percentile, and use the historical reconstruction error corresponding to the index position as the initial preset user-specific threshold. When a user marks data that is not on the whitelist as normal communication, the difference is calculated. Set step size And calculate the current preset user-specific threshold. ; When a user marks communication data that matches the whitelist as abnormal communication, the difference is calculated. Set step size And calculate the current preset user-specific threshold. ,in, All of these are pre-set proportional coefficients. The maximum step size is preset.

[0018] In summary, after training an autoencoder network, a discrimination threshold needs to be set to distinguish between normal communication and data to be inspected. If the threshold remains fixed, it cannot adapt to changes in the sensitivity preferences of different users and the actual usage scenarios. This solution first initializes the threshold using the reconstruction error distribution of historical normal samples from users, for example, using the 95th percentile as the starting point to ensure the initial setting is statistically reasonable. Based on this, the threshold is dynamically adjusted by users actively marking misjudged events. When a user marks data that the system judges as to be inspected as normal, it indicates that the threshold is too low and needs to be increased; when a user marks data that the system judges as normal as abnormal, it indicates that the threshold is too high and needs to be decreased. The step size is proportional to the error difference and has a maximum step size limit to avoid threshold oscillation. This dynamic adjustment mechanism allows the system to continuously adapt to user feedback and changes in habits, gradually improving the accuracy of discrimination and reducing the false alarm rate.

[0019] Step S102: The data to be inspected is split into at least one behavior sequence unit, and a corresponding behavior embedding vector is generated for each behavior sequence unit. The behavior embedding vectors are then compressed into semantic fingerprints. It should be noted that this step divides the data to be inspected into multiple behavioral sequence units, each representing a segment with independent semantics. Then, a behavioral embedding vector is generated for each behavioral sequence unit, which captures the key semantic features within the sequence unit. Finally, all behavioral embedding vectors are compressed into a fixed-length semantic fingerprint. This fingerprint is irreversible, meaning the original data content cannot be recovered from the fingerprint, but it retains the core features used for determining attack intent.

[0020] Specifically, firstly, the mutual information entropy between adjacent characters in the data to be inspected is calculated, and the positions of characters whose mutual information entropy is lower than a preset segmentation threshold are used as segmentation boundaries to divide the data to be inspected into several behavioral sequence units. Then, the characters in each behavior sequence unit are converted into pulse sequences according to their Unicode encoding values ​​and input into the spiking neural network deployed locally on the mobile device. Next, the pulse firing frequency of the output layer of the spiking neural network within each time window is taken to form the sparse coding vector corresponding to each behavior sequence unit, which is used as the behavior embedding vector. The behavior embedding vector is then input into a compression circuit consisting of three cascaded Logistic chaotic mappers. The mapping functions of each chaotic mapper are as follows: ; in, Let be the state values ​​of the k-th level chaotic mapper in the nth and (n+1)th iterations, respectively. Let be the chaos parameters and coupling coefficients of the k-th level chaos mapper, respectively. This represents the segment value in the behavior embedding vector corresponding to the k-th level chaotic mapper; After N iterations, the lowest 8 bits of the binary representation of the final state value of each chaotic mapper are taken, totaling 24 bits, as the basic fingerprint. Then, the 24-bit basic fingerprint is subjected to bit amplification transformation to obtain a 256-bit semantic fingerprint.

[0021] In summary, since the data to be inspected needs to be converted into a feature format suitable for cloud-based detection, and to ensure the irreversibility of the conversion process and protect privacy, this embodiment first uses mutual information entropy as the basis for splitting. Positions with low mutual information entropy between adjacent characters indicate weak semantic association, making them semantically reasonable as splitting boundaries. Furthermore, it does not rely on a predefined vocabulary and can adapt to inputs of any language and format. Second, a spiking neural network is used to encode each behavioral sequence unit. The pulse firing frequency forms a sparse coding vector, which effectively captures temporal features and salience information in the sequence. Finally, a three-stage cascaded Logistic chaotic mapper is used for compression. The chaotic parameters and coupling coefficients of each stage are generated by a secure chip with true random numbers, exhibiting good irreversibility and collision resistance. After iteration, the lowest 8 bits are combined and amplified into a 256-bit semantic fingerprint.

[0022] Specifically, in some embodiments, the spiking neural network employs a leaky integral firing model. Each neuron accumulates input pulse signals, and the membrane potential decays over time. When the membrane potential exceeds a firing threshold, a pulse is output and the network is reset. Synaptic weights in the network are updated online according to the pulse time-dependent plasticity rule: if the input pulse precedes the output pulse, the synaptic weight is strengthened; if the input pulse follows the output pulse, the synaptic weight is weakened. The pulse firing frequencies of the output layer within each time window are used to construct the sparse coding vector corresponding to each behavioral sequence unit as the behavioral embedding vector. This spiking neural network encoding method can effectively capture the temporal dynamic information in the behavioral sequence units, and the sparse coding form facilitates subsequent compression processing.

[0023] Furthermore, the chaotic mapping compression process is highly irreversible, making it impossible for attackers to reverse-engineer the original data content from the 256-bit semantic fingerprint. At the same time, the chaotic parameters of different devices are different, so even the semantic fingerprints generated by the same original data on different devices are completely different, further enhancing privacy protection capabilities.

[0024] Step S103: Upload the semantic fingerprint to the backend server through the dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the security GPT model and generate a security decision instruction based on the decoding result; It should be noted that the connection between the mobile device and the backend server is established through a dynamic token negotiation channel. This channel uses dynamically generated tokens for encryption and verification in each communication, without relying on a pre-set fixed key, effectively preventing replay attacks and man-in-the-middle attacks. After receiving the semantic fingerprint, the backend server calls the secure GPT model to decode the fingerprint's attack intent, maps the fingerprint to a preset intent manifold space, and determines whether the communication data contains attack intent by matching and weighted voting with anchors of known attack types, and generates corresponding security decision instructions accordingly.

[0025] Specifically, the mobile device first collects a first environmental electromagnetic noise signal sequence at a first preset sampling frequency within a preset time window, and then obtains a second environmental electromagnetic noise signal sequence collected by the backend server at the same first preset sampling frequency. Then, the first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence are binarized respectively to obtain the first sequence and the second sequence corresponding to the first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence respectively: ; in, It is the i-th binarized value in the first sequence or the second sequence. This refers to the i-th sampled value in either the first environmental electromagnetic noise signal sequence or the second environmental electromagnetic noise signal sequence. The average sample value of the first environmental electromagnetic noise signal sequence or the second environmental electromagnetic noise signal sequence; Input the first sequence and the second sequence into the SHA-3 hash function to obtain the first token value and the second token value corresponding to the first sequence and the second sequence, respectively. Using the first token value as the key, the semantic fingerprint is encrypted using the AES-128 symmetric encryption algorithm to obtain the first ciphertext. The first ciphertext and the key's checksum are then sent to the backend server so that the backend server can decrypt the first ciphertext based on the second token value. If decryption is successful and the checksum of the second token matches the checksum of the key, then token synchronization is confirmed to be successful. At this point, the backend server inputs the semantic fingerprint obtained from decryption into the secure GPT model.

[0026] In summary, traditional pre-set key or certificate systems are vulnerable to key leakage and brute-force attacks, and their rigid key update mechanisms are ill-suited to resist replay and man-in-the-middle attacks. Therefore, this embodiment utilizes environmental electromagnetic noise as a random source. The mobile terminal and the backend server collect electromagnetic noise signals from the same geographical area within a preset time window. Due to the spatial correlation of noise, the token values ​​calculated independently by both parties tend to be consistent in probability. Furthermore, a dynamic token is obtained through binarization and SHA-3 hashing, used for symmetric encryption semantic fingerprints. This mechanism does not pre-set any fixed key; the token for each communication is related to real-time environmental noise, making it unpredictable and impossible for attackers to replay. Simultaneously, token synchronization is verified through checksum matching, ensuring that the tokens of both communicating parties are consistent before data decryption, significantly improving the security of the communication link.

[0027] Furthermore, in some embodiments, the semantic fingerprint obtained through decryption needs to be mapped to a projection point in a preset intent manifold space: ; in, Let F be the coordinates of the transmission point, and F be the semantic fingerprint. Both are weight matrices. , All are bias terms. It is a non-linear activation function. For training parameters, It is a multilayer perceptron network; Construct an intent anchor library, which includes multiple anchors, the coordinates of each anchor in the preset intent manifold space, the attack intent label corresponding to each anchor, and the radius of influence. Calculate the manifold distance between the projection point and each anchor point: ; in, For manifold distance, Let be the coordinates and the radius of influence of the i-th anchor point, respectively; Select K target anchor points whose manifold distance is greater than a first threshold, and calculate the voting weight of each target anchor point: ; Calculate the sum of the voting weights for each attack intent label: ; in, The sum of the voting weights for the attack intent label y. The attack intent label for the i-th target anchor point. This is an indicator function, which means that if the attack intent label of the i-th target anchor point is the attack intent label y, then it is set to 1, and if the attack intent label of the i-th target anchor point is not the attack intent label y, then it is set to 0. The maximum value is selected from the sum of all voting weights, and the attack intent label corresponding to that maximum value is used as the decoding result.

[0028] In summary, while traditional distance-based classification methods (such as K-nearest neighbors) support incremental expansion, in high-dimensional spaces, the curse of dimensionality causes the distance between any two points to tend to be equal, resulting in the loss of discriminative power in nearest neighbor matching and ineffective classification. To address this, we map 256-bit semantic fingerprints onto a low-dimensional intent manifold space using a multilayer perceptron. This mapping clusters semantically similar fingerprints in the manifold space, while separating semantically dissimilar fingerprints. Next, we construct an intent anchor library, where each anchor contains manifold coordinates, an attack type label, and an influence radius. During detection, we calculate the manifold distance between the projection point and each anchor, and select the K anchors with the smallest manifold distances for weighted voting. The label with the highest vote is used as the decoding result. This anchor matching mechanism exhibits good scalability; new attack types only require adding new anchors without retraining the entire classification model. Furthermore, the weighted voting method smooths the decision boundary and enhances classification robustness.

[0029] Step S104: Obtain the security decision instruction uploaded via the dynamic token negotiation channel, and perform a baseline or rollback operation on the initial communication data according to the security decision instruction.

[0030] It should be noted that the mobile device receives the security decision instructions returned by the backend server through a dynamic token negotiation channel. These instructions are transmitted in encrypted form and can only be read after being decrypted using the local token key. Based on the decision result in the instruction, the mobile device performs corresponding operations on the original initial communication data: if the instruction is a baseline operation, it performs interception, passage, or isolation according to the decision result; if the instruction is a rollback operation, it triggers the backup processing procedure.

[0031] Specifically, in order to generate security decision instructions, it is first necessary to query a preset decision mapping table based on the decoding results to obtain the corresponding baseline operation, confidence threshold and rollback operation. The preset decision mapping table includes attack intent labels and the baseline operation, confidence threshold and rollback operation corresponding to the attack intent labels. Then, the confidence score of the decoding result is calculated, which is equal to the sum of the voting weights of the decoding result divided by the sum of the voting weights of all attack intent tags; If the confidence score is greater than or equal to the confidence threshold, the security decision instruction is the baseline operation; if the confidence score is less than the confidence threshold, the security decision instruction is the rollback operation.

[0032] In some embodiments, the baseline operation includes interception, release, and isolation operations; Specifically, the mobile device receives the encrypted security decision instruction returned by the backend server through a dynamic token negotiation channel, and then uses the locally stored token key to decrypt the encrypted security decision instruction to obtain the plaintext security decision instruction; then it parses the plaintext security decision instruction to extract the instruction type field and the target field, wherein the value of the instruction type field is intercept, allow, isolate or rollback, and the target field is the local storage identifier of the initial communication data; If the value of the instruction type field is intercept, the transmission of the initial communication data to the receiver is blocked, and an interception record is stored locally. The interception record includes an interception timestamp, the semantic fingerprint of the initial communication data, the decoding result, and the confidence score. An interception prompt message is displayed in the notification bar of the mobile device. If the instruction type field is set to allow, the mobile device will allow the initial communication data to be transmitted normally to the receiver and add the semantic fingerprint of the initial communication data as a normal sample to the training set of the local semantic awareness whitelist engine for incremental updates. If the value of the instruction type field is "isolation", the mobile device will temporarily store the initial communication data in a local isolation area. The local isolation area is an encrypted storage area, and the data in the encrypted storage area is prohibited from being read or transmitted by any application. If the value of the instruction type field is rollback, the initial communication data will be rolled back, that is, the initial communication data will be uploaded to the cloud so that the user can manually review it.

[0033] In summary, based on the aforementioned mobile secure communication method using the secure GPT model, this method achieves accurate identification and adaptive protection against highly adversarial attacks while protecting user privacy through the organic combination of local whitelist filtering, irreversible semantic fingerprint compression, dynamic token negotiation, and manifold space anchor matching. It also ensures continuous security capabilities in weak network environments. Specifically, by converting raw communication data into irreversible semantic fingerprints before uploading to the cloud, the risk of user privacy leakage during transmission and processing is avoided, solving the problem of poor privacy security in existing cloud detection solutions. Secondly, by using a spiking neural network to extract behavioral embedding vectors and compressing them through chaotic mapping to generate semantic fingerprints, and combining this with anchor matching and weighted voting mechanisms in the intent manifold space for attack intent decoding, it eliminates the need for... The predefined rule base effectively improves the detection accuracy against highly obfuscated and highly variant adversarial attacks, overcoming the shortcomings of traditional rule matching and machine learning methods in terms of detection capabilities. Furthermore, it employs dynamic token generation based on environmental electromagnetic noise for channel encryption, without pre-setting a fixed key; the token value is dynamically generated for each communication, effectively resisting replay attacks and man-in-the-middle attacks, thus compensating for the rigidity of existing key mechanisms. In addition, by deploying a semantically aware whitelist engine trained on user's personal historical data on the mobile device, normal communication can be directly allowed even without a network, and the threshold can be dynamically adjusted based on user feedback. This ensures basic protection capabilities in weak or no-network environments while reducing the probability of false interception of normal communication, solving the problems of protection interruption and high false alarm rates in existing solutions under poor network conditions.

[0034] like Figure 2 As shown, one embodiment of the present invention proposes a mobile terminal secure communication system based on the secure GPT model, the system comprising: The data acquisition module 10 is used to collect the initial communication data input by the user and call the locally deployed semantic awareness whitelist engine to filter the initial communication data, and mark the data that does not hit the whitelist as data to be inspected. The data splitting module 20 is used to split the data to be inspected into at least one behavior sequence unit, generate a corresponding behavior embedding vector for each behavior sequence unit, and compress the behavior embedding vectors one by one into a semantic fingerprint. The intent recognition module 30 is used to upload the semantic fingerprint to the backend server through a dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the security GPT model and generate a security decision instruction based on the decoding result. The decision module 40 is used to obtain the security decision instruction uploaded through the dynamic token negotiation channel, and perform a baseline or rollback operation on the initial communication data according to the security decision instruction.

[0035] In another aspect, the present invention also proposes a storage medium on which one or more programs are stored, which, when executed by a processor, implement the above-described secure mobile communication method based on the secure GPT model.

[0036] In another aspect, the present invention also proposes an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to realize the above-mentioned secure mobile communication method based on the secure GPT model.

[0037] Those skilled in the art will understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain stored, communicated, propagated, or transmitted programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0038] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0039] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0040] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A mobile terminal secure communication method based on the secure GPT model, characterized in that, The method includes: Collect initial communication data input by the user, and call the locally deployed semantic-aware whitelist engine to filter the initial communication data, marking data that does not match the whitelist as data to be inspected; The data to be inspected is split into at least one behavioral sequence unit, and a corresponding behavioral embedding vector is generated for each behavioral sequence unit. The behavioral embedding vectors are then compressed into semantic fingerprints. The characters in each behavior sequence unit are converted into pulse sequences, input into a spiking neural network deployed locally on the mobile device, and the corresponding sparse coding vector is output as the behavior embedding vector. The behavior embedding vector is input into a compressed circuit consisting of three cascaded Logistic chaotic mappers; After N iterations, the lowest 8 bits of the binary representation of the final state value of each chaotic mapper are taken, totaling 24 bits, as the basic fingerprint. Then, the 24-bit basic fingerprint is subjected to bit amplification transformation to obtain a 256-bit semantic fingerprint. The semantic fingerprint is uploaded to the backend server through a dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the secure GPT model and generate security decision instructions based on the decoding results. Within a preset time window, a first environmental electromagnetic noise signal sequence is acquired at a first preset sampling frequency, and a second environmental electromagnetic noise signal sequence is acquired by a backend server at the first preset sampling frequency. The first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence are binarized respectively to obtain a first sequence and a second sequence corresponding to the first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence respectively. Input the first sequence and the second sequence into the SHA-3 hash function to obtain the first token value and the second token value corresponding to the first sequence and the second sequence, respectively. Using the first token value as the key, the semantic fingerprint is encrypted using the AES-128 symmetric encryption algorithm to obtain the first ciphertext. The first ciphertext and the key's checksum are then sent to the backend server so that the backend server can decrypt the first ciphertext based on the second token value. If decryption is successful and the checksum of the second token matches the checksum of the key, then token synchronization is confirmed to be successful. At this point, the backend server inputs the semantic fingerprint obtained from decryption into the secure GPT model. The semantic fingerprint obtained from decryption is mapped to a projection point in a predefined intention manifold space; Construct an intent anchor library, which includes multiple anchors; Calculate the manifold distance between the projection point and each anchor point, select K target anchor points whose manifold distance is greater than the first threshold, calculate the voting weight of each target anchor point, and calculate the sum of the voting weights of each attack intent label; The maximum value is selected from the sum of all voting weights, and the attack intent label corresponding to that maximum value is used as the decoding result; Obtain the security decision instruction uploaded via the dynamic token negotiation channel, and perform a baseline or rollback operation on the initial communication data according to the security decision instruction.

2. The mobile terminal secure communication method based on the secure GPT model according to claim 1, characterized in that, The semantic-aware whitelist engine includes an autoencoder network, which is trained using the user's historical initial communication data. The autoencoder network includes a decoder and an encoder. The steps of collecting initial communication data input by the user and calling a locally deployed semantic-aware whitelist engine to filter the initial communication data, marking data that does not match the whitelist as data to be inspected, include: The initial communication data is input into the encoder of the autoencoder network to obtain the corresponding latent space coding vector; then the latent space coding vector is input into the decoder to obtain the reconstructed initial communication data. Calculate the reconstruction error between the original initial communication data and the reconstructed initial communication data; If the reconstruction error is less than the preset user-specific threshold, the initial communication data is determined to be in the whitelist and is allowed to pass directly. If the reconstruction error is greater than or equal to the user-specific threshold, the initial communication data is determined not to be in the whitelist and is marked as data to be inspected.

3. The mobile terminal secure communication method based on the secure GPT model according to claim 2, characterized in that, The steps for determining the preset user-specific threshold include: Using normal samples from users' historical communication data as the training set, the historical reconstruction error of each sample in the training set is calculated. Sort all historical reconstruction errors in ascending order, calculate the index position corresponding to the preset percentile, and use the historical reconstruction error corresponding to the index position as the initial preset user-specific threshold. When a user marks data that is not on the whitelist as normal communication, the difference is calculated. Set step size And calculate the current preset user-specific threshold. ; When a user marks communication data that matches the whitelist as abnormal communication, the difference is calculated. Set step size And calculate the current preset user-specific threshold. ,in, All of these are pre-set proportional coefficients. The maximum step size is preset.

4. The mobile terminal secure communication method based on the secure GPT model according to claim 1, characterized in that, The steps of splitting the data to be inspected into at least one behavioral sequence unit, generating a corresponding behavioral embedding vector for each behavioral sequence unit, and compressing the behavioral embedding vectors one by one into a semantic fingerprint include: The mutual information entropy between adjacent characters in the data to be inspected is calculated, and the positions of characters whose mutual information entropy is lower than a preset segmentation threshold are used as segmentation boundaries to divide the data to be inspected into several behavioral sequence units.

5. The mobile terminal secure communication method based on the secure GPT model according to claim 1, characterized in that, The formulas for binarizing the first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence respectively to obtain the first sequence and the second sequence corresponding to the first environmental electromagnetic noise signal sequence and the second environmental electromagnetic noise signal sequence are as follows: ； in, It is the i-th binarized value in the first sequence or the second sequence. This refers to the i-th sampled value in either the first environmental electromagnetic noise signal sequence or the second environmental electromagnetic noise signal sequence. It is the average sample value of the first environmental electromagnetic noise signal sequence or the second environmental electromagnetic noise signal sequence.

6. The mobile terminal secure communication method based on the secure GPT model according to claim 5, characterized in that, The formula for the projection point is: ； in, Let F be the coordinates of the transmission point, and F be the semantic fingerprint. Both are weight matrices. , All are bias terms. It is a non-linear activation function. For training parameters, It is a multilayer perceptron network; The formula for manifold distance is: ； in, For manifold distance, Let be the coordinates of the i-th anchor point and the radius of influence, respectively. The formula for voting weight is: ； The formula for the sum of voting weights is: ； in, The sum of the voting weights for the attack intent label y. The attack intent label for the i-th target anchor point. The function is an indicator function, which means that if the attack intent label of the i-th target anchor point is the attack intent label y, then it is set to 1, and if the attack intent label of the i-th target anchor point is not the attack intent label y, then it is set to 0.

7. The mobile terminal secure communication method based on the secure GPT model according to claim 5, characterized in that, The step of generating security decision instructions based on the decoding results includes: The preset decision mapping table is queried based on the decoding results to obtain the corresponding baseline operation, confidence threshold and fallback operation. The preset decision mapping table includes attack intent labels and the baseline operation, confidence threshold and fallback operation corresponding to the attack intent labels. Calculate the confidence score of the decoding result, which is equal to the sum of the voting weights of the decoding result divided by the sum of the voting weights of all attack intent tags; If the confidence score is greater than or equal to the confidence threshold, the security decision instruction is the baseline operation; if the confidence score is less than the confidence threshold, the security decision instruction is the rollback operation.

8. The mobile terminal secure communication method based on the secure GPT model according to claim 7, characterized in that, The steps of obtaining the security decision instruction uploaded via the dynamic token negotiation channel and performing interception, allowance, or isolation operations on the initial communication data according to the security decision instruction include: The baseline operations include interception, release, and isolation operations; The encrypted security decision instruction returned by the backend server is received through a dynamic token negotiation channel, and the encrypted security decision instruction is decrypted using the locally stored token key to obtain the plaintext security decision instruction. Parse the plaintext security decision instruction, extract the instruction type field and the target field, wherein the value of the instruction type field is intercept, allow, isolate or rollback, and the target field is the local storage identifier of the initial communication data; If the value of the instruction type field is intercept, the transmission of the initial communication data to the receiver is blocked, and an interception record is stored locally. The interception record includes an interception timestamp, the semantic fingerprint of the initial communication data, the decoding result, and the confidence score. An interception prompt message is displayed in the notification bar of the mobile device. If the instruction type field is set to allow, the mobile device will allow the initial communication data to be transmitted normally to the receiver and add the semantic fingerprint of the initial communication data as a normal sample to the training set of the local semantic awareness whitelist engine for incremental updates. If the value of the instruction type field is "isolation", the mobile device will temporarily store the initial communication data in a local isolation area. The local isolation area is an encrypted storage area, and the data in the encrypted storage area is prohibited from being read or transmitted by any application. If the instruction type field is set to rollback, the initial communication data will be rolled back so that the user can perform manual review.

9. A mobile terminal secure communication system based on the secure GPT model, used to implement the mobile terminal secure communication method based on the secure GPT model as described in any one of claims 1-8, characterized in that, The system includes: The data acquisition module is used to collect the initial communication data input by the user and call the locally deployed semantic awareness whitelist engine to filter the initial communication data, marking the data that does not hit the whitelist as data to be inspected. The data splitting module is used to split the data to be inspected into at least one behavior sequence unit, generate a corresponding behavior embedding vector for each behavior sequence unit, and compress the behavior embedding vectors one by one into a semantic fingerprint. The intent recognition module is used to upload the semantic fingerprint to the backend server through a dynamic token negotiation channel, so that the backend server can decode the attack intent of the received semantic fingerprint based on the secure GPT model and generate security decision instructions based on the decoding results. The decision module is used to obtain security decision instructions uploaded via the dynamic token negotiation channel, and to perform baseline or rollback operations on the initial communication data according to the security decision instructions.

10. A storage medium, characterized in that, The storage medium stores one or more programs that, when executed by a processor, implement the mobile terminal secure communication method based on the secure GPT model as described in any one of claims 1-8.

Images