Firewall method and apparatus for detecting automated attacks based on large models
Patent Information
- Application Number
- CN202610967342.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-01
- Publication Date
- 2026-10-16
- Estimated Expiration
- 2046-07-01
AI Technical Summary
然而，在大学校园局域网承载教务管理系统、在线选课平台、实验室资源预约系统、校园一卡通服务等多个交互平台的应用场景下，攻击者利用校内失陷主机或合法账号，通过部署定制化的自动化脚本发起攻击，导致现有技术难以有效应对
[0044] By extracting user interaction behavior features from request payloads and performing temporal behavior modeling, cross-platform jump feature vectors and payload feature vectors are output. A pre-trained large language model is used to semantically encode the cross-platform jump feature vectors, outputting a deviation sequence containing multiple semantic deviations. Based on this deviation sequence, user behavior profile features are established. The current behavior profile is compared with a pre-established baseline of normal student behavior to determine outlier distances and classify alarms. This effectively solves the technical problems in existing technologies, such as the high coupling between automated attack traffic within campus networks and normal student behavior, the overlap between attack request initiation time and peak business operations, request frequency falling within normal traffic fluctuation ranges, and attack traffic originating from internal private IP address ranges that cannot be filtered through traditional IP geofencing or threat intelligence databases. In application scenarios where university campus LANs carry multiple interactive platforms such as academic affairs management systems, online course selection platforms, laboratory resource reservation systems, and campus card services, it achieves silent identification and precise blocking of internal automated attack traffic without affecting the normal student experience of course selection, grade checking, and other critical business processes.