A query graph-based deep learning code model black-box attack detection method and system

Abstract

The application discloses a kind of deep learning code model black box confrontation attack detection method and system based on query graph, comprising: the input query stream of target deep learning code model is captured in real time, and feature extraction is carried out;Based on the similarity between statistical characteristics, dynamically construct query graph, introduce similarity threshold control edge establishment;For each node, calculate structure characteristic vector, and splice original feature to form enhanced node representation;Query graph is decomposed into connected subgraph, input pre-trained graph neural network classifier, and output the attack probability of each node in subgraph;When at least one node in a connected subgraph has an attack probability exceeding a predetermined threshold, determine that all queries in the subgraph are attacks, and intercept subsequent queries in real time.The application can achieve high accuracy and low false alarm rate of confrontation attack detection by analyzing query behavior patterns, has good cross-model migration ability and real-time performance, and is suitable for model as a service scenarios.

Description

Technical Field

[0001] This invention belongs to the field of deep learning model security technology, specifically relating to a method and system for detecting black-box adversarial attacks on deep learning code models based on query graphs. Background Technology

[0002] Deep learning models are widely used in code intelligence tasks, such as vulnerability prediction, code clone detection, and code classification. However, research shows that deep learning code models are vulnerable to adversarial attacks. Attackers can cause the model to output incorrect results by adding tiny perturbations to the original input. Attack methods are divided into white-box attacks and black-box attacks. Black-box attacks, which only require obtaining the model's output through a query interface, are closer to real-world cloud service scenarios and are therefore more threatening.

[0003] Existing defenses against black-box attacks are mostly concentrated in the field of computer vision, such as State Defense Models (SDMs). These methods assume a continuous input space and cannot be directly applied to discrete source code inputs. Furthermore, in a completely black-box deployment environment, defenders cannot access the model's internal parameters, gradients, or intermediate layer representations; they can only interact with the model through limited input / output interfaces. This renders traditional defenses that rely on internal information ineffective. Existing code model defense methods typically depend on internal model information (such as gradients and embeddings), making them unsuitable for completely black-box environments; or they are directly migrated from the field of computer vision and cannot effectively handle discrete code inputs.

[0004] Therefore, there is an urgent need for a black-box adversarial attack detection method that does not rely on internal model information, can adapt to the discrete input characteristics of code, and has real-time detection capabilities. Summary of the Invention

[0005] Purpose of the invention: To solve the above problems, the present invention provides a method and system for detecting black-box adversarial attacks on deep learning code models based on query graphs. By observing the external behavior of model interactions, the method analyzes the pattern characteristics of query sequences and identifies malicious attack activities.

[0006] Technical solution:

[0007] This invention proposes a black-box adversarial attack detection method for deep learning code models based on query graphs, comprising:

[0008] The input query stream of a deep learning code model is captured, and statistical features are extracted from the input query stream using statistical methods. The input query stream includes several query requests, and each query request corresponds to the extraction of a statistical feature.

[0009] Taking the query request as a node, construct an undirected attributed query graph, calculate the similarity of statistical features between any two nodes, and if the obtained similarity is greater than a preset similarity threshold, establish an edge of the query graph between the corresponding two nodes, and set the obtained similarity as the edge weight; nodes whose similarity calculated with all other nodes is less than the similarity threshold remain isolated in the query graph;

[0010] Traverse all nodes, calculate the structural feature of the node according to the node degree, and splice it with the corresponding statistical feature to form the enhanced feature of the node; decompose the query graph by using breadth-first search, isolate the nodes that remain isolated, and obtain connected subgraphs;

[0011] A pre-trained graph neural network classifier is provided, which includes an input layer, three layers of edge-conditioned convolution layers and an output layer. The connected subgraphs and the corresponding enhanced features are used as the input of the graph neural network classifier, to obtain the attack probability output of all nodes in the connected subgraphs;

[0012] If the attack probability of at least one node in the connected subgraph exceeds a preset probability threshold, it is determined that all query requests corresponding to all nodes in the connected subgraph are attack query requests, and real-time interception is performed.

[0013] Further, the statistical method is a term frequency-inverse document frequency algorithm, and the extracting statistical features from the input query stream includes:

[0014] Extract tokens from the corpus including historical queries, and the total number of tokens is set as the dimension of the statistical feature; any query request in the input query stream corresponding statistical feature is a combined vector of term frequency-inverse document frequency, expressed as ;

[0015] The statistical feature the th term frequency-inverse document frequency corresponding to the token has the calculation formula as:

[0016]

[0017]

[0018] In the formula represents the token index, is the token in the query request frequency of occurrence, is any token in the query request , is the historical query, is the total number of historical queries, For containing word elements The number of query requests.

[0019] Furthermore, the similarity of statistical features between any two nodes is calculated using cosine similarity; the similarity threshold ranges from 0.90 to 0.95.

[0020] Furthermore, the structural features are a combined vector of the statistics of the adjacent edges of the currently traversed node, including the node degree of the currently traversed node, the mean of the adjacent edge weights, the maximum / minimum of the adjacent edge weights, the standard deviation of the adjacent edge weights, and the sum of the adjacent edge weights; the structural features of isolated nodes are zero vectors.

[0021] Furthermore, the graph neural network classifier is trained offline using a pre-training method for the edge-conditional convolutional layer. The training samples are derived from query sequences containing real labels, and the training loss function is the binary cross-entropy loss.

[0022] Furthermore, the edge-conditional convolutional layer propagates the node features in the connected subgraph layer by layer, denoted as the currently processed node. The corresponding input enhancement features are The transmission process is represented as:

[0023]

[0024] In the above formula, Represents a node The neighboring nodes, Representing neighboring nodes index, Represents the enhanced features of neighboring nodes; Indicates connection , The edge weights between two nodes; It is a multilayer perceptron. It is a self-loop parameter matrix; The nodes are processed by convolutional layers. The enhanced features are passed through three edge-conditional convolutional layers to form nodes. Aggregation features.

[0025] Furthermore, the output layer includes a Sigmoid function. The output layer receives aggregated features formed by three edge-conditional convolutional layers and maps the probability that the query request represented by the corresponding node is an attack through the Sigmoid function.

[0026] Furthermore, the construction of the query graph for undirected attributes includes:

[0027] A non-overlapping sliding window mechanism is used to control the graph size, dividing consecutive query requests into windows of a preset length, and constructing a query graph independently within each window; the preset length ranges from 200 to 1000 query requests; after the attack query request is determined, the sliding window cache is cleared.

[0028] Furthermore, the real-time interception includes:

[0029] The attack query request is intercepted, and the identifier corresponding to the attack query request is added to the blacklist. If the identifier of a subsequent query request matches the blacklist, the detection of the graph neural network classifier is skipped, and the query is directly intercepted. The identifier in the blacklist is automatically removed after a preset cooldown time.

[0030] On the other hand, this invention also proposes a black-box adversarial attack detection system for deep learning code models based on query graphs, comprising:

[0031] The statistical feature extraction module is used to capture the input query stream of the deep learning code model and extract statistical features from the input query stream using statistical methods; the input query stream includes several query requests, and each query request corresponds to the extraction of a statistical feature;

[0032] The query graph module is used to construct an undirected query graph with query requests as nodes. It calculates the similarity of statistical features between any two nodes. If the obtained similarity is greater than a preset similarity threshold, an edge is established between the corresponding two nodes, and the obtained similarity is set as the edge weight. Nodes whose calculated similarity with other nodes is less than the similarity threshold remain isolated in the query graph. It traverses all nodes, calculates the structural features of the nodes based on their degree, and concatenates them with the corresponding statistical features to form the enhanced features of the nodes. It uses breadth-first search to decompose the query graph, isolates the isolated nodes, and obtains a connected subgraph.

[0033] The graph neural network classifier includes an input layer, three edge-conditional convolutional layers, and an output layer. It takes the connected subgraph and the corresponding enhancement features as input to the graph neural network classifier and outputs the attack probability of all nodes in the connected subgraph.

[0034] The determination module is used to determine whether there is at least one node in the connected subgraph whose attack probability exceeds a preset probability threshold. If so, the query requests corresponding to all nodes in the connected subgraph are determined to be attack query requests and are intercepted in real time.

[0035] Beneficial effects:

[0036] (1) Independent of internal model information. This invention captures the input query stream in real time and extracts TF-IDF statistical features, dynamically constructing a query graph with queries as nodes and semantic similarity as edges, making the detection process completely independent of the model's internal architecture. The entire defense chain only relies on input and output logs, without needing to access model parameters, gradients, or intermediate layer representations. This fundamentally solves the pain point of traditional defense methods failing due to the inability to obtain internal information in a black-box environment. This allows the invention to be deployed plug-and-play on any cloud code model API gateway layer, maintaining stable transfer performance on different pre-trained models.

[0037] (2) Adapting to the discrete input characteristics of the code. This invention extracts and concatenates structural features and statistical features, which not only include information about the nodes themselves, but also local topological information between nodes. This effectively preserves the node connection relationships and neighborhood structure in the discrete input, thereby improving the model's ability to represent discrete graph structure data. By fusing information from neighboring nodes, the information isolation between discrete nodes is reduced, enabling the node augmentation feature representation to reflect the local structural context and improving the model's adaptability to discrete input.

[0038] (3) Real-time detection capability. This invention introduces a similarity threshold to construct a sparse query graph and uses connected subgraphs as detection units. It combines edge-conditional graph convolutional networks to dynamically and differentially modulate edge weights, accurately capturing the dense connection patterns unique to attack sequences. This mechanism enables attack samples to form semantically highly clustered connected components in the graph, while normal queries remain isolated because they cannot reach the strict threshold. This results in a high F1 score under various attack methods, significantly improving detection accuracy while significantly reducing false alarm rate, effectively balancing security defense capabilities and normal user experience. Attached Figure Description

[0039] Figure 1 This is a flowchart of the method of the present invention;

[0040] Figure 2 This is a schematic diagram of the query graph construction process. Detailed Implementation

[0041] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. The present invention provides a method for detecting black-box adversarial attacks on deep learning code models based on query graphs, such as... Figure 1 The flowchart shown is a method of the present invention, which specifically includes the following steps:

[0042] Step 1: Query flow feature extraction.

[0043] The system captures the input query stream of the target deep learning code model in real time, extracts features from each query, and obtains statistical features representing the semantics of the query. It continuously receives query requests. Each query contains a code snippet. Statistical feature extraction employs statistical methods, independent of internal model information, specifically the Term Frequency-Inverse Document Frequency (TF-IDF) algorithm. This algorithm extracts the vocabulary from the historical query corpus and converts each code snippet into a statistical feature vector. The specific steps include:

[0044] Step 1-1: Extract a vocabulary from the historical query corpus. The vocabulary contains all lexical units appearing in the code snippet, and sets the feature dimension N. The value of N ranges from 500 to 2000, and is preferably 1000 in this embodiment.

[0045] Steps 1-2, for the query Its statistical eigenvector Represented as:

[0046]

[0047] Statistical characteristics No. Term frequency - reverse file frequency for each lexical unit The calculation formula is:

[0048]

[0049]

[0050] in as a word element In the query Frequency of occurrence in For historical query collection, This represents the total number of historical queries. For containing word elements The number of queries.

[0051] Step 2, Incremental query graph construction.

[0052] Dynamically construct a query graph based on the similarity between statistical feature vectors. The query graph is an undirected attribute graph, where nodes represent query instances and node attributes include statistical features; edges represent semantic relationships between queries, and edge weights are determined by similarity metrics.

[0053] A similarity threshold S is introduced during the construction of the query graph. A connection edge is established only when the similarity between two queries exceeds S; otherwise, the nodes remain isolated. The similarity threshold S ranges from 0.90 to 0.95, and in this embodiment, S=0.92 is preferred.

[0054] Specifically, a non-overlapping sliding window mechanism is used to control the graph size, including: dividing continuous queries into windows of length L, independently constructing and detecting query graphs within each window, and clearing the graph structure after the window ends; the value of L is in the range of 200~1000, with a preferred value of 500.

[0055] Within each window, when a new query Upon arrival, perform the following steps:

[0056] Step 2-1, extract the new query Statistical eigenvectors Create the corresponding node ;

[0057] Step 2-2, Calculate With all existing nodes in graph G similarity In this embodiment, the similarity measurement method uses cosine similarity, expressed as:

[0058]

[0059] in Let ||·|| denote the dot product of vectors, and ||·|| denote the L2 norm of the vectors. Indicates querying the graph The corresponding query express Statistical eigenvectors.

[0060] Steps 2-3, for each node ,like Then in and Add an undirected edge between them, with the edge weight set to 1. If no node satisfies the conditions, then... Add it to the graph as an isolated node.

[0061] Steps 2-4 involve calculating structural feature vectors for all nodes in the resulting query graph. This encodes the local topological information of each node, including the mean, maximum, minimum, standard deviation, and sum of outgoing edge weights, as well as the node's degree. The structural features are then concatenated with the original query features to form an enhanced node representation.

[0062] For any node Get the weight set of all its adjacent edges. Calculate the following six statistics as structural feature vectors. :

[0063]

[0064] in Representative node The number of adjacent edges (i.e., nodes) The degree of the node reflects the breadth of connections in the query graph; Represents a node The average weight of all adjacent edges reflects the average similarity between the node and its neighboring nodes. Represents a node The maximum value of all adjacent edge weights reflects the closeness between the node and its most similar neighbor; Represents a node The minimum value of all adjacent edge weights reflects the degree of association between the node and its least similar neighbor; Represents a node The standard deviation of all adjacent edge weights reflects the dispersion or volatility of the adjacent edge weights of a node; if a node has no adjacent edges, all statistics are set to 0.

[0065] The statistical feature vector obtained in step 1 Treat as the original feature vector , and structural feature vector splicing together to form nodes Enhanced features .

[0066] Steps 2-5: When the number of queries in the window reaches L, the query graph at this point is... Proceed to step 3, then clear the graph structure and begin the next window.

[0067] like Figure 2 The query graph constructed for this embodiment shows seven query nodes (queries 1 to 7) within a non-overlapping sliding window. Queries 1 to 3 are normal queries submitted by ordinary users, while queries 4 to 7 are adversarial sample query sequences submitted iteratively by attackers. The connecting edges between nodes indicate that the cosine similarity between the TF-IDF statistical feature vectors of two queries exceeds a preset threshold of 0.92. Solid lines in the graph represent strong semantic association edges established when the threshold is exceeded, while dashed lines represent weak similarity comparison relationships where the threshold is not reached and therefore no edge is actually established.

[0068] from Figure 2As can be seen, a dense, fully connected subgraph structure is formed between queries 4 and 7 (as shown in the high-density subgraph section in the figure). This is because the attacker only makes minor perturbations to the code each time when generating adversarial examples, resulting in consecutive queries in the same attack sequence being highly similar semantically (similarity S is between 0.90 and 0.95), all exceeding the threshold, hence the establishment of connecting edges. Query 1, Query 2, and Query 3 are isolated nodes, with no edge connections to any other query (as shown in the normal query section in the figure). This is because the code queries of normal users are semantically independent, and their similarity cannot reach the strict threshold of this invention (similarities are 0.23 and 0.45, respectively).

[0069] Step 3: Node-level attack probability prediction based on graph neural networks.

[0070] Query graph Decompose into connected subgraphs The decomposition process is as follows: the graph is traversed using the breadth-first search (BFS) algorithm. All nodes in the graph The graph is decomposed into several unconnected subgraphs, and isolated nodes are isolated according to the similarity threshold set in step 2. Subgraphs with connections are retained as connected subgraphs. .

[0071] All connected subgraphs are input into a pre-trained graph neural network classifier, which outputs the attack probability of each node in the subgraph. The graph neural network classifier uses an edge-conditional graph neural network (EC-GNN), which dynamically modulates information propagation according to edge weights to effectively capture dense connection patterns of highly similar queries in the attack sequence.

[0072] The graph neural network classifier of this invention comprises an input layer, three EC-GNN convolutional layers, and an output layer. The input is a connected subgraph. After processing by the input layer, all nodes and their enhanced features of the connected subgraph are extracted and fed into a three-layer EC-GNN convolutional layer. The three-layer EC-GNN convolutional layer uses the information aggregation formula to pass the enhanced features of the nodes layer by layer, and finally obtains the aggregated features. The output layer outputs the attack probability of each node by adding Sigmoid activation to the aggregated features.

[0073] The information aggregation formula used in convolutional layers is expressed as:

[0074]

[0075] In the above formula, the subscript Indicates the node currently being processed by the convolutional layer. , Represents a node The neighboring nodes, index Represents a node neighboring nodes , and This represents the enhanced features obtained for the corresponding node in step 2; It is a connection , The edge between two nodes, i.e. the cosine similarity between node queries, is calculated in the same way as in step 2-2; It is a shared multilayer perceptron used to process edge features. Mapped to transform weights; It is a learnable self-loop parameter matrix; The nodes are processed by convolutional layers. The node features are passed through three EC-GNN convolutional layers to obtain aggregated features.

[0076] The graph neural network classifier is trained offline using a three-layer EC-GNN convolutional layer. Training samples are derived from publicly available query sequences with real-world annotations, including both attack and normal queries. The attack-labeled query sequences are generated using various black-box attack methods, including variable name-level attacks, statement-level attacks, and structural transformation-level attacks. Using the same method as steps 1 to 2 of this invention, an annotated query graph of the training samples is constructed. The graph neural network classifier learns the pattern features of attack queries from this annotated query graph. The loss function used during training is node-level binary cross-entropy loss. , is represented as:

[0077]

[0078] in This represents the number of labeled query graphs in the training batch. A fully connected, labeled query graph; For the image The actual labeling is as follows: 1 indicates an attack, and 0 indicates normal operation. For graph neural network classifiers targeting graphs The probability of the output. Training stops after 100 epochs. Other training parameters set in this embodiment are shown in Table 1.

[0079] Table 1. Hyperparameters for training a three-layer EC-GNN convolutional layer

[0080]

[0081] Step 4: Online detection and interception.

[0082] When the attack probability of at least one node in a connected subgraph exceeds a preset threshold, all queries corresponding to nodes in that subgraph are determined to be attack queries. In this embodiment, the threshold is set to 0.5. The system intercepts these attack queries in real time.

[0083] Subsequent queries with the same query source as the attack query are intercepted, and the query identifiers corresponding to all nodes in the subgraph that are determined to be attack sequences are added to a dynamic blacklist. If the identifier of a subsequent query exists in the blacklist, the query is directly intercepted and no longer input into the graph neural network classifier. At the same time, a preset rejection response message is returned to the intercepted client.

[0084] After completing the attack query and judgment, clear the sliding window cache and return to step 2 to continue the detection. The query identifier in the blacklist will be automatically removed after a preset cooldown time or manually cleared by the administrator.

[0085] This embodiment provides a code vulnerability prediction API applied to a cloud service provider, based on all the steps of the above method. This API is finely tuned from the CodeBERT model; users submit code snippets via HTTP requests to obtain vulnerability probabilities. A defense system is deployed at the API gateway layer to monitor all queries in real time.

[0086] During the access to the vulnerability detection models CodeBERT, GraphCodeBERT, CodeT5, and CodeGPT (with minor adjustments), the detection results of this invention against several existing adversarial attack methods, including ACCENT, ALERT, CARROT, MHM, RNNS, and WIR, are shown in Tables 2 and 3. Table 2 shows the F1 scores of the detection results of this invention against adversarial attacks on different models, and Table 3 shows the FPR values ​​of the detection results of this invention against adversarial attacks on different models.

[0087] Table 2. F1 scores of the detection results of adversarial attacks of the present invention under different models.

[0088]

[0089] Table 3. FPR values ​​of the detection results of adversarial attacks using different models of the present invention.

[0090]

[0091] As can be seen from the comparison results above, the graph neural network designed in this invention achieves a single detection latency as low as 41.08 milliseconds, which significantly reduces the detection latency time, improves the detection efficiency of black-box adversarial attacks, and can meet the needs of online services.

Claims

1. A method for detecting black-box adversarial attacks on deep learning code models based on query graphs, characterized in that, include: Capture the input query stream of a deep learning code model and extract statistical features from the input query stream using statistical methods; The input query stream includes several query requests, and each query request corresponds to the extraction of a statistical feature. The query request is used as a node to construct an undirected attribute query graph. The similarity of statistical features between any two nodes is calculated. If the obtained similarity is greater than the preset similarity threshold, an edge of the query graph is established between the corresponding two nodes, and the obtained similarity is set as the edge weight. Nodes whose similarity scores calculated from other nodes are all less than the similarity threshold remain isolated in the query graph; Traverse all nodes, calculate the structural features of the nodes based on their degree, and concatenate them with the corresponding statistical features to form the enhanced features of the nodes; Breadth-first search is used to decompose the query graph, isolating isolated nodes to obtain a connected subgraph; It provides a pre-trained graph neural network classifier, including an input layer, three edge-conditional convolutional layers, and an output layer. It takes the connected subgraph and the corresponding enhancement features as input to the graph neural network classifier and obtains the attack probability output of all nodes in the connected subgraph. If the attack probability of at least one node in a connected subgraph exceeds a preset probability threshold, all query requests corresponding to nodes in that connected subgraph are determined to be attack query requests and are intercepted in real time.

2. The black-box adversarial attack detection method according to claim 1, characterized in that, The statistical method is a term frequency-inverse document frequency algorithm, and the extraction of statistical features from the input query stream includes: Extract lexical units from a corpus that includes historical queries, and calculate the total number of lexical units. Set as the dimension of the statistical feature; any query request in the input query stream. Corresponding statistical characteristics The combined vector of term frequency and inverse document frequency is represented as: ; Statistical characteristics No. Term frequency - reverse file frequency for each lexical unit The calculation formula is: In the formula represents the token index, is the token in the query request the occurrence frequency in, is any token in the query request , is a historical query, is the total number of historical queries, is the number of query requests containing the token .

3. The black-box adversarial attack detection method according to claim 2, characterized in that, The similarity of statistical features between any two nodes is calculated using cosine similarity; the similarity threshold ranges from 0.90 to 0.

95.

4. The black-box adversarial attack detection method according to claim 3, characterized in that, The structural features are a combination vector of the statistics of the adjacent edges of the currently traversed node, including the node degree of the currently traversed node, the mean of the adjacent edge weights, the maximum / minimum of the adjacent edge weights, the standard deviation of the adjacent edge weights, and the sum of the adjacent edge weights; the structural features of isolated nodes are zero vectors.

5. The black-box adversarial attack detection method according to claim 4, characterized in that, The graph neural network classifier is trained offline using a pre-training method. The edge-conditional convolutional layers are generated from query sequences with real labels, including query sequences generated by variable name attacks, statement attacks, and structure transformation attacks. The training loss function is binary cross-entropy loss.

6. The black-box adversarial attack detection method according to claim 5, characterized in that, The edge-conditional convolutional layer propagates the node features of the connected subgraph layer by layer, denoted as the currently processed node. The corresponding input enhancement features are The transmission process is represented as: In the above formula, Represents a node The neighboring nodes, Representing neighboring nodes index, Represents the enhanced features of neighboring nodes; Indicates connection , The edge weights between two nodes; It is a multilayer perceptron. It is a self-loop parameter matrix; The nodes are processed by convolutional layers. The enhanced features are passed through three edge-conditional convolutional layers to form nodes. Aggregation features.

7. The black-box adversarial attack detection method according to claim 6, characterized in that, The output layer includes a Sigmoid function. The output layer receives aggregated features formed by three edge-conditional convolutional layers and maps the probability that the query request represented by the corresponding node is an attack through the Sigmoid function.

8. The black-box adversarial attack detection method according to claim 7, characterized in that, The construction of the query graph of undirected attributes includes: A non-overlapping sliding window mechanism is used to control the graph size, dividing consecutive query requests into windows of a preset length, and constructing a query graph independently within each window; the preset length ranges from 200 to 1000 query requests; after the attack query request is determined, the sliding window cache is cleared.

9. The black-box adversarial attack detection method according to claim 8, characterized in that, The real-time interception includes: The attack query request is intercepted, and the identifier corresponding to the attack query request is added to the blacklist. If the identifier of a subsequent query request matches the blacklist, the detection of the graph neural network classifier is skipped, and the query is directly intercepted. The identifier in the blacklist is automatically removed after a preset cooldown time.

10. A black-box adversarial attack detection system for deep learning code models based on query graphs, characterized in that, include: The statistical feature extraction module is used to capture the input query stream of the deep learning code model and extract statistical features from the input query stream using statistical methods. The input query stream includes several query requests, and each query request corresponds to the extraction of a statistical feature. The query graph module is used to construct an undirected query graph with query requests as nodes, calculate the similarity of statistical features between any two nodes, and if the obtained similarity is greater than the preset similarity threshold, establish an edge of the query graph between the corresponding two nodes and set the obtained similarity as the edge weight. Nodes whose similarity to other nodes is less than the similarity threshold remain isolated in the query graph; all nodes are traversed, and the structural features of the nodes are calculated based on their degree, and then concatenated with the corresponding statistical features to form the enhanced features of the nodes; Breadth-first search is used to decompose the query graph, isolating isolated nodes to obtain a connected subgraph; The graph neural network classifier includes an input layer, three edge-conditional convolutional layers, and an output layer. It takes the connected subgraph and the corresponding enhancement features as input to the graph neural network classifier and outputs the attack probability of all nodes in the connected subgraph. The determination module is used to determine whether there is at least one node in the connected subgraph whose attack probability exceeds a preset probability threshold. If so, the query requests corresponding to all nodes in the connected subgraph are determined to be attack query requests and are intercepted in real time.

Images