WO2023246237A1

WO2023246237A1 - Attack-defense confrontation simulation test method and system for network model

Info

Publication number: WO2023246237A1
Application number: PCT/CN2023/087367
Authority: WO
Inventors: 李志峰; 崔世文; 孟昌华; 王维强
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2022-06-22
Filing date: 2023-04-10
Publication date: 2023-12-28
Also published as: CN114859758A

Abstract

Embodiments of the present description provide an attack-defense confrontation simulation test method and system for a network model. The network model is deployed in a defense party platform, and the network model publicly provides a prediction service for service data to each user. In the simulation test method, an attack party platform is disguised as a user and sends a service request to the defense party platform on the basis of an attack algorithm, the service request carrying service data to be predicted. The defense party platform receives the service request sent by the attack party platform, determines a prediction result of the service data by means of the network model, and sends feedback data to the attack party platform on the basis of the prediction result. When the attack party platform receives the feedback data and the feedback data satisfies a preset condition, the attack party platform adjusts the attack algorithm, for example, adjusting the operation logic of the attack algorithm when an attack fails, and continuing the attack in a different mode. Meanwhile, the defense party platform also performs anomaly detection on the processing process of the service request, and takes a corresponding defensive measure when an anomaly is detected.

Description

An attack and defense confrontation simulation test method and system for network models

This application requests the priority of the Chinese patent application submitted to the State Intellectual Property Office of China on June 22, 2022, with the application number 2022107112943 and the application title "An offensive and defensive confrontation simulation test method and system for network models", all of which The contents are incorporated into this application by reference.

Technical field

One or more embodiments of this specification relate to the field of computer technology, and in particular, to an attack and defense simulation test method and system for a network model.

Background technique

Artificial Intelligence (AI) models represented by deep learning have achieved very good performance in various scenarios such as facial recognition, machine translation, and recommendation systems. However, AI models perform very unstable when attacked, and attackers can even make the model output the results they want.

Therefore, it is hoped that there will be improved solutions that can better simulate actual adversarial attacks on network models in order to better find ways to combat actual attacks.

Contents of the invention

One or more embodiments of this specification describe an attack and defense confrontation simulation test method and system for a network model to better simulate actual adversarial attacks against the network model and find better methods to combat actual attacks. The specific technical solutions are as follows.

In the first aspect, embodiments provide an attack and defense confrontation simulation test method for a network model, including an attacker platform and a defender platform. The network model is deployed on the defender platform. The method includes:

The attacker platform sends a service request to the defender platform based on the attack algorithm, and the service request carries business data to be predicted;

The defender platform receives the service request sent by the attacker platform, determines the prediction result of the business data through the network model, and sends feedback data to the attacker platform based on the prediction result, and Detect anomalies in the processing of business requests;

The attacker platform receives feedback data sent by the defender platform in response to the service request, adjusts the attack algorithm when the feedback data meets preset conditions, and continues to execute the attack algorithm-based attack algorithm to the defense. Steps for sending business requests to the party platform.

In one implementation, after abnormality detection is performed on the processing of the service request, the method further includes:

When an anomaly is detected, a preset defense plan is executed based on the detected anomaly information;

After executing the preset defense plan, when an abnormality is detected but not eliminated, the defense plan is adjusted and the adjusted defense plan is continued.

In one implementation, the step of detecting anomalies in the processing of the service request includes:

Perform anomaly detection based on received business requests and/or corresponding prediction results.

In one implementation, the step of adjusting the attack algorithm when the feedback data meets a preset condition includes:

When the feedback data meets the preset attack failure conditions, the operating logic in the attack algorithm is adjusted.

In one implementation, the step of sending a service request to the defender platform based on an attack algorithm includes:

Send service requests to the defender platform respectively based on multiple different attack algorithms;

The step of adjusting the attack algorithm when the feedback data meets a preset condition includes:

When there is first feedback data that satisfies the preset attack success conditions among the received feedback data for different attack algorithms, the first attack algorithm corresponding to the first feedback data is used as the attack algorithm used in subsequent attacks, Stop using other attack algorithms.

In one implementation, after stopping using other attack algorithms, the method further includes:

When the subsequently received feedback data for the first attack algorithm satisfies the preset attack failure condition, the operating logic in the first attack algorithm is adjusted.

In one implementation, the step of sending service requests to the defender platform respectively based on multiple different attack algorithms includes:

Based on multiple different attack algorithms, and under the set traffic limits corresponding to different attack algorithms, send business requests to the defender platform respectively; wherein the sum of the set traffic corresponding to the multiple attack algorithms is less than the total set traffic .

In one implementation, the step of using the first attack algorithm corresponding to the first feedback data as the attack algorithm used in subsequent attacks and stopping using other attack algorithms includes:

Based on the total remaining traffic, increase the remaining traffic corresponding to the first attack algorithm, and set the remaining traffic corresponding to other attack algorithms to 0.

In one embodiment, the method further includes:

The attacker's platform counts the number of successful attacks within a preset period and sends the number to the designated device;

The defender platform counts the number of successful defenses within the preset period and sends the number to the designated device;

The designated device evaluates the attack and defense confrontation simulation test process for the network model based on the number of successful attacks on the attacker's platform and the number of successful defenses on the defender's platform.

In the second aspect, the embodiment provides an attack and defense confrontation simulation test system for a network model, including an attacker platform and a defender platform. The network model is deployed on the defender platform. The system includes:

The attacker platform is configured to send a service request to the defender platform based on an attack algorithm, where the service request carries business data to be predicted;

The defender platform is used to receive the service request sent by the attacker platform, determine the prediction result of the business data through the network model, and send feedback data to the attacker platform based on the prediction result, and Perform anomaly detection in the processing process of the business request;

The attacker platform is used to receive feedback data sent by the defender platform in response to the service request, and When the feedback data meets the preset conditions, the attack algorithm is adjusted, and service requests are continued to be sent to the defender platform based on the attack algorithm.

In one embodiment, the defender platform is also used to:

After anomaly detection is performed on the processing of the business request, when an anomaly is detected, a preset defense plan is executed based on the detected anomaly information; after the preset defense plan is executed, all adjustments are made when the anomaly is detected but not eliminated. The defense plan is described above and continue to implement the adjusted defense plan.

In one implementation, when the attacker platform sends a service request to the defender platform based on the attack algorithm, it includes:

The attacker's platform, when adjusting the attack algorithm when the feedback data meets the preset conditions, includes:

In one implementation, the attacker platform is also used to count the number of successful attacks within a preset period and send the number to the designated device;

The defender platform is also used to count the number of successful defenses within the preset period, and send the number to the designated device, so that the designated device is based on the number of successful attacks on the attacker platform, As well as the number of times the defender's platform has successfully defended, the attack and defense confrontation simulation test process for the network model is evaluated.

In a third aspect, embodiments provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to perform any of the methods described in the first aspect.

In a fourth aspect, embodiments provide a computing device, including a memory and a processor. Executable code is stored in the memory. When the processor executes the executable code, any one of the aspects of the first aspect is implemented. method described.

In the methods and devices provided by the embodiments of this specification, the attacker's platform sends service requests to the defender's platform based on the attack algorithm, receives feedback data, adjusts the attack algorithm when the feedback data meets the preset conditions, and then continues to attack the defender's platform. ; The defender platform determines the prediction results of the business data in the business request through the network model, sends feedback data to the attacker platform, and performs anomaly detection on the entire business request processing process. This simulation test method of attack and defense confrontation more realistically simulates the actual situation when the attacker's platform attacks the network model. That is, the attacker's platform will continuously adjust the attack algorithm based on feedback data, and the defender's platform will also detect it in real time. abnormality, and take corresponding countermeasures. This simulation testing method better simulates actual adversarial attacks against network models, providing a way to find better ways to combat actual attacks; at the same time, through this simulation process, the defender platform can also find ways to combat actual attacks. A better way to attack.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without exerting creative efforts, other drawings can also be obtained based on these drawings. picture.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

Figure 2 is a schematic flow chart of an attack and defense confrontation simulation test method for a network model provided by the embodiment;

FIG. 3 is a schematic block diagram of an attack and defense confrontation simulation test system for a network model provided by the embodiment.

Detailed ways

The solutions provided in this specification will be described below in conjunction with the accompanying drawings.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. Among them, an attack plan is developed for the attacker and a defense plan is developed for the defender. The attacker uses the attack plan to send business requests to the defender to call the AI model for prediction. As a party that publicly provides prediction services, the defender provides prediction services to users based on the AI model it runs. When the defender receives a business request sent by the attacker and no anomaly is detected, it will follow the normal business process and input the business data carried in the business request into the AI model to obtain the prediction results and provide the attacker with the prediction results based on the prediction results. Send feedback data. The attacker will use the attack plan to send attacks to the defender multiple times and in various ways, and the defender will also detect in real time whether there are any abnormalities in the processing of business requests. Once a certain attack method is successful, the attacker will concentrate all traffic and use this attack method to attack the AI model; if no attack is successful after a period of time, the attack plan will be updated. Once the defender detects an abnormality or possible attack, it will adopt a corresponding defense plan. If the defense is successful, the attack and defense confrontation process and the defense plan will be recorded and used as defense in actual business processing. plan; if the defense fails, this process of attack and defense confrontation can provide maintenance personnel with a reference for improving the defense plan and improving the stability of the network model.

Among them, the AI model can also be called a network model, which can be a network model obtained by using deep learning methods. This network model can be used to predict input business data and obtain prediction results. The prediction results include types such as predicted classification and predicted value. That is to say, the network model can be a classification model or a regression model that outputs a predicted value, which is not limited in this application. Business data includes characteristic data of users, products, images, text, audio and other objects.

The above attackers are designed to simulate actual attackers. In practice, attackers use a variety of attack algorithms against network models, including backdoor attacks, poisoning attacks, adversarial samples, etc. Using a certain attack algorithm to attack several fixed defense algorithms, or using a certain defense algorithm to deal with certain classic attack algorithms to test the defense effect, are all static attack-defense confrontations. In actual business scenarios, the real confrontation is the confrontation between the attack system and the defense system, which changes dynamically. In this process, the attacker is constantly looking for effective attack methods, and the defender is constantly detecting defense vulnerabilities and upgrading the defense system. Therefore, based on this, this embodiment provides a network model attack and defense confrontation testing method that can simulate real scenarios.

In this simulation test method, in step S210, the attacker's platform sends a service request to the defender's platform based on the attack algorithm, and the service request carries the service data to be predicted. In step S220, the defender platform receives the service request sent by the attacker platform, determines the prediction results of the business data through the network model, sends feedback data to the attacker platform based on the prediction results, and performs anomaly detection on the processing of the service request. In step S230, the attacker platform receives the feedback data sent by the defender platform in response to the business request, and adjusts the feedback data when the feedback data meets the preset conditions. Attack algorithm, continue to perform the steps of sending service requests to the defender platform based on the attack algorithm. This simulation testing method can simulate the dynamic confrontation between the attack system and the defense system. The attacker constantly changes the attack algorithm, and the defender continuously detects defense vulnerabilities and upgrades the defense system, thus simulating the actual network model. The adversarial attack method provides a way to find better ways to combat actual attacks.

This embodiment will be described in detail below with reference to FIG. 2 .

FIG. 2 is a schematic flowchart of an attack and defense confrontation simulation test method for a network model provided by the embodiment. This method includes the attacker's platform corresponding to the attacker, and the defender's platform corresponding to the defender. The network model is deployed in the defender platform. The network model can be a trained model that is used to determine the prediction results of the input business data based on the trained model parameters. For example, it can be used to recognize images, classify users into high-risk and low-risk categories, or determine user treatment. The level of interest in recommended content, etc. Both the attacker platform and the defender platform can be implemented through any device, device, platform, device cluster, etc. with computing and processing capabilities. The method includes the following steps.

In step S210, the attacker platform A sends a service request to the defender platform B based on the attack algorithm. Among them, the service request carries the service data to be predicted. The attacker's platform A can obtain the original data, process the original data based on the attack algorithm, obtain the business data to be predicted, and generate a business request based on the business data. Attacker platform A can use multiple raw data to generate multiple service requests correspondingly, and send multiple service requests to defender platform B.

For example, when the attack algorithm is an adversarial sample attack algorithm, the attacker platform A can add disturbances that are imperceptible to the human eye in the original sample to obtain a processed sample, and use such a sample as business data. The attacker's platform A generates a business request based on the business data and sends it to the defender's platform B. This business request is used to request the defender platform B to use its network model to determine the prediction results for the business data.

For example, the attacker's platform can make some changes to the image of a cat, and through recognition by the network model, obtain the image recognition result that it is a dog. These perturbations will not affect human recognition, but they can easily cause the network model to make incorrect predictions.

The above attack algorithm can be one or more. The attack algorithm can be selected from a variety of existing attack algorithms, or it can be a generated attack algorithm. The attacker platform A can also send service requests to the defender platform B based on multiple (two or more) different attack algorithms at the same time. Attacker platform A can use different attack algorithms to process the original data to obtain different business data to be predicted, and correspondingly generate multiple types of business requests based on different business data. The types mentioned in different types of business requests can be understood as the types corresponding to business requests carrying business data obtained using different attack algorithms.

In step S220, the defender platform B receives the service request sent by the attacker platform A, determines the prediction results of the business data through the network model, and sends feedback data to the attacker platform A based on the prediction results. In addition, defense platform B can also detect abnormalities in the processing of the above business requests in real time.

Defender Platform B is a platform that simulates and utilizes network models to publicly provide prediction services. When the defender platform B does not detect an abnormality, it will process the received business request according to the normal process. For example, the business data carried in the business request will be input into the network model, the prediction result of the business data will be determined through the network model, and feedback data will be sent to attack platform A based on the prediction result. When the defender platform B detects an abnormality, it can handle it in a preset way.

After determining the prediction results of the business data, the defender platform B can directly send the prediction results to the attacker platform A as feedback data, or it can generate feedback data based on the prediction results. For example, when no anomaly is detected, the prediction results can be directly sent to the attacker platform A as feedback data; when an anomaly is detected, feedback data indicating that the current service is unavailable can be sent to the attacker platform A.

When the defender platform B detects anomalies in the processing of business requests, it can perform anomaly detection based on the received business requests and/or corresponding prediction results. For example, you can count the number of business requests from a certain address within a period of time. When the number exceeds the threshold, it is considered abnormal; you can count the number of certain prediction results obtained within a period of time. When the number exceeds the normal range, It is considered that there is an abnormality. For example, in the field of credit approval, network models are used to determine whether credit approval is passed for that user based on input user data. If the credit approval rate is found to be too high within a period of time, it can be considered that there is an anomaly.

When defense platform B detects an abnormality, it can issue an abnormality warning for further processing by professionals.

In step S230, the attacker platform A receives the feedback data sent by the defender platform B in response to the business request, adjusts the attack algorithm when the feedback data meets the preset conditions, and continues to perform the attack algorithm in step S210 to send data to the defender platform B based on the attack algorithm. Business request steps.

The preset condition may be a preset attack success condition or a preset attack failure condition. When the feedback data contains prediction results for business data, if the prediction results meet the attack purpose preset by the attacker, the feedback data is considered to meet the attack success conditions. If the prediction result does not achieve the attacker's attack purpose, the feedback data is considered not to meet the attack success conditions. For example, the attacker performs a slight perturbation on the image of a cat, and the purpose of the attack is to hope that the image of the cat will be recognized as an image of a dog. If the prediction result shows that the network model recognizes the cat image as a dog image, the prediction result is considered to have achieved the purpose of the attack, and the feedback data meets the conditions for a successful attack. Or, the attacker slightly perturbs the cat image, and the purpose of the attack is to reduce the probability of the cat image being correctly recognized by 20%. If its predicted value is reduced by more than 20% compared to the correct recognition probability of the image without perturbation, it is considered that the predicted value has achieved the purpose of the attack, and the feedback data meets the conditions for a successful attack. When the attack is successful, the attack algorithm is considered to have successfully attacked the network model.

Similarly, for attack failure, it can be considered that the feedback data that does not meet the attack success conditions are consistent with the attack failure conditions. The attack failure can also be determined based on the number of sent business requests. For example, when m business requests sent all fail to attack, this attack algorithm is considered to have failed.

When the feedback data meets the preset attack failure conditions, the attacker platform A can adjust the operating logic in the attack algorithm and continue to send business requests to the defender platform B based on the adjusted attack algorithm, that is, continue to attack the network model. , in order to simulate real attack behavior.

When the attacker platform A sends a service request to the defender platform B based on one or more attack algorithms, that is, after launching the attack for a period of time, the attacks have failed. The attacker platform A can adjust the attack algorithm, based on the adjusted attack algorithm. Continue to attack the defender’s platform B.

If there is first feedback data that satisfies the preset attack success conditions in the feedback data for different attack algorithms received by the attacker platform A, then the first attack algorithm corresponding to the first feedback data will be used as a subsequent attack. attack algorithm and stop using other attack algorithms. That is to say, when among multiple different attack algorithms, once a certain attack algorithm succeeds, only this attack algorithm will be used to continue attacking the defender platform B, and other attack algorithms will no longer be used.

For example, the attacker platform uses attack algorithms 1, 2 and 3 to send business data to the defender platform B respectively. When it is found that the feedback data corresponding to attack algorithm 2 meets the conditions for a successful attack, the feedback data is called the first feedback data, and the attack Algorithm 2 is called the first attack algorithm.

After stopping using other attack algorithms, the attacker platform A continues to send service requests to the defender platform B based on the first attack algorithm. When the subsequently received feedback data for the first attack algorithm meets the preset attack failure conditions, the attacker platform A can then adjust the operating logic in the first attack algorithm. In this case, the defender platform B may have detected the anomaly and adopted a corresponding defense plan to make up for the vulnerability. Therefore, the subsequent attack behavior of the first attack algorithm used by the attacker platform A will fail.

The real attack plan is limited by the operating environment of the attacker's platform A, such as the memory size, CPU computing power and other resource constraints of the attacker's platform A. In order to be closer to the real attack behavior, the request traffic of the attacker platform A can be limited and a certain proportion of the request traffic is allocated to the attacker. The traffic used by the attacker platform A when conducting the attack cannot exceed this limit.

For example, a set flow rate can be allocated to each attack algorithm, and the sum of the set flow rates corresponding to multiple attack algorithms is less than the total set flow rate. Based on multiple different attack algorithms, the attacker's platform A sends business requests to the defender's platform B respectively under the set traffic limits corresponding to different attack algorithms.

Attacker platform A can use or stop using the attack algorithm by restricting the request traffic. For example, based on the total remaining traffic, you can increase the remaining traffic corresponding to the first attack algorithm, and set the remaining traffic corresponding to other attack algorithms to 0, so as to use the first attack algorithm as the attack algorithm for subsequent attacks and stop using other attack algorithms. The purpose of the attack algorithm. Specifically, all of the total remaining traffic may be allocated to the first attack algorithm, or part of the total remaining traffic may be allocated to the first attack algorithm. All remaining traffic from other attack algorithms flows into the total remaining traffic.

For example, a total of 1,000 service requests are allocated to the attacker, and 100 service requests are initially allocated to each of the five attack algorithms. Within the 100 service requests sent based on each attack algorithm, if a certain attack algorithm a succeeds, then all remaining service requests will be allocated to the attack algorithm a, and other attack algorithms will no longer send service requests. If no attack algorithm succeeds within these 100 business requests, you can adjust these attack algorithms and continue to use the remaining 500 business requests to attack.

The above content focuses on the process of simulating real attack scenarios and attack behaviors for the attacker and adjusting the attack algorithm. In the embodiment shown in Figure 2, the defender can also simulate a real scenario to execute defense plans, perform defense upgrades, etc. The method may also include steps S240 and S250.

In step S240, after the defender platform B detects anomalies in the processing of the business request, when an anomaly is detected, the defender platform B can also execute a preset defense plan based on the detected anomaly information. Preset defense solutions may include: changing the network model to one with similar functions, or intercepting business requests from a certain address, etc.

In step S250, after the defender platform B executes the preset defense plan and detects anomalies that have not been eliminated, Adjust the defense plan and continue to implement the adjusted defense plan. When adjusting the defense plan, you can retrain the network model or set up a blacklist or whitelist.

For defender platform B, corresponding defense success conditions and defense failure conditions can also be set. For example, within a set period of time after an anomaly is detected, if the anomaly is not eliminated, the defense can be considered a failure; if the anomaly is eliminated, the defense is considered successful.

The real defense solution is limited by the operating environment of the defender's platform B, such as the memory size of the defender's platform B, the computing power of the CPU, and other resource constraints. Defender platform B can detect anomalies in the processing of business requests and adjust defense plans under set computing resources.

After the attacker platform A and the defender platform B confront each other for a period of time, the simulation test process can be evaluated based on the number of attack solutions and the number of successful defense solutions as evaluation indicators.

The attacker's platform A can count the number k1 of successful attacks within a preset period and send the number k1 to the designated device. Defender platform B can count the number k2 of successful defenses within the preset period and send the number k2 to the designated device. Specify the device to evaluate the offensive and defensive confrontation simulation test process for the network model based on the number of times k1 and k2. The designated device can be either attacker platform A or defender platform B, or it can be a third-party device.

In the above embodiment, the entire attack and defense are dynamic. Once the attack plan finds that its attack has failed, it needs to update the attack plan to try to break through the defense; once successful, all attack traffic can use this attack method to increase the number of attacks. Once the defense plan is detected to have been breached, the defense plan needs to be updated to block the attack.

In the above embodiment, the attacker's platform simulates actual business scenarios, and its attack algorithm is more likely to break the network model of real scenarios, rather than just for experimental research. At the same time, this embodiment also has certain limitations on the attacker's computing resources and computing time, and emphasizes the timeliness and computing cost of the attack algorithm. These are factors that must be considered in real attacks.

The defense aspect deals with attack methods that are close to reality, and the defense solutions developed in this scenario are more likely to be applied to actual business scenarios. At the same time, the simulation test method requires that the defense solution can respond quickly when it is breached, update and upgrade defense methods, and plug loopholes in time. Otherwise, the attacker can use successful attack methods to infinitely break through the defense. The defense solutions generated on this platform are more likely to be applied to actual business scenarios, thereby improving the security and stability of the network model.

In this specification, the "first" in terms such as first feedback data and first attack algorithm is only for convenience of distinction and description and does not have any limiting meaning.

The foregoing description describes specific embodiments of the specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desired results. Additionally, the processes depicted in the figures do not necessarily require the specific order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain implementations.

FIG. 3 is a schematic block diagram of an attack and defense confrontation simulation test system for a network model provided by the embodiment. The system includes an attacker platform 310 and a defender platform 320, and the network model is deployed on the defender platform 320. Among them, attack Both the party platform 310 and the defender platform 320 can be implemented by any device, equipment, platform, device cluster, etc. with computing and processing capabilities. The system embodiment corresponds to the method embodiment shown in Figure 2. The system 300 includes:

The attacker platform 310 is configured to send a service request to the defender platform 320 based on the attack algorithm, where the service request carries the business data to be predicted;

The defender platform 320 is used to receive the service request sent by the attacker platform 310, determine the prediction results of the business data through the network model, and send feedback data to the attacker platform 310 based on the prediction results to evaluate the business Perform anomaly detection in the request processing process;

The attacker platform 310 is configured to receive feedback data sent by the defender platform 320 in response to the service request, adjust the attack algorithm when the feedback data meets the preset conditions, and continue to send services to the defender platform 320 based on the attack algorithm. ask.

In one embodiment, defender platform 320 is also used to:

In one implementation, when the defender platform 320 detects anomalies in the processing of business requests, it includes:

In one implementation, when the attacker platform 310 adjusts the attack algorithm when the feedback data meets the preset conditions, it includes:

In one implementation, when the attacker platform 310 sends a service request to the defender platform 320 based on the attack algorithm, it includes:

Send service requests to the defender platform 320 based on multiple different attack algorithms;

The attacker platform 310 adjusts the attack algorithm when the feedback data meets the preset conditions, including:

In one implementation, the attacker platform 310 is also used to:

After stopping using other attack algorithms, when the subsequently received feedback data for the first attack algorithm satisfies the preset attack failure condition, the operating logic in the first attack algorithm is adjusted.

In one implementation, when the attacker platform 310 sends service requests to the defender platform 320 based on multiple different attack algorithms, the following include:

Based on multiple different attack algorithms, service requests are respectively sent to the defender platform 320 under the set traffic limits corresponding to the different attack algorithms; where the sum of the set traffic corresponding to the multiple attack algorithms is less than the total set traffic.

In one implementation, the attacker platform 310 uses the first attack algorithm corresponding to the first feedback data as the attack algorithm used in subsequent attacks. When it stops using other attack algorithms, it includes:

In one implementation, the attacker platform 310 is also used to count the number of successful attacks within a preset period and send the number to the designated device;

The defender platform 320 is also used to count the number of successful defenses within the preset period, and send the number to the designated device, so that the designated device is based on the number of successful attacks by the attacker platform 310, and the defense The number of successful defenses of the platform 320 is used to evaluate the attack and defense confrontation simulation test process for the network model.

The above system embodiments correspond to the method embodiments. For specific descriptions, please refer to the description of the method embodiments and will not be described again here. The system embodiment is obtained based on the corresponding method embodiment and has the same technical effect as the corresponding method embodiment. For specific description, please refer to the corresponding method embodiment.

Embodiments of this specification also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in either of Figures 1 and 2.

Embodiments of this specification also provide a computing device, including a memory and a processor. Executable code is stored in the memory. When the processor executes the executable code, any one of Figures 1 and 2 can be implemented. method described.

Each embodiment in this specification is described in a progressive manner. The same and similar parts between the various embodiments can be referred to each other. Each embodiment focuses on its differences from other embodiments. In particular, the storage medium and computing device embodiments are described simply because they are basically similar to the method embodiments. For relevant details, please refer to the partial description of the method embodiments.

Those skilled in the art should realize that in one or more of the above examples, the functions described in the embodiments of the present invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The above-mentioned specific implementation modes further describe the objectives, technical solutions and beneficial effects of the embodiments of the present invention in detail. It should be understood that the above are only specific implementation modes of the embodiments of the present invention, and are not used to limit the protection scope of the present invention. Any modifications and equivalent substitutions made on the basis of the technical solutions of the present invention , improvements, etc., should be included in the protection scope of the present invention.

Claims

An attack and defense confrontation simulation test method for a network model, including an attacker platform and a defender platform. The network model is deployed on the defender platform. The method includes:

The attacker platform sends a service request to the defender platform based on the attack algorithm, and the service request carries business data to be predicted;

The defender platform receives the service request sent by the attacker platform, determines the prediction result of the business data through the network model, and sends feedback data to the attacker platform based on the prediction result, and Detect anomalies in the processing of business requests;

The attacker platform receives feedback data sent by the defender platform in response to the service request, adjusts the attack algorithm when the feedback data meets preset conditions, and continues to execute the attack algorithm-based attack algorithm to the defense. Steps for sending business requests to the party platform.
The method according to claim 1, after performing anomaly detection on the processing of the service request, further comprising:

When an anomaly is detected, a preset defense plan is executed based on the detected anomaly information;

After executing the preset defense plan, when an abnormality is detected but not eliminated, the defense plan is adjusted and the adjusted defense plan is continued.
The method according to claim 1, the step of detecting anomalies in the processing of the service request includes:

Perform anomaly detection based on received business requests and/or corresponding prediction results.
The method according to claim 1, the step of adjusting the attack algorithm when the feedback data meets a preset condition includes:

When the feedback data meets the preset attack failure conditions, the operating logic in the attack algorithm is adjusted.
According to the method of claim 1, the step of sending a service request to the defender platform based on an attack algorithm includes:

Send service requests to the defender platform respectively based on multiple different attack algorithms;

The step of adjusting the attack algorithm when the feedback data meets a preset condition includes:

When there is first feedback data that satisfies the preset attack success conditions among the received feedback data for different attack algorithms, the first attack algorithm corresponding to the first feedback data is used as the attack algorithm used in subsequent attacks, Stop using other attack algorithms.
The method according to claim 5, after stopping using other attack algorithms, the method further includes:

When the subsequently received feedback data for the first attack algorithm satisfies the preset attack failure condition, the operating logic in the first attack algorithm is adjusted.
According to the method of claim 5, the step of sending service requests to the defender platform respectively based on multiple different attack algorithms includes:

Based on multiple different attack algorithms, and under the set traffic limits corresponding to different attack algorithms, send business requests to the defender platform respectively; wherein the sum of the set traffic corresponding to the multiple attack algorithms is less than the total set traffic .
The method according to claim 7, the step of using the first attack algorithm corresponding to the first feedback data as the attack algorithm used in subsequent attacks and stopping using other attack algorithms includes:

Based on the total remaining traffic, increase the remaining traffic corresponding to the first attack algorithm, and set the remaining traffic corresponding to other attack algorithms to 0.
The method of claim 1, further comprising:

The attacker's platform counts the number of successful attacks within a preset period and sends the number to the designated device;

The defender platform counts the number of successful defenses within the preset period and sends the number to the designated device;

The designated device evaluates the attack and defense confrontation simulation test process for the network model based on the number of successful attacks on the attacker's platform and the number of successful defenses on the defender's platform.
An attack and defense confrontation simulation test system for a network model, including an attacker platform and a defender platform. The network model is deployed on the defender platform. The system includes:

The attacker platform is configured to send a service request to the defender platform based on an attack algorithm, where the service request carries business data to be predicted;

The defender platform is used to receive the service request sent by the attacker platform, determine the prediction result of the business data through the network model, and send feedback data to the attacker platform based on the prediction result, and Perform anomaly detection in the processing process of the business request;

The attacker platform is configured to receive feedback data sent by the defender platform in response to the service request, adjust the attack algorithm when the feedback data meets preset conditions, and continue to send data to the defender based on the attack algorithm. The platform sends business requests.
According to the system of claim 10, the defender platform is also used for:

After anomaly detection is performed on the processing of the business request, when an anomaly is detected, a preset defense plan is executed based on the detected anomaly information; after the preset defense plan is executed, all adjustments are made when the anomaly is detected but not eliminated. The defense plan is described above and continue to implement the adjusted defense plan.
According to the system of claim 10, when the attacker platform sends a service request to the defender platform based on an attack algorithm, it includes:

Send service requests to the defender platform respectively based on multiple different attack algorithms;

The attacker's platform, when adjusting the attack algorithm when the feedback data meets the preset conditions, includes:

When there is first feedback data that satisfies the preset attack success conditions among the received feedback data for different attack algorithms, the first attack algorithm corresponding to the first feedback data is used as the attack algorithm used in subsequent attacks, Stop using other attack algorithms.
The system of claim 10, wherein:

The attacker platform is also used to count the number of successful attacks within a preset period and send the number to the designated device;

The defender platform is also used to count the number of successful defenses within the preset period, and send the number to the designated device, so that the designated device is based on the number of successful attacks on the attacker platform, As well as the number of times the defender's platform has successfully defended, the attack and defense confrontation simulation test process for the network model is evaluated.
A computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to perform the method described in any one of claims 1-9.
A computing device includes a memory and a processor. The memory stores executable code. When the processor executes the executable code, the method according to any one of claims 1-9 is implemented.