An Application Programming Interface (API) Sensitive Data Identification Method Based on the Federated Large Language Model
Source abstract
Abstract
The traditional methods for identifying sensitive data in APIs mainly encompass rule-based and machine learning-based approaches. However, these methods suffer from inadequacies in terms of security and robustness, exhibit high false positive rates, and struggle to cope with evolving threat landscapes. This paper proposes a method for detecting sensitive data in APIs based on the Federated Large Language Model (FedAPILLM). This method applies the large language model Qwen2.5 and the LoRA instruction tuning technique within the framework of federated learning (FL) to the field of data security. Under the premise of protecting data privacy, a domain-specific corpus and knowledge base are constructed for pre-training and fine-tuning, resulting in a large language model specifically designed for identifying sensitive data in APIs. This paper conducts comparative experiments involving Llama3 8B, Llama3.1 8B, and Qwen2.5 14B. The results demonstrate that Qwen2.5 14B can achieve similar or better performance levels compared to the Llama3.1 8B model with fewer training iterations.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Big Data and Digital Economy · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China
Shanghai Fushu Technology Co., Ltd., Shanghai 311700, China
Shanghai Fudian Intelligent Technology Co., Ltd., Shanghai 311700, China
Funding
“Pioneer” and “Leading Goose” R&D Programs of Zhejiang
References (31)
Show source-provided references
1. (2024, August 05). 2023 API Security Status Report. Available online: https://www.traceable.ai/2023-state-of-api-security.
2. Salt Labs (2024, August 05). API Predictions for 2024. Available online: https://salt.security/blog/api-predictions-for-2024.
3. Cheh, C., and Chen, B.B. (2021, January 18–20). Analyzing OpenAPI Specifications for Security Design Issues. Proceedings of the 2021 IEEE Secure Development Conference (SecDev), Atlanta, GA, USA.10.1109/SecDev51306.2021.00019 ↗
4. Faruk, M.J.H., Patinga, A.J., Migiro, L., Shahriar, H., and Sneha, S. (July, January 27). Leveraging Healthcare API to transform Interoperability: API Security and Privacy. Proceedings of the 2022 IEEE 46th Annual Computers, Software, and Applicationis Conference (COMPSAC 2022), Los Alamitos, CA, USA.10.1109/COMPSAC54236.2022.00082 ↗
5. Research Towards Key Issues of API Security10.1007/978-981-16-9229-1_11 ↗
6. Vörös, T., Bergeron, S.P., and Berlin, K. (2023, January 26–29). Web content filtering through knowledge distillation of large language models. Proceedings of the 22nd IEEE/WIC International Conference on Web Intelli-gence and Intelligent Agent Technology (WI-IAT), Venice, Italy.10.1109/WI-IAT59888.2023.00058 ↗
7. Watch your language: Large language models and content moderation10.1609/icwsm.v18i1.31358 ↗
8. Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., and Qian, B. (2023). Toolllm: Facilitating large language models to master 16000+ real-world apis. arXiv.
9. Federated learning of predictive models from federated Elec-tronic Health Records10.1016/j.ijmedinf.2018.01.007 ↗
10. Blockchain-federated-learning and deep learning models for COVID-19 detection using CT Imaging10.1109/JSEN.2021.3076767 ↗
11. Shi, D., Tong, Y., Zhou, Z., Song, B., Lv, W., and Yang, Q. (2021, January 14–18). Learning to assign: Towards fair task assignment in large-scale ride hailing. Proceedings of the 27th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), Singapore.10.1145/3447548.3467085 ↗
12. Mcmahan, H.B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B.A. (2017, January 20–22). Communication-efficient learning of deep networks from decentralized data. Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, Fort Lauderdale, FL, USA.
13. Yue, L.N., Liu, Q., Du, Y.C., Gao, W.B., Liu, Y., and Ya, F.Z. (2024). FedJudge: Federated Legal Large Language Model. arXiv.
14. Xing, P.W., Lu, S.T., and Yu, H. (2024). Federated Neuro-Symbolic Learning. arXiv.
15. Jiang, J.G., Liu, X.Y., and Fan, C.Y. (2023). Low-Parameter Federated Learning with Large Language Models. arXiv.10.1007/978-981-97-7707-5_28 ↗
16. (2024, August 05). OpenAI ChatGPT. Available online: https://openai.com/chatgpt.
17. Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., and Azhar, F. (2023). Llama: Open and efficient foundation language models. arXiv.
18. Jiang, A.Q., Sablayrolles, A., Roux, A., Mensch, A., Savary, B., Bamford, C., Chaplot, D.S., Casas, D.d., Hanna, E.B., and Bressand, F. (2024). Mixtral of experts. arXiv.
19. Anil, R., Borgeaud, S., Alayrac, J., Yu, J., Soricut, R., Schalkwyk, J., Dai, A.M., Hauth, A., Millican, K., and Silver, D. (2023). Gemini: A family of highly capable multimodal models. arXiv.
20. Artificial intelligence for cybersecurity: Literature review and future research directions10.1016/j.inffus.2023.101804 ↗
21. Artificial intelligence: Revolutionizing cyber security in the digital era10.57159/gadl.jcmm.2.3.23064 ↗
22. Towards artificial intelligence-based cybersecurity: The practices and chatgpt generated ways to combat cybercrime
23. da Silva, G.D.J.C., and Westphall, C.B. (2024). A survey of large language models in cybersecurity. arXiv.
24. Motlagh, F.N., Hajizadeh, M., Majd, M., Najafi, P., Cheng, F., and Meinel, C. (2024). Large language models in cybersecurity: State-of-the-art. arXiv.
25. (2024, October 18). Web API Dataset. Available online: https://github.com/gaozhirui233/openData.
26. Dettmers, T., Pagnoni, A., Holtzman, A., and Zettlemoyer, L. (2023, January 10–16). QLORA: Efficient finetuning of quantized LLMs. Proceedings of the 37th Conference on Neural Information Processing Systems (NeurIPS), New Orleans, LA, USA.
27. Chavan, A., Liu, Z., Gupta, D., Xing, E., and Shen, Z. (2023). One-for-All: Generalized LoRA for parameter-efficient fine-tuning. arXiv.
28. Zhang, Q., Chen, M., Bukharin, A., Karampatziakis, N., He, P., Cheng, Y., Chen, W., and Zhao, T. (2023). AdaLoRA: Adaptive budget allocation for parame-ter-efficient fine-tuning. arXiv.
29. Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. (2021). Lora: Low-rank adaptation of large language models. arXiv.
30. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017, January 4–9). Attention is all you need. Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA.
31. Methodologies for the Implementation of Large Language Models in the Era of AI: Costs, Efficiency, and Effectiveness