隐藏在业务逻辑中的数据只攻击检测
问题概述
当前的静态分析和模糊测试工具难以识别嵌入合法业务流程（如电商退款）中的数据只攻击，导致欺诈行为未被发现。此外，现有解决方案往往依赖大语言模型包装，缺乏专门的、可靠的分析手段。
痛点标签
- 在合法业务逻辑（如电商退款）中隐藏的数据只攻击难以被检测
- 现有工具多为 LLM 包装，缺乏专门的静态分析手段
待验证问题
- 您是否在自己的业务中遇到过类似的数据只攻击隐藏在合法逻辑中的情况？
- 现有的检测工具是否满足您的需求？
- 您更倾向于使用哪种类型的安全分析工具（静态分析、动态监测、专用工具等）？
证据
原话 · @匿名
Data-only attacks are somewhat low-hanging fruit. Classical static analysis could already find them before AI got this strong, and LLMs make identification even easier. But the real threat is risk buried in business logic, especially abuse of normal business logic. Take e-commerce refund abuse. Bug hunters would not even call it a risk, yet fraud rings have arbitraged millions off this kind of logic. And because the logic is legitimate business logic, it is very hard to detect.
原话 · @匿名
I'm positively surprised that their tool is not yet another LLM wrapper.The quality of research (and by extent HN submissions) has really plummeted since LLMs have become marginally useful
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。