Network attack traceability and defense system and method based on rule reasoning and multi-agent cooperation

Abstract

The invention discloses a network attack traceability and defense system based on rule reasoning and multi-agent collaboration, which comprises a multi-source data acquisition module in modular design, a quick decision-making module based on rule reasoning, a multi-agent collaboration decision-making module and an attack chain visualization module, and key tasks such as data acquisition, threat identification, path analysis and visual display are cooperatively completed. Two innovation modules of rule reasoning and multi-agent cooperation are introduced, so that the overall intelligent level of the network attack tracing and defending system is improved, the response speed and judgment accuracy of the network attack tracing and defending system in a variable threat environment and the dynamic adaptation capability of a security policy are enhanced, and the network attack tracing and defending system has important application and popularization values.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack tracing and defense system and method based on rule reasoning and multi-agent collaboration. Background Art

[0002] Existing network security tracing and protection systems are widely used in enterprise-level security operations centers (SOCs), protection of critical information infrastructure, tracing and defense of government and military network attacks, and information security prevention and control in large organizations. Their main function is to identify, analyze, trace, and respond to network attack behaviors to ensure the continuous availability of the system and the security of data.

[0003] Existing network security tracing and protection systems typically include multiple core modules: data acquisition and preprocessing, behavior analysis and detection, attack tracing, response and coordinated defense, and visualization. The data acquisition and preprocessing module collects heterogeneous data from multiple sources, including host logs, network traffic, system calls, and application logs, and cleans, standardizes, and time-aligns the data to lay the foundation for subsequent analysis. The behavior analysis and detection module uses feature matching and model-based methods to detect suspicious behavior. The attack tracing module combines logs, communication relationships, and attack signatures to restore attack paths and identify their origins. Common methods include dependency graph construction, causal analysis, and backtracking reasoning. The response and coordinated defense module automatically triggers emergency responses such as IP blocking, host isolation, and access policy adjustments, collaborating with firewalls and endpoint protection systems. The visualization module displays graphical information, including attack chains, behavior sequences, and attack timelines, improving analysis efficiency and user understanding.

[0004] While existing cybersecurity traceability and protection systems are relatively complete in structure, enabling multi-dimensional data collection and analysis, and a certain degree of attack recovery and response capabilities, they generally suffer from delayed responses, reliance on manual labor, limited detection capabilities, and insufficient coordinated defense. Therefore, new systems centered around intelligence, high-confidence reasoning, real-time coordination, and enhanced visualization capabilities have become a hot topic for research and industrial development. Summary of the Invention

[0005] The present invention aims to solve one of the technical problems existing in the related art at least to a certain extent.

[0006] One purpose of the present invention is to provide a comprehensive security platform based on rule-based reasoning and multi-intelligence collaborative technology, which can realize the rapid identification, accurate classification and dynamic tracing of network attack behaviors.

[0007] To achieve the above objectives, the present invention provides a network attack tracing and defense system based on rule-based reasoning and multi-agent collaboration, including: Multi-source data collection module, which is used to collect suspicious data from multiple heterogeneous data sources in real time, pre-process it, and then submit the pre-processed suspicious data to the message queue; The rule decision module is used to monitor the message queue, obtain suspicious data submitted by the multi-source data acquisition module, analyze and respond to it, and submit the analysis and response results to the message queue; the response results may include blocking the connection, recording an alarm, updating the log, and requesting collaborative analysis of abnormal data; The multi-agent collaborative decision-making module is used to monitor the message queue, obtain the abnormal data collaborative analysis request submitted by the rule decision module, analyze and respond to it, and submit the analysis and response results to the message queue; The attack chain visualization module is used to monitor the message queue, obtain the analysis and response results submitted by the two decision modules, and visualize them.

[0008] Preferably, the preprocessing is specifically to clean and structurally transform the suspicious data by a preset unified parsing engine, and finally format it into a standardized intermediate representation data structure.

[0009] Preferably, the analysis and response of the rule decision module are performed on suspicious data based on a predefined rule set, wherein the predefined rule set is an IF-THEN type rule set based on formal construction and is dynamically updated according to business needs.

[0010] Preferably, the multi-agent collaborative decision-making module includes multiple agents in different fields, a fusion agent and a decision-making agent: The multiple intelligent agents in different fields are used to independently analyze the same data from different perspectives and output multiple analysis results; The fusion agent is used to perform weighted fusion of the above-mentioned multiple analysis results through consistency verification and adversarial fusion methods; The decision-making agent is used to further judge the above fusion results and output the final results.

[0011] Preferably, the multi-agent collaborative decision-making module also includes a blackboard structure, through which the agents achieve information sharing and asynchronous collaboration; the blackboard structure stores the current system status, intermediate inference results, attack clues and identified contextual behavior information.

[0012] Preferably, all the intelligent agents call multiple basic large model resources during operation to perform semantic understanding, abnormal reasoning and attack behavior generation.

[0013] Preferably, the basic large model resources include a general adversarial library, an attack pattern classification library and a defense strategy knowledge base.

[0014] Preferably, the analysis and response results submitted to the message queue by the rule decision module and the multi-agent collaborative decision module are uniformly converted into structured attack chain data using a standard JSON format.

[0015] Preferably, the attack chain visualization module includes a server side and a browser side: The server is configured to monitor the message queue, obtain the structured attack chain data output by the two decision modules, and send the data to the browser in real time via the WebSocket protocol; The browser side is used to receive and parse the data output by the server side and to construct and dynamically render the graph based on the graph data visualization framework.

[0016] Another aspect of the present invention provides a network attack tracing and defense method based on rule-based reasoning and multi-agent collaboration, characterized by comprising the following steps: S1. Obtain suspicious data from multiple heterogeneous data sources in real time, pre-process the suspicious data, and establish a suspicious data set; S2. Based on the established suspicious data set, use a predefined set of rules to analyze and respond to the input data. The response actions include blocking the connection, recording an alarm, updating the log, and requesting collaborative analysis of abnormal data. S3, based on a multi-agent collaborative architecture, completes detailed analysis of the abnormal data and formulation of response actions through information sharing and distributed collaboration; S4. Based on the analysis results and response actions of steps S2-S3, they are visualized through visualization processing.

[0017] Beneficial Effects: 1. This invention innovatively introduces a rule-based rapid decision-making mechanism based on traditional network security traceability and defense systems. This mechanism, centered on an if-then rule base built from expert knowledge, offers excellent interpretability and transparency, enabling rapid judgment and response control of abnormal events. This significantly improves the system's processing efficiency and decision-making credibility in high-frequency attack scenarios. It also offers strong scalability and ease of maintenance, making it easier to adapt to dynamically evolving threat environments.

[0018] 2. This invention overcomes the limitations of traditional systems that rely on a single model and lack confidence when handling complex anomalies. It innovatively adopts a multi-agent collaborative mechanism, combined with a multi-perspective adversarial fusion strategy, to achieve information complementarity and semantic adversarial reasoning among agents. Each agent analyzes the same abnormal event from multiple dimensions such as behavioral patterns, attack paths, and contextual environments, and integrates them through consistency and difference mechanisms, effectively improving the system's decision-making accuracy, robustness, and intelligent adaptability in complex attack scenarios.

[0019] 3. Traditional systems typically rely on manual cross-verification of attack evidence. However, this invention integrates rule-based experts with the ATT&CK knowledge graph and leverages the powerful reasoning capabilities of multiple agents to automatically complete evidence association and causal chain construction without manual intervention, significantly improving efficiency and intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A framework diagram of a network attack tracing and defense system based on rule-based reasoning and multi-agent collaboration provided by an embodiment of the present invention.

[0021] Figure 2 A block diagram of message push between modules of the network attack tracing and defense system provided by an embodiment of the present invention.

[0022] Figure 3 This is an execution flow chart of the data acquisition module provided in an embodiment of the present invention.

[0023] Figure 4 This is a flowchart of the execution of the rule module provided in an embodiment of the present invention.

[0024] Figure 5 This is an execution flow chart of the visualization module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the embodiments described are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0026] The following combination Figure 1 - Figure 5 The present invention describes a network attack tracing and defense system and method based on rule reasoning and multi-agent collaboration.

[0027] Example 1: Figure 1 、 Figure 2 As shown, this embodiment provides a network attack tracing and defense system based on rule reasoning and multi-agent collaboration, including: a multi-source data acquisition module, a rule decision module, a multi-agent collaborative decision module and an attack chain visualization module; 1. Data acquisition module, which is used to achieve real-time acquisition and standardized processing of original information from multi-source heterogeneous data environments. Specifically, Figure 3 As shown, the module connects to multiple data entrances, including but not limited to network traffic monitoring terminals, host operation log systems, user behavior event recording platforms, email content parsing interfaces, etc., to collect raw data with potential characteristics of security threats.

[0028] The collected data is first cleaned and structured through a preset unified parsing engine, and finally formatted into a standardized intermediate representation data structure in JSON format to improve cross-system compatibility and subsequent processing efficiency.

[0029] To decouple data processing from decision analysis and enable asynchronous transmission, this module further integrates a message queue mechanism, preferably using the Kafka distributed stream processing framework. Upon detecting data fragments that may contain threat signatures, the collection module packages them and pushes them to the rule-based decision module, triggering subsequent security assessment and response control processes.

[0030] Second, the rule decision module is used to quickly judge and respond to input standardized security events based on the preset knowledge rule set. Its structure is as follows: Figure 4 As shown. This module relies on a formally constructed IF-THEN rule set to predefine a variety of typical threat behavior patterns and corresponding handling strategies to achieve explainable and efficient automated security decision-making. For example, a typical rule item can be expressed as: "IF the target IP appears in the blacklist AND the network traffic exceeds the threshold, THEN it is determined to be a denial of service attack." This rule performs logical judgment by combining multiple conditions and triggers corresponding defense actions. It has a clear causal chain and traceability. The module supports hierarchical management of rules and condition priority configuration, and can dynamically update the rule base according to business needs to ensure the flexibility and maintainability of the system's decision-making capabilities. Its core advantages lie in its clear reasoning process, traceable results, and fast response speed. It is particularly suitable for scenarios with high requirements for real-time and explainability, such as security alerts, fault diagnosis, anomaly detection, etc.

[0031] Normal processing logic: During the normal decision-making process, the module listens to the message queue and receives standardized event data from the multi-source data acquisition module. It first calls the built-in anomaly detection model and ATT&CK classification model to pre-process and initially classify the event. Subsequently, the event enters the rule inference engine for a multi-stage inference process, including: causal reasoning to determine the attack path; predicting the attacker's next possible action based on attack characteristics; and activating the corresponding defense rule set based on the inference results. Finally, in the execution phase, according to the defense actions defined in the rule consequences, operations such as blocking, isolation, and alerting are performed. When an anomaly occurs that cannot be decided, the module passes the data to the agent decision module via the message queue for further processing.

[0032] High-risk handling logic: When the system detects an attack with a confidence level higher than 0.9, it marks it as a high-risk event. At this point, the rule-based inference engine immediately bypasses the normal inference process, quickly matching and triggering high-priority rules to ensure a timely attack response. Triggered defensive actions include, but are not limited to: real-time blocking of suspicious network connections; logging and reporting security events to the monitoring platform; updating local security logs and synchronizing them to the log management system; and notifying other modules to coordinate responses (such as triggering agent analysis or visualization updates).

[0033] This module is highly interpretable, highly real-time, and policy customizable, and is the core logic unit for the system to achieve automated threat response and policy execution.

[0034] In addition, to facilitate further correlation analysis and tracing of events, the module will attach the processing results to the original event object in the form of annotations, generating an extended event structure containing information such as threat level, matching rule number, and disposal status for subsequent module calls and visual display.

[0035] 3. Multi-agent collaborative decision-making module, which is composed of multiple agents with autonomous analysis and reasoning capabilities. The overall multi-agent collaborative architecture is used to complete the fine identification and response strategy formulation of complex attack events through shared information structure and distributed collaboration. Figure 1 The process in the multi-agent collaborative decision-making module in

[15] is as follows. The module monitors the message queue and obtains abnormal data from the rule-based decision-making module. First, multiple domain agents independently analyze the same event from different perspectives (such as host behavior analysis, network traffic mapping, and permission change paths), outputting multiple analysis results. Then, the fusion agent performs weighted integration through consistency verification and adversarial fusion methods to enhance system robustness and decision accuracy. Finally, the decision-making agent further evaluates the fusion results based on existing attack analysis in the blackboard mechanism and outputs the final result.

[0036] Agents share information and collaborate asynchronously through a blackboard mechanism. The blackboard structure stores the current system state, intermediate inference results, attack clues, and identified contextual behavior. The fusion agent combines historical attack sequences stored in the blackboard to analyze the likely stage of the attack chain and determine whether the current event represents a continuation, escalation, or a subsequent attack.

[0037] In multi-agent collaboration, agents can leverage a variety of large-scale foundational models for semantic understanding, anomaly reasoning, and attack behavior generation. These include, but are not limited to: GPT models (such as GPT-4 and GPT-4o) for complex semantic analysis and reasoning dialogue simulation; the LLaMA model for causal reasoning and scenario modeling under structured input; and the DeepSeek model, which focuses on behavioral sequence modeling and adversarial intent identification. During reasoning, each agent can access the following specialized security knowledge bases for fact-based verification and pattern matching: the Adversarial Knowledge Base (ATT&CK) for inferring attacker tactics and technical paths; the Attack Pattern Classification Library (CAPEC) for identifying attack methods and steps; and the Defense Strategy Knowledge Base (DEFEND) for matching known defensive actions or suggesting new ones.

[0038] Fourth, the Attack Chain Visualization Module (hereafter referred to as the Visualization Module) is a core component for graphically displaying and dynamically analyzing the entire attack process. Based on the MITRE ATT&CK Common Adversarial Knowledge Base, this module transforms the previously abstract and complex attack behavior sequences into visual path diagrams, timelines, or behavioral topology maps, helping users quickly identify attack starting points, key nodes, impact paths, and attacker intent.

[0039] like Figure 5 As shown in the figure, the analysis results and response actions from the rule module and the intelligent agent collaborative decision module will be uniformly converted into an attack chain structured representation, organized in a standard JSON format, including but not limited to key fields such as attack event number, attack stage, participating nodes, timestamp, reasoning path, triggering rules, execution actions and confidence scores.

[0040] Server-side: In a system based on a browser / server (B / S) architecture, the visualization module's server-side continuously receives structured attack chain data pushed from the decision module via Kafka, a message queue middleware. This approach supports high-concurrency access, asynchronous processing, and buffer decoupling, ensuring stable and real-time data communication between the frontend and backend. The received attack chain structured data is pushed to the browser client in real time via the WebSocket protocol, ensuring low-latency and high-frequency data updates to meet the requirements of dynamic visualization rendering.

[0041] Browser: The browser-side visualization module is responsible for parsing structured data and constructing and dynamically rendering graphs based on a graph data visualization framework. Key features include: dynamic generation and updating of nodes and edges in attack chain paths; timeline display and stage stratification of attack events; support for interactive operations such as dragging, zooming, filtering, and searching; and visual encoding of attack intensity, stage, or confidence using color, icons, and animation.

[0042] In summary, by introducing two innovative modules, rule-based reasoning and multi-agent collaboration, this invention not only improves the overall intelligence level of the network attack tracing and defense system, but also enhances its response speed, judgment accuracy, and dynamic adaptation capabilities of security policies in a changing threat environment, thus possessing significant application and promotion value. The deployment environment of each module of this invention is shown in Table 1: Table 1. Deployment instructions for each module.

[0043]

[0044] Example 2: This example provides a network attack tracing and defense method based on rule-based reasoning and multi-agent collaboration, including the following steps: S1. Obtain suspicious data from multiple heterogeneous data sources in real time, pre-process the suspicious data, and establish a suspicious data set; S2. Based on the established suspicious data set, use a predefined set of rules to analyze and respond to the input data. The response actions include blocking the connection, recording an alarm, updating the log, and requesting collaborative analysis of abnormal data. S3, based on a multi-agent collaborative architecture, completes detailed analysis of the abnormal data and formulation of response actions through information sharing and distributed collaboration; S4. Based on the analysis results and response actions of steps S2-S3, they are visualized through visualization processing.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A network attack tracing and defense system based on rule-based reasoning and multi-agent collaboration, characterized by: The network attack tracing and defense system includes: Multi-source data collection module, which is used to collect suspicious data from multiple heterogeneous data sources in real time, pre-process it, and then submit the pre-processed suspicious data to the message queue; The rule decision module is used to monitor the message queue, obtain suspicious data submitted by the multi-source data acquisition module, analyze and respond to it, and submit the analysis and response results to the message queue; the response results may include blocking the connection, recording an alarm, updating the log, and requesting collaborative analysis of abnormal data; The multi-agent collaborative decision-making module is used to monitor the message queue, obtain the abnormal data collaborative analysis request submitted by the rule decision module, analyze and respond to it, and submit the analysis and response results to the message queue; The attack chain visualization module is used to monitor the message queue, obtain the analysis and response results submitted by the two decision modules, and visualize them.

2. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 1 is characterized in that: The pre-processing of the suspicious data is specifically to clean and structurally transform the suspicious data by a preset unified parsing engine, and finally format the suspicious data into a standardized intermediate representation data structure.

3. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 1 is characterized in that: The analysis and response of the rule decision module are performed on suspicious data based on a predefined rule set, which is an IF-THEN type rule set based on formal construction and is dynamically updated according to business needs.

4. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 1 is characterized in that: The multi-agent collaborative decision-making module includes multiple agents in different fields, fusion agents and decision-making agents: The multiple intelligent agents in different fields are used to independently analyze the same data from different perspectives and output multiple analysis results; The fusion agent is used to perform weighted fusion of the above-mentioned multiple analysis results through consistency verification and adversarial fusion methods; The decision-making agent is used to further judge the above fusion results and output the final results.

5. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 4 is characterized in that: The multi-agent collaborative decision-making module also includes a blackboard structure, through which the agents achieve information sharing and asynchronous collaboration; the blackboard structure stores the current system status, intermediate inference results, attack clues and identified contextual behavior information.

6. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 4 is characterized in that: All the above-mentioned intelligent agents call on a variety of basic large model resources during operation to perform semantic understanding, abnormal reasoning and attack behavior generation.

7. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 6 is characterized in that: The basic large model resources include a general confrontation library, an attack pattern classification library and a defense strategy knowledge library.

8. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 1 is characterized in that: The analysis and response results submitted to the message queue by the rule decision module and the multi-agent collaborative decision module are uniformly converted into structured attack chain data in a standard JSON format.

9. The network attack tracing and defense system based on rule reasoning and multi-agent collaboration according to claim 8 is characterized in that: The attack chain visualization module includes a server side and a browser side: The server is configured to monitor the message queue, obtain the structured attack chain data output by the two decision modules, and send the data to the browser in real time via the WebSocket protocol; The browser side is used to receive and parse the data output by the server side and to construct and dynamically render the graph based on the graph data visualization framework.

10. The network attack tracing and defense method based on rule reasoning and multi-agent collaboration according to any one of claims 1 to 9, characterized in that: The steps include: S1. Obtain suspicious data from multiple heterogeneous data sources in real time, pre-process the suspicious data, and establish a suspicious data set; S2. Based on the established suspicious data set, use a predefined set of rules to analyze and respond to the input data. The response actions include blocking the connection, recording an alarm, updating the log, and requesting collaborative analysis of abnormal data. S3, based on a multi-agent collaborative architecture, completes detailed analysis of the abnormal data and formulation of response actions through information sharing and distributed collaboration; S4. Based on the analysis results and response actions of steps S2-S3, they are visualized through visualization processing.

Images