Security defense strategy method and system based on AI Agent dynamic optimization

Abstract

The invention provides a method and a system for dynamically optimizing a security defense strategy based on an AI Agent, and aims to solve the problems that the traditional network security defense strategy is static and cannot adapt to a dynamic network environment and novel network threats, and the processing efficiency of massive security data is low and the response is not timely. The method comprises the following steps: firstly, realizing whole network node data acquisition through a distributed AI Agent, performing accurate identification in combination with a multi-dimensional threat perception and fusion detection mechanism, and establishing a threat parameter quantitative evaluation model; secondly, the AI Agent generates a dynamic defense strategy according to the analysis result of the intelligent threat detection and the real-time state of the network in combination with threat features and risk assessment; and finally, according to the dynamic defense response result, realizing attack path tracking, accurate vulnerability positioning, automatic repair execution and traceability information retention processing. According to the method, real-time sensing and quick response to network threats can be realized, and the hysteresis of a traditional static defense strategy is overcome.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity, specifically to a security defense strategy method and system based on dynamic optimization of AI Agent. Background Technology

[0002] With the rapid development of internet technology, the internet has become an indispensable part of social life and economic development. However, cybersecurity threats are also becoming increasingly prominent, exhibiting characteristics of diversification, complexity, and dynamism.

[0003] Currently, traditional cybersecurity defense strategies have significant limitations: First, traditional defense strategies are mostly statically configured, and their rules and parameters often remain unchanged for a long time after being set, making it difficult to cope with the constantly emerging new cyberattack methods. For example, new malware and viruses are constantly mutating, and their attack methods are becoming more covert and intelligent. Static defense strategies cannot identify and defend against these new threats in a timely manner.

[0004] Secondly, the network environment is constantly changing. Network traffic, device access, and business applications are all dynamically adjusted. Traditional defense strategies cannot adapt to these dynamic changes, resulting in vulnerabilities in the defense.

[0005] Furthermore, in the face of massive cybersecurity incidents and data, traditional manual analysis and decision-making methods are inefficient, making it difficult to respond quickly and handle security threats accurately. This often leads to the escalation of security incidents and causes huge losses to network systems. Summary of the Invention

[0006] This invention aims to address the problems of traditional network security defense strategies being static, unable to adapt to dynamic network environments and emerging network threats, and inefficient in processing massive amounts of security data and untimely responses. It proposes a security defense strategy method and system based on AI Agent dynamic optimization. This invention achieves adaptive decision-making and real-time optimization of network security defense through a collaborative mechanism of intelligent threat detection, dynamic defense response, and automated source tracing and remediation.

[0007] The objective of this application is achieved through the following technical solution:

[0008] Firstly, this application provides a security defense strategy method based on dynamic optimization of AI Agent, including the following steps:

[0009] Intelligent threat detection: Data collection from all network nodes is achieved through a distributed AI Agent, combined with a multi-dimensional threat perception and fusion detection mechanism to build accurate threat feature identification and risk assessment;

[0010] Dynamic defense response: The AI ​​Agent generates dynamic defense strategies based on the analysis results of the intelligent threat detection and the real-time network status, combined with the threat characteristics and the risk assessment.

[0011] Automated source tracing and remediation: Based on the results of the dynamic defense response, the system can track attack paths, accurately locate vulnerabilities, automatically perform remediation operations, and retain source tracing information.

[0012] Secondly, this application provides a security defense strategy system based on dynamic optimization of AI Agent, including:

[0013] The intelligent threat detection module is used to collect data from all nodes of the distributed AI Agent network, combine multi-dimensional threat perception and fusion detection mechanisms to accurately identify threats, and establish a quantitative assessment model for threat parameters.

[0014] The dynamic defense response module, AI Agent, generates dynamic defense strategies based on the analysis results of the intelligent threat detection and the real-time network status, combined with threat characteristics and risk assessment.

[0015] The automated source tracing and repair module, based on the dynamic defense response results, is used to track attack paths, accurately locate vulnerabilities, automatically perform repairs, and retain source tracing information.

[0016] The beneficial effects of this invention are as follows: This invention enables real-time perception and rapid response to network threats, overcoming the lag of traditional static defense strategies. The collaborative work and autonomous decision-making capabilities of the AI ​​Agent make the generation and optimization of defense strategies more intelligent and precise, improving the efficiency and effectiveness of network security defense. Simultaneously, through a closed-loop feedback mechanism, the defense strategy is continuously optimized, effectively addressing complex and ever-changing network environments and emerging network threats, significantly enhancing the overall security of the network system. Furthermore, this strategy reduces reliance on manual intervention, lowering the cost and difficulty of network security management.

[0017] Instruction manual illustrations

[0018] Figure 1 This is a schematic diagram of intelligent threat detection according to an embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the dynamic defense response in an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of automated source tracing and repair according to an embodiment of the present invention. Detailed Implementation

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] Please refer to Figure 1 , Figure 1 The diagram illustrates intelligent threat detection according to an embodiment of the present invention, including multi-dimensional threat perception, fusion detection mechanism, and risk assessment.

[0024] Specifically, in this embodiment, multi-dimensional threat perception leverages the advantages of distributed deployment of AI Agents to collect data comprehensively across all network nodes, enabling multi-dimensional threat perception. This encompasses multiple levels, including network traffic analysis, system behavior monitoring, user behavior analysis, and endpoint security monitoring. Network traffic analysis includes abnormal traffic pattern recognition and malicious communication detection; system behavior monitoring involves process anomalies, file changes, and privilege escalation; user behavior analysis covers abnormal logins, privilege abuse, and data access; and endpoint security monitoring focuses on malware, vulnerability exploitation, and lateral movement.

[0025] Specifically, in this embodiment, the fusion detection mechanism adopts a fusion detection model of "feature matching + abnormal behavior analysis + deep learning recognition". First, it matches known threat features (such as virus signatures, malicious IPs, etc.) using a knowledge base, and then quickly identifies known threats using a multi-pattern matching engine. For example, it accurately matches the encryption features of common ransomware, achieving millisecond-level blocking and covering more than 90% of conventional attacks. Next, it discovers abnormal behaviors through statistical analysis and behavioral baseline comparison. Finally, it uses a deep neural network to perform pattern recognition on unknown threats. For example, for new variant viruses, it extracts the semantic features of their code fragments, transforming threat samples (such as virus code, network traffic) into 128-dimensional semantic vectors. It discovers variant threats through vector space similarity calculation and compares them with historical threat samples to achieve accurate identification.

[0026] Specifically, in this embodiment of the application, the risk assessment is based on parameters such as the attack path, scope of impact, and potential losses of the threat, and a quantitative assessment model is constructed to classify the threat into four levels: lethal, high-risk, medium-risk, and low-risk. The specific classification criteria are as follows:

[0027] Critical: The attack has caused core business disruption, sensitive data leakage, or complete loss of system control. All affected nodes on the network must be isolated immediately and emergency response procedures must be initiated (e.g., ransomware encrypting core servers, APT attacks stealing confidential data).

[0028] High risk: Attacks can cause critical service paralysis or privilege escalation (e.g., remote code execution vulnerability exploitation, large-scale DDoS attack). The attack source must be automatically blocked and lateral spread limited within 5 seconds.

[0029] Medium risk: Local system vulnerabilities or potential penetration risks exist (e.g., unauthorized access vulnerabilities, medium-scale scanning attacks). Access control policies must be dynamically adjusted and targeted hardening triggered within 60 seconds.

[0030] Low risk: Abnormal behavior of a single node or low-risk attempts (such as port scanning or dictionary brute-force attacks) are included in the continuous monitoring queue and the handling is delayed (>5 minutes) to reduce resource consumption.

[0031] Examples of quantitative indicators used for grading include:

[0032]

[0033] The Common Vulnerability Scoring System (CVSS) is an internationally standardized vulnerability assessment framework maintained by the FIRST organization, used to objectively quantify the severity of software vulnerabilities. In the field of cybersecurity, CVSS scores are a core basis for threat classification and incident response prioritization.

[0034] Business impact coefficient = (weight of affected business × downtime) / total business weight;

[0035] The spread risk coefficient = number of infected nodes / total number of nodes.

[0036] Please refer to Figure 2 , Figure 2 A schematic diagram illustrating the dynamic defense response of an embodiment of the present invention is shown.

[0037] In this embodiment, the AI ​​Agent generates targeted dynamic defense strategies based on threat detection and analysis results and real-time network status, combined with threat characteristics and risk assessment models in the knowledge base. For example, when a new SQL injection attack pattern is detected, the system quickly analyzes the attack characteristics, calls relevant basic policies from the policy library, and automatically adjusts policy parameters, such as traffic limit thresholds and routing switching rules, based on factors such as the current network environment and attack intensity, to generate a defense strategy specifically designed to deal with this attack.

[0038] The dynamic adjustment of defense parameters strategy utilizes an adaptive threshold algorithm to intelligently adjust defense parameters, ensuring a precise match between the response strategy and the attack intensity. Its core formula is:

[0039] New threshold = baseline value × (1 + attack strength coefficient × 0.2)

[0040] The attack intensity coefficient is obtained by dynamically calculating the current attack traffic divided by the historical maximum traffic. For example, when the attack traffic reaches 80% of the historical peak (coefficient = 0.8), the system automatically raises the traffic limit threshold to 1.16 times the baseline value; if the attack continues to escalate (coefficient → 1.0), the threshold can adaptively expand to a maximum of 1.2 times the baseline value. This design allows the defense system to quickly suppress high-intensity attacks without human intervention, while avoiding excessive resource consumption in low-threat scenarios.

[0041] Specifically, as the attack landscape changes, the dynamic defense response mechanism evaluates the defense effectiveness in real time and adjusts the defense strategy accordingly. If the current firewall rules are found to be insufficient to completely block attack traffic, the system will automatically add stricter filtering rules. Furthermore, defense measures at different layers work together to form an organic whole. For example, when the network layer detects malicious traffic originating from a specific IP address, it not only blocks the traffic at the network layer but also notifies the system layer to check and process network connections associated with that IP address. Simultaneously, the application layer will also conduct more stringent verification of access requests from that IP address.

[0042] Specifically, the real-time evaluation of defense effectiveness is achieved by dynamically monitoring the defense effect through three core indicators, driving closed-loop optimization of the strategy. The three core indicators are as follows:

[0043]

[0044] In this embodiment of the application, the defense report generation and improvement suggestions are specifically implemented as follows:

[0045] Specifically, based on the quantitative indicators (attack traffic reduction rate, false positive rate, resource consumption ratio) output by the real-time effect evaluation model, combined with the current defense strategy execution logs and historical data from the knowledge base, the system automatically generates a structured defense report and outputs improvement suggestions. The specific implementation process is as follows:

[0046] Problem attribution: When the indicators are abnormal (e.g., false blocking rate > 0.1%), extract false blocking request samples and compare them with the normal business feature library in the knowledge base to locate the root cause of rule defects (e.g., high-frequency legitimate APIs are misidentified as attacks).

[0047] Strategy optimization: Call optimization templates for similar scenarios in the knowledge base (such as "WAF rule false alarm correction - solution 3") to generate targeted improvement suggestions, including parameter adjustment (relaxing the threshold for specific API request frequency), rule update (adding syntax exemption flags) or architecture expansion (deploying traffic scrubbing clusters).

[0048] Closed-loop execution: After the improvement suggestions are reviewed by the administrator or automatically triggered, the defense strategy library is dynamically updated and synchronized to the AI ​​Agent across the network. At the same time, the execution results (such as the false blocking rate being reduced to 0.03%) are fed back to the knowledge base to form a closed-loop learning, enabling the system to have the ability to continuously evolve.

[0049] In this embodiment of the application, a model update mechanism based on defense report-driven mechanism is constructed and forms a closed-loop linkage with real-time defense decision-making.

[0050] Specifically, when a defense report diagnoses anomalies in key indicators (such as a false blocking rate > 0.1%), the system automatically extracts abnormal samples and matches them with optimized templates in the knowledge base (such as "high-frequency API false alarm correction schemes"), generating a lightweight model update package (containing adjusted deep learning parameters or rule logic). The control center pushes the update package to the entire network's AI Agents via a secure channel. The Agents use double-buffering loading technology to preload the new model in memory and complete real-time inference verification (e.g., testing with historical attack data to achieve an accuracy rate ≥ 98.5%). After successful verification, the system... The atomic pointer switching seamlessly migrates real-time defense decision traffic to the updated model within 10ms, while simultaneously starting the dynamic traffic scheduler to increase the proportion of traffic to the new model by 5% increments. The system continuously monitors defense performance indicators (false blocking rate / resource consumption). If the indicators return to normal after the update (e.g., false blocking rate ≤ 0.1%), the optimization effect is fed back to the knowledge base to form a closed-loop learning. If an anomaly occurs (e.g., CPU usage suddenly increases to > 20%), the version is automatically rolled back and an alarm is triggered (for example, the false blocking rate is optimized from 0.15% to 0.03%, with a model activation delay of only 0.8 seconds).

[0051] Please refer to Figure 3 , Figure 3 This invention illustrates an automated source tracing and repair method according to an embodiment of the present invention, including the following steps:

[0052] 1. Attack Path Tracing

[0053] Specifically, multi-source heterogeneous data fusion analysis technology is employed, integrating network traffic analysis, log analysis, and threat intelligence correlation capabilities to achieve comprehensive tracking and path reconstruction of attack behaviors. The specific process is as follows: starting from the network boundary, by parsing information such as source IP, destination IP, port number, and protocol type in data packets, and combining this with the real-time network topology, the complete path of the attacker penetrating from the outside into the internal network and moving laterally within the internal network is gradually identified.

[0054] For example, when a malicious SQL injection attack is detected, the system can use the database server's access logs as a starting point to accurately trace the source of the attack request (external IP), clearly show the intermediate network nodes it flows through, and ultimately reveal how the attacker successfully accessed the database by exploiting system vulnerabilities.

[0055] 2. Precise vulnerability location

[0056] Specifically, based on successfully reconstructing the attack path, the system will further pinpoint the system vulnerabilities exploited by the attackers. Its core method involves combining a built-in knowledge base (covering common vulnerability characteristics, impact scope, and remediation suggestions) to perform targeted scanning and feature comparison of servers, terminal devices, and applications affected by the attack path.

[0057] For example, when tracing the attack back to a web server, the system automatically triggers a code audit and configuration check of that server. By matching code patterns and configuration parameters with vulnerability characteristics in the knowledge base, it can accurately identify which version of the web application framework the attacker exploited for the file upload vulnerability, thereby pinpointing the code modules or configuration items that need to be fixed.

[0058] 3. Automatic repair execution

[0059] Specifically, based on the vulnerability location results, remediation operations are automatically executed. For operating system vulnerabilities, the corresponding patches are automatically downloaded and installed; for application vulnerabilities, they are fixed by updating the application version, modifying configuration files, or adjusting code logic.

[0060] For example, if a remote code execution vulnerability is discovered in the server's operating system, the system will automatically connect to the official patch server, download and install the corresponding security patch, and perform subsequent operations such as a system restart to ensure the patch takes effect. Furthermore, tampered data can be automatically restored based on backup records, ensuring data integrity.

[0061] 4. Retention of traceability information

[0062] Specifically, the entire automated source tracing and remediation process involves detailed recording of the attack tracing process and results, including attack source information, attack methods, exploited vulnerabilities, and remediation measures. This information is used for subsequent security audits to help security managers understand the full picture of cybersecurity incidents; it is also fed back into the knowledge base to provide reference for subsequent threat detection and defense decisions, continuously enriching the system's experience in responding to various attacks.

[0063] The following specific embodiments illustrate the invention by dynamically defending against SQL injection attacks and tracing and remediating them using an AI Agent, including the following steps:

[0064] S1: System Initialization Configuration

[0065] Hardware environment:

[0066] Control Center: 2×Intel Xeon Gold 6338N CPUs / 256GB RAM

[0067] AI Agent Nodes: Deployed on the perimeter firewall (Model: FortiGate 3600F), core switch (CiscoNexus 9508), and web server cluster (Ubuntu 22.04).

[0068] Software environment:

[0069] Knowledge Base: Integrates the MITRE ATT&CK framework (v13.1) and the NVD vulnerability database (2025Q2 version).

[0070] Deep learning model: ResNet-50 variant (threat identification accuracy 98.2%)

[0071] S2: Attack scenario simulation, including:

[0072] S21: Attack Injection Point

[0073] GET / product.php?id=1' UNION SELECT username,password FROM users--HTTP / 1.1

[0074] Host: www.target.com

[0075] S22: Attack Characteristics

[0076] WAF rule ID: SQLi-1003 (UNION SELECT pattern detected)

[0077] Threat Level: High Risk (risk assessment model output score 82 / 100 > 0.7), which meets the high-risk standard of "CVSS ≥ 7.0 and business impact coefficient > 0.7".

[0078] S3: Dynamic defense response process, including:

[0079] S31: Real-time policy generation

[0080] Specifically, once the boundary AI Agent detects an attack, it triggers a dynamic defense strategy.

[0081] #Python code: Dynamically generate WAF rules.

[0082] new_rule = {

[0083] "action": "BLOCK"

[0084] "condition": "request_uri CONTAINS 'UNION SELECT'",

[0085] "priority": "CRITICAL"

[0086] "source_ip": "202.96.1.10" # The attack source IP.

[0087] }

[0088] S32: Coordinated defensive actions, including:

[0089] Network layer: Add a blocking rule to the perimeter firewall (source IP: 202.96.1.10).

[0090] Application layer: Web server limits the frequency of requests from the same IP address (≤5 times / second);

[0091] Adaptive threshold adjustment: Concurrent attack traffic detected reached 12Gbps (historical peak was 15Gbps).

[0092] Calculate the flow threshold:

[0093] New threshold = 10Gbps × (1 + 0.8 × 0.2) = 11.6Gbps / / Attack strength coefficient = 12 / 15 = 0.8;

[0094] Automatically start traffic scrubbing (threshold 11.6Gbps).

[0095] S4: Automated source tracing and remediation, including:

[0096] S41: Attack Path Reconstruction

[0097]

[0098] The complete path is:

[0099] Attack source: 202.96.1.10 → Firewall: 443 → Web server: 10.0.1.5 → Database: 10.0.2.8.

[0100] S42: Precise Vulnerability Location

[0101] Code audit revealed vulnerabilities:

[0102] / / Vulnerable code location: / var / www / product.php, line 48

[0103] $id = $_GET['id']; / / No input filtering (CWE-89).

[0104] Knowledge base matching:

[0105] Vulnerability ID: CVE-2025-0731 (Apache Struts 2.7.0 file upload vulnerability).

[0106] Scope of impact: Web application frameworks v2.7.0-2.7.5.

[0107] S43: Automatic repair execution

[0108] #bash automatically executes repair scripts

[0109] wget https: / / repo.apache.org / struts / patches / struts-2.7.6-patch.zip

[0110] unzip -o struts-2.7.6-patch.zip -d / var / www / lib /

[0111] systemctl restart apache2

[0112] #Data Recovery (Based on Binlog)

[0113] mysqlbinlog --start-datetime="2025-08-07 14:20:00"|mysql -u root.

[0114] S5: Effect Verification

[0115]

[0116] S6: Defense Report-Driven Model Updates and Real-Time Decision-Making Linkage

[0117] Specifically, when the effect verification shows that the false blocking rate exceeds the standard (0.15% > threshold 0.1%), the system automatically triggers the following closed-loop optimization process:

[0118] Problem Diagnosis: Extracting falsely blocked samples (such as a legitimate request / api / v1 / product / list?Keywords=union being misjudged), the cause was found to be that rule SQLi-1003 did not filter the UNION keyword of whitelisted APIs.

[0119] / / Model update package contents

[0120] {

[0121] "type": "Hot rule update"

[0122] "rule_id": "SQLi-1003",

[0123] "new_condition":"request_uri CONTAINS 'UNION SELECT' AND path NOT IN(' / api / v1 / product / *')",

[0124] "new_rate_limit": 15, / / The request frequency threshold has been increased from 5 times / second to 15 times / second.

[0125] "signature": "sha256: 9f86d0818..." / / Blockchain signature.

[0126] }

[0127] Real-time deployment: The control center pushes the update package to the Web server AI Agent through a secure channel. The Agent preloads the new rule engine in memory through double buffering (takes 3ms), and the atomic pointer switch completes the hot update of the decision engine within 8ms.

[0128] Closed-loop feedback: / / Knowledge base adds optimized cases

[0129] {

[0130] Case ID: "OPT-SQLi-0825"

[0131] "Optimization Strategy": "Add API syntax exemptions + relax frequency thresholds"

[0132] "Improved effectiveness": "False blocking rate 0.15% → 0.03%",

[0133] "Effective delay": "0.8 seconds".

[0134] }

[0135] In this embodiment of the application, the entire process takes 0.8 seconds, which is 120 times more efficient than traditional manual repair.

[0136] Based on the same concept as the above method embodiments, this application also proposes a security defense strategy dynamic optimization system based on AI Agent, including:

[0137] The intelligent threat detection module is used to collect data from all nodes of the distributed AI Agent network, combine multi-dimensional threat perception and fusion detection mechanisms to accurately identify threats, and establish a quantitative assessment model for threat parameters.

[0138] The dynamic defense response module is used by the AI ​​Agent to generate dynamic defense strategies based on the analysis results of the intelligent threat detection and the real-time network status, combined with threat characteristics and risk assessment.

[0139] The automated source tracing and repair module is used to track attack paths, accurately locate vulnerabilities, automatically perform repairs, and retain source tracing information based on the dynamic defense response results.

[0140] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Any other modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention, as long as they do not depart from the spirit and scope of the technical solutions of the present invention, should be covered within the scope of the claims of the present invention.

Claims

1. A method for dynamically optimizing security defense strategies based on AI Agents, characterized in that, Includes the following steps: Intelligent threat detection: Data collection from all network nodes is achieved through a distributed AI Agent, and accurate identification is performed by combining multi-dimensional threat perception and fusion detection mechanisms to establish a quantitative assessment model for threat parameters; Dynamic defense response: The AI ​​Agent generates dynamic defense strategies based on the analysis results of the intelligent threat detection and the real-time network status, combined with threat characteristics and risk assessment. Automated source tracing and remediation: Based on the dynamic defense response results, the system can track attack paths, accurately locate vulnerabilities, automatically perform remediation, and retain source tracing information.

2. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 1, characterized in that, The multi-dimensional threat perception includes network traffic analysis, system behavior monitoring, user behavior analysis, and endpoint security monitoring.

3. A method for dynamically optimizing security defense strategies based on AI Agents according to claim 1 or 2, characterized in that, The fusion detection mechanism employs feature matching, abnormal behavior analysis, and a deep learning recognition model, and includes the following steps: First, known threat characteristics are matched using a knowledge base, and then known threats are quickly identified using a multi-model matching engine. Secondly, abnormal behavior is identified through statistical analysis and comparison with known threats using behavioral baselines. Finally, deep neural networks are used to perform pattern recognition on unknown threats.

4. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 1, characterized in that, The risk assessment includes four levels: catastrophic, high-risk, medium-risk, and low-risk.

5. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 4, characterized in that, The risk assessment is based on the CVSS score range, business impact coefficient, and diffusion risk coefficient.

6. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 1, characterized in that, The dynamic defense strategy is based on an adaptive threshold dynamic parameter adjustment method to achieve precise matching between response strategy and attack intensity.

7. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 6, characterized in that, Based on the quantitative indicators output by the evaluation model, combined with execution logs and knowledge base data, a defense report is generated and improvement suggestions are provided. The specific process includes: Problem attribution: When indicators are abnormal, the root cause of the defense rule defect is located by comparing the falsely blocked request samples with the normal features of the knowledge base; Strategy optimization: Invoke knowledge base templates to output improvement suggestions; Closed-loop execution: After the improvement suggestions are reviewed or triggered, the defense strategy library is dynamically updated and synchronized to the AI ​​Agent, and the execution results are fed back to the knowledge base to form a closed-loop learning.

8. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 7, characterized in that, The aforementioned abnormal key indicators in the defense report will trigger a Level 3 response: Intelligent diagnostics: Automatically matches knowledge base optimization solutions and generates lightweight model update packages; Security Update: Employs double-buffered preloading and atomic pointer switching to achieve millisecond-level migration of model updates, and launches a dynamic traffic scheduler to increase traffic share; Defense closed loop: Real-time monitoring of defense indicators; once updated and meeting the standards, closed-loop optimization is implemented in the knowledge base; if anomalies occur, alarms are automatically rolled back.

9. The method for dynamically optimizing security defense strategies based on AI Agents according to claim 1, characterized in that, The automated source tracing and repair includes: Attack path tracing: By integrating multi-source data, a comprehensive tracking and path reconstruction of attack behaviors is constructed; Precise vulnerability location: Based on the path reconstruction results, the vulnerability exploited by the attacker is precisely located; Automatic remediation: Based on the vulnerability location results, automatically perform remediation operations; Source tracing information retention: During the automatic repair process, the process and results of attack source tracing are recorded.

10. A security defense strategy optimization system based on AI Agent, characterized in that, include: The intelligent threat detection module is used to collect data from all nodes of the distributed AI Agent network, combine multi-dimensional threat perception and fusion detection mechanisms to accurately identify threats, and establish a quantitative assessment model for threat parameters. The dynamic defense response module is used by the AI ​​Agent to generate dynamic defense strategies based on the analysis results of the intelligent threat detection and the real-time network status, combined with threat characteristics and risk assessment. The automated source tracing and repair module is used to track attack paths, accurately locate vulnerabilities, automatically perform repairs, and retain source tracing information based on the dynamic defense response results.

Images