Multi-agent-based attack threat analysis method and related device

Abstract

The invention discloses a multi-agent-based attack threat analysis method and related device, and the method comprises the steps: collecting original data, carrying out the preprocessing of the collected original data, and obtaining the preprocessed original data; carrying out attack threat analysis on the preprocessed original data through an edge agent; when the attack threat analysis of the edge agent on the preprocessed original data is unsuccessful, generating a high-priority analysis request according to the preprocessed original data; the attack threat analysis is carried out through the central agent according to the high-priority analysis request. The method and the related device can avoid the problem caused by the fact that a central management node is relied on to carry out final correlation analysis and decision making.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and relates to a multi-agent-based attack threat analysis method and related device. BACKGROUND

[0002] With the rapid development of information technology, the attack threats in cyberspace are increasingly complex, large-scale and collaborative. Traditional security protection methods, such as firewalls, intrusion detection systems (IDS), etc., are mostly based on predefined signature rules or static strategies, and present an "island" defense mode. These systems usually operate independently, lack effective information sharing and collaborative linkage capabilities, and are difficult to cope with complex network attacks such as advanced persistent threats (APT) and distributed denial of service (DDoS).

[0003] In recent years, the field of network security is evolving towards intelligence and automation. Concepts such as Security Operations Center (SOC) and Security Orchestration, Automation and Response (SOAR) platform have been proposed to integrate multiple security tools and achieve a certain degree of automated response. However, these systems still have bottlenecks in analysis capabilities, and their core analysis engines often rely on centralized data processing and logical judgment. In the face of massive, heterogeneous and rapidly evolving attack data, performance bottlenecks, single-point failures and single analysis perspectives are likely to occur.

[0004] To improve the intelligence level of threat analysis, academia and industry have begun to explore the application of multi-agent systems (Multi-Agent System, MAS) in the field of network security. Multi-agent systems are composed of multiple autonomous or semi-autonomous agents (Agent). These agents can complete complex tasks that individual agents cannot solve through communication and collaboration.

[0005] The popular solution in the existing industry is a centralized agent analysis solution, which has alarm or intelligence data reported from various sources at the core. The core agent performs logical analysis and processing. This solution lacks advanced cognitive and collaborative analysis capabilities. The analysis capabilities and knowledge base of the entire system depend on the updates and maintenance of the central node, and the following main defects and deficiencies exist: Centralized analysis bottleneck and single-point failure risk: The existing technology relies on a central management node for final correlation analysis and decision-making. This leads to a significant performance bottleneck in the system. When the network scale expands and attack data surges, the central node may become a constraint point for processing speed. At the same time, if the central node is attacked by attackers or fails due to downtime, the entire threat analysis system will be paralyzed, posing a serious single-point failure risk. SUMMARY

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a multi-agent attack threat analysis method and related apparatus. This method and apparatus can avoid the problems caused by relying on a central management node for final correlation analysis and decision-making.

[0007] To achieve the above objectives, this invention discloses a multi-agent-based attack threat analysis method, comprising: Collect raw data, preprocess the collected raw data, and obtain preprocessed raw data; The preprocessed raw data is analyzed for attack threats using an edge intelligence agent. If the edge agent fails to analyze the attack threat of the preprocessed raw data, a high-priority analysis request is generated based on the preprocessed raw data. The central agent performs attack threat analysis based on the high-priority analysis requests.

[0008] Furthermore, the preprocessing process for the collected raw data is as follows: The collected raw data is parsed, cleaned, standardized, and formatted to obtain structured JSON events.

[0009] Furthermore, the process of performing attack threat analysis on the preprocessed raw data through an edge agent is as follows: The lightweight rule engine within the edge intelligent body loads the detection rule set periodically issued by the central intelligent body, performs real-time pattern matching on the structured JSON events, and uses the decision-maker within the edge intelligent body to perform attack threat analysis on the successfully matched structured JSON events.

[0010] Furthermore, the process of performing attack threat analysis on the local decision-maker within the successfully matched structured JSON event edge intelligence body is as follows: The decision-maker in the edge intelligent body queries the locally maintained behavior baseline library. When the subject of the structured JSON event exists in the trusted whitelist, or the sequence of the structured JSON event conforms to the known normal operation mode, the structured JSON event is marked as expected behavior or false alarm and suppressed. When the structured JSON event is determined to be a known low-level threat, the decision-maker in the edge intelligence body triggers the near-source response intelligence body to perform attack threat analysis and generate corresponding disposal measures based on the analysis results.

[0011] Furthermore, the edge agent is considered unsuccessful in its attack threat analysis of the preprocessed raw data if the following conditions are met: Decision-makers within edge intelligence bodies cannot accurately assess the risk level or intent of structured JSON events; Multiple structured JSON events are detected within a preset time period. These multiple structured JSON events are related in terms of time, subject, or object, and cannot be linked together to form a complete supply chain within the edge intelligence body. The lightweight anomaly detection algorithm built into the edge agent cannot match any unknown suspicious behavior patterns with existing rules.

[0012] Furthermore, the process of performing attack threat analysis by the central intelligent agent based on the high-priority analysis request is as follows: The central intelligent agent performs knowledge graph context association, cross-domain attack chain reconstruction, enhanced retrieval and generative reasoning, strategy generation, and command issuance and execution based on the high-priority analysis requests.

[0013] Furthermore, it also includes: Regularly update both edge agents and central agents.

[0014] This invention discloses a multi-agent attack threat analysis system, comprising: The preprocessing module is used to collect raw data, preprocess the collected raw data, and obtain preprocessed raw data. The analysis module is used to perform attack threat analysis on the preprocessed raw data through an edge agent; The first decision module is used to generate a high-priority analysis request based on the preprocessed raw data when the edge agent fails to perform attack threat analysis on the preprocessed raw data. The second decision-making module is used to perform attack threat analysis based on the high-priority analysis request through the central intelligent agent.

[0015] The present invention discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the multi-agent-based attack threat analysis method.

[0016] The present invention discloses a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps of the multi-agent-based attack threat analysis method.

[0017] The present invention has the following beneficial effects: The attack threat analysis method and related device based on multi-agent technology described in this invention introduces edge agents for distributed preprocessing during operation, fundamentally solving the performance and reliability problems of existing centralized architectures. Specifically, the lightweight rule engine and decision-maker built into the edge agent can independently complete real-time matching of near-source data, threat identification, noise reduction, and rapid response to simple threats. This improvement enables more than 70% of simple and repetitive alarms to be processed and digested locally at the data source, while only high-value complex events are reported to the central agent, greatly reducing the data processing pressure on the central agent and allowing its computing resources to focus on deep correlation analysis, thereby significantly improving the overall throughput and real-time performance of the system. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system structure diagram of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In the description of this invention, it should be understood that the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this invention generally indicates that the preceding and following objects have an "or" relationship.

[0024] It should be understood that although terms such as first, second, third, etc., may be used in the embodiments of the present invention to describe the preset range, these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from one another. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0025] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0027] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0028] Example 1 refer to Figure 1 The attack threat analysis method based on multi-agent technology described in this invention includes the following steps: 1) Collect distributed data and preprocess the collected data; The data sources include at least cloud server instances, employee office terminals, network boundary firewalls and switches. The edge agent continuously collects raw data such as local system audit logs, network traffic packets, process creation information and file operation records by calling operating system APIs and listening to network driver interfaces (such as libpaco). Subsequently, the edge agent parses, cleans and standardizes the collected heterogeneous raw data, converts it into structured JSON events, and temporarily stores it in the local cache.

[0029] 2) Perform near-source threat identification and intelligent noise reduction on the preprocessed data; The lightweight rule engine within the edge intelligent body loads detection rule sets (such as YARA and Sigma rules) periodically issued by the central intelligent body to perform real-time pattern matching on the structured JSON events generated in step 1). For successfully matched structured JSON events, the decision-maker within the edge intelligent body performs refined judgment. The specific judgment process is as follows: 21) Noise Reduction Processing: The decision-maker queries the locally maintained behavior baseline library. If the subject of an event (such as process name, source IP address) exists in the trusted whitelist, or if the sequence of the event conforms to a known normal operating pattern, the event is marked as "expected behavior" or "false alarm" and suppressed, without generating an uplink alarm.

[0030] 22) Rapid Handling of Simple Threats: When an incident is clearly identified as a known low-level threat (e.g., a file hash value that perfectly matches a malware database), the decision-maker immediately triggers a near-source response agent to generate corresponding rapid handling measures based on the analysis results. These measures may include terminating malicious processes, isolating infected files, or blocking suspicious network connections. Upon completion of the operation, a standardized "Local Handling Complete" record is generated and reported.

[0031] 3) Event classification and accurate reporting; The edge agent executes differentiated reporting strategies based on the results of local processing: 31) For simple threats that have been dealt with, the corresponding “dealt with” record is marked as low priority and uploaded to the central agent in batches and compressed form at preset time intervals (e.g., every 5 minutes) for global log auditing and situational awareness.

[0032] When encountering the following complex situations, the edge agent encapsulates the data of the original event, the local analysis context, and the request type, generates a high-priority analysis request message, and proactively and in real-time reports it to the central agent: a) The rule was successfully matched, but the decision-maker was unable to accurately assess its risk level or intent due to insufficient information.

[0033] b) Multiple events are detected in a short period of time. These events are related in terms of time, subject, or object, and the local logic cannot effectively link them into a complete attack chain.

[0034] c) Discover unknown suspicious behavior patterns that do not match any existing rules through built-in lightweight anomaly detection algorithms (such as statistical deviation detection).

[0035] 4) Centralized deep correlation analysis and intelligent reasoning.

[0036] After receiving a high-priority analysis request, the central agent's analysis module initiates a multi-dimensional in-depth analysis process, specifically: Knowledge graph context association: Starting from the core entities in the request message (such as attacker IP, suspicious file path, user ID), multi-hop traversal queries are performed in the graph database. The queries aim to answer questions such as: "Is IP address A marked as a C2 server of a known APT group B in the threat intelligence graph? Does the group's commonly used 'credential dump' (T1003) technique match the currently discovered 'LSASS memory read' event? Does the attacked server asset have a specific vulnerability (CVE-2023-XXXX) that can be exploited by this technique?"

[0037] Cross-domain attack chain reconstruction: Isolated events from different network regions and hosts are correlated and fused according to dimensions such as timestamp sequence, MITRE ATT&CK tactical stage evolution, and shared attacker infrastructure, and a complete and visualized attack sequence diagram is dynamically constructed in the knowledge graph.

[0038] Enhanced retrieval and generative reasoning: For unknown threats with weak direct correlation in the knowledge graph, the analysis module calls the language big model to convert their text descriptions into high-dimensional vector representations. Then, it performs a high-similarity Top-K search in the vector database to find the most semantically similar attack cases, tactical manuals, and handling solutions in history. Subsequently, the retrieved results are combined with the detailed features of the current event to form a prompt, which is input into the language big model for deep reasoning to generate a structured analysis report. The content of the analysis report includes speculation on the attacker's intentions, possible attack development paths, and assessment of the potential impact on business.

[0039] 5) Collaborative response and distributed processing execution.

[0040] Policy generation: The response module automatically generates handling policies based on the attack chain diagram and analysis briefing output by the analysis module. The handling policies include: "Block all communication with the malicious IP segment at the perimeter firewall", "Immediately isolate the three servers confirmed to be compromised", and "Force specific user groups to complete multi-factor authentication on their next login".

[0041] Command Issuance and Execution: The handling module translates the handling strategy into specific executable commands or API calls (such as Ansible Playbooks, firewall CLI commands, and EDR isolation instructions), and sends them to one or more relevant edge agents through a secure and reliable messaging channel, either point-to-point or broadcast. After receiving the command, the edge agent executes it within its local permissions and synchronously feeds back the execution result (success / failure / status) to the central handling module.

[0042] 5) Knowledge feedback and system capability evolution.

[0043] Incremental knowledge base updates: New knowledge elements are automatically extracted from the entire lifecycle of this analysis and response, including newly discovered attack indicators (IOCs), new attack tactics (TTPs), and effective response plans. These new knowledge elements are then structured and incrementally updated into the graph and vector databases via a knowledge base construction pipeline.

[0044] Detection capabilities are decentralized: The central agent periodically (e.g., daily or weekly) mines, refines, and compiles new information in the knowledge base to generate optimized or entirely new detection rules, signature codes, or anomaly detection models. These updates are proactively and accurately distributed to all relevant edge agents through a management channel, thereby completing a closed-loop capability iteration and evolution for the entire system and enabling continuous adaptation to new threats.

[0045] This invention has the following characteristics: This invention effectively eliminates performance bottlenecks and single points of failure, significantly improving system processing efficiency and robustness.

[0046] This invention fundamentally solves the performance and reliability problems of existing centralized architectures by introducing edge agents for distributed preprocessing. Specifically, the lightweight rule engine and decision-maker built into the edge agent can independently complete real-time matching of near-source data, threat identification, noise reduction, and rapid response to simple threats. This improvement allows more than 70% of simple, repetitive alarms to be processed and digested locally at the data source, reporting only high-value, complex events to the center. This greatly reduces the data processing pressure on the central node, allowing its computing resources to focus on deep correlation analysis, thereby significantly improving the overall system throughput and real-time performance. Simultaneously, due to the high degree of autonomy of the edge nodes, basic protection can be maintained even when communication with the center is interrupted, effectively avoiding the global paralysis caused by the failure of the central node in existing technologies, significantly enhancing system robustness.

[0047] This invention enables dynamic and flexible collaborative analysis, achieving a breakthrough in the detection capabilities for complex and unknown threats.

[0048] This invention addresses the problems of rigid collaboration and limited analytical perspectives in existing technologies by coordinating an intelligent reporting mechanism with a central enhanced analysis module. The edge agent not only reports data but also distinguishes the nature of events based on local context, achieving precise collaboration through "summarizing simple issues and immediately reporting complex behaviors." Upon receiving a complex event, the central agent's analysis module immediately activates, utilizing a knowledge graph for multi-hop traversal and association to reconstruct cross-domain attack chains. For unknown threats, it performs semantic-level similarity retrieval using a vector database and employs a large language model for reasoning, generating an analysis summary. This mechanism makes the system resemble a well-defined expert team: the edge side efficiently performs initial screening, while the central side focuses on resolving complex issues, thus significantly enhancing the chain analysis capabilities for complex attacks such as APTs and the inference and identification capabilities for unknown threats such as zero-day attacks and variants.

[0049] This invention possesses a self-learning capability that allows for continuous evolution, significantly reduces operation and maintenance costs, and provides forward-looking protection.

[0050] The core advantage of this invention lies in its construction of a self-evolving closed loop through a multimodal knowledge base. Utilizing a large language model, it automatically extracts entities and relationships from unstructured data, constructing and updating a knowledge graph, fundamentally changing the traditional high-cost, slow-moving model that relies on manual intelligence gathering. The introduction of a vector database enables the system to understand and retrieve semantically similar threat cases, providing historical evidence for analyzing unknown attacks. The entire system forms an autonomous closed loop of "analysis-decision-feedback-update": new knowledge generated from each action is automatically absorbed and refined into new rules by the center and distributed to the periphery. This improvement significantly reduces the time and manpower costs for security experts to manually maintain the knowledge base and rule base, and enables the system to proactively adapt to the evolution of attack techniques, shifting from "static passive defense" to "dynamic proactive evolution." It possesses stronger forward-looking early warning and adaptive protection capabilities when facing new threats, fundamentally improving the quality and efficiency of security operations.

[0051] Example 2 refer to Figure 2 The attack threat analysis system based on multi-agent technology of the present invention includes: The preprocessing module is used to collect raw data, preprocess the collected raw data, and obtain preprocessed raw data. The analysis module is used to perform attack threat analysis on the preprocessed raw data through an edge agent; The first decision module is used to generate a high-priority analysis request based on the preprocessed raw data when the edge agent fails to perform attack threat analysis on the preprocessed raw data. The second decision-making module is used to perform attack threat analysis based on the high-priority analysis request through the central intelligent agent.

[0052] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0053] Example 3 A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the multi-agent-based attack threat analysis method, for example, including: collecting raw data; preprocessing the collected raw data to obtain preprocessed raw data; performing attack threat analysis on the preprocessed raw data using an edge agent; generating a high-priority analysis request based on the preprocessed raw data when the edge agent's attack threat analysis of the preprocessed raw data is unsuccessful; and performing attack threat analysis on the high-priority analysis request using a central agent. The memory may include main memory, such as high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device. The processor, network interface, and memory are interconnected via an internal bus, which may be an industry-standard architecture bus, a peripheral component interconnection standard bus, an extended industry-standard architecture bus, etc., and the bus may be divided into an address bus, a data bus, a control bus, etc. The memory stores the program; specifically, the program may include program code, which includes computer operation instructions. The memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0054] Example 4 A computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the multi-agent-based attack threat analysis method. For example, the method includes: collecting raw data; preprocessing the collected raw data to obtain preprocessed raw data; performing attack threat analysis on the preprocessed raw data using an edge agent; generating a high-priority analysis request based on the preprocessed raw data when the edge agent's attack threat analysis of the preprocessed raw data is unsuccessful; and performing attack threat analysis on the high-priority analysis request using a central agent. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0055] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and disclosure of the invention. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0060] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

[0061] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the present invention. Any simple modifications, alterations, or equivalent structural changes made to the above embodiments based on the technical essence of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A multi-agent-based attack threat analysis method, characterized in that, include: Collect raw data, preprocess the collected raw data, and obtain preprocessed raw data; The preprocessed raw data is analyzed for attack threats using an edge intelligence agent. If the edge agent fails to analyze the attack threat of the preprocessed raw data, a high-priority analysis request is generated based on the preprocessed raw data. The central agent performs attack threat analysis based on the high-priority analysis requests.

2. The attack threat analysis method based on multi-agent technology according to claim 1, characterized in that, The process of preprocessing the collected raw data is as follows: The collected raw data is parsed, cleaned, standardized, and formatted to obtain structured JSON events.

3. The attack threat analysis method based on multi-agent technology according to claim 2, characterized in that, The process of performing attack threat analysis on the preprocessed raw data using an edge intelligence agent is as follows: The lightweight rule engine within the edge intelligent body loads the detection rule set periodically issued by the central intelligent body, performs real-time pattern matching on the structured JSON events, and uses the decision-maker within the edge intelligent body to perform attack threat analysis on the successfully matched structured JSON events.

4. The attack threat analysis method based on multi-agent technology according to claim 2, characterized in that, The process of performing attack threat analysis on the local decision-maker within the edge intelligence body of the successfully matched structured JSON event is as follows: The decision-maker in the edge intelligent body queries the locally maintained behavior baseline library. When the subject of the structured JSON event exists in the trusted whitelist, or the sequence of the structured JSON event conforms to the known normal operation mode, the structured JSON event is marked as expected behavior or false alarm and suppressed. When the structured JSON event is determined to be a known low-level threat, the decision-maker in the edge intelligence body triggers the near-source response intelligence body to perform attack threat analysis and generate corresponding disposal measures based on the analysis results.

5. The attack threat analysis method based on multi-agent technology according to claim 2, characterized in that, The edge agent is considered unsuccessful in its attack threat analysis of the preprocessed raw data if the following conditions are met: Decision-makers within edge intelligence bodies cannot accurately assess the risk level or intent of structured JSON events; Multiple structured JSON events are detected within a preset time period. These multiple structured JSON events are related in terms of time, subject, or object, and cannot be linked together to form a complete supply chain within the edge intelligence body. The lightweight anomaly detection algorithm built into the edge agent cannot match any unknown suspicious behavior patterns with existing rules.

6. The attack threat analysis method based on multi-agent technology according to claim 1, characterized in that, The process of performing attack threat analysis by the central intelligent agent based on the high-priority analysis request is as follows: The central intelligent agent performs knowledge graph context association, cross-domain attack chain reconstruction, enhanced retrieval and generative reasoning, strategy generation, and command issuance and execution based on the high-priority analysis requests.

7. The attack threat analysis method based on multi-agent technology according to claim 1, characterized in that, Also includes: Regularly update both edge agents and central agents.

8. A multi-agent attack threat analysis system, characterized in that, include: The preprocessing module is used to collect raw data, preprocess the collected raw data, and obtain preprocessed raw data. The analysis module is used to perform attack threat analysis on the preprocessed raw data through an edge agent; The first decision module is used to generate a high-priority analysis request based on the preprocessed raw data when the edge agent fails to perform attack threat analysis on the preprocessed raw data. The second decision-making module is used to perform attack threat analysis based on the high-priority analysis request through the central intelligent agent.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the attack threat analysis method based on multiple agents as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the attack threat analysis method based on multiple agents as described in any one of claims 1-7.

Images