Agent security assessment and dynamic sandbox protection method and system, and related device

Abstract

A method, system, and related equipment for intelligent agent security assessment and dynamic sandbox protection are disclosed. The method includes: generating an attack task based on an attack task template using a large language model; inputting the attack task into a target intelligent agent in a controlled environment, causing the target intelligent agent to execute the attack task and collect behavioral data during execution; performing a risk assessment based on the behavioral data to determine the security level under the current attack task; triggering a dynamic sandbox protection mechanism based on the security level to adapt and adjust the permissions and resources of the target intelligent agent; obtaining feedback on abnormal samples, adjusting the risk judgment threshold in the risk assessment process based on the feedback on abnormal samples, and simultaneously generating a new attack task template and entering the next round of adversarial assessment; through multiple rounds of adversarial assessment, stabilizing the security level of the target intelligent agent and meeting preset security requirements. This invention achieves adversarial assessment of intelligent agent security risks and realizes hierarchical protection and policy adjustment through a dynamic sandbox mechanism.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to a method, system and related equipment for intelligent agent security assessment and dynamic sandbox protection, applicable to multi-agent collaborative platforms and AI toolchain environments. Background Technology

[0002] With the continuous improvement of Large Language Models (LLMs), they exhibit human-like intelligent characteristics in natural language understanding, logical reasoning, task planning, and multi-tool collaboration, gradually becoming the core foundation for building intelligent agents with autonomous perception, decision-making, and execution capabilities. Based on this, intelligent agents can accomplish complex goals by calling system APIs, accessing internet resources, operating external devices, or executing automated tasks. However, with the widespread deployment of intelligent agents in open environments, their autonomy and external operability also bring new security risks. For example, attackers can induce intelligent agents to execute unauthorized commands through prompt injection, context pollution, and task chain hijacking; improper control of tool call permissions may lead to abuse of system resources, leakage of sensitive information, or malicious propagation; and architectures lacking fine-grained access control and dynamic behavioral constraints are more prone to breaching system boundaries, generating highly concealed and dangerous potential threats. These security vulnerabilities have become significant bottlenecks restricting the application of LLM intelligent agents in key areas such as industry, energy and power, and government affairs.

[0003] Existing security measures for intelligent agents primarily focus on the static input level, such as filtering prompt content, matching blacklists and whitelists for instructions, or context-based review mechanisms. While these can prevent explicit malicious input to some extent, they cannot cover the dynamic risks that arise during the execution, inference, or tool interaction phases. For example, during task decomposition or multi-round inference, an intelligent agent may spontaneously generate high-risk operation requests or engage in multi-hop privilege-breaking behavior through external call chains; existing detection systems struggle to dynamically identify and intercept these risks in real time during runtime. Summary of the Invention

[0004] The purpose of this invention is to address the problems in the prior art by providing a method, system, and related equipment for intelligent agent security assessment and dynamic sandbox protection. This method enables the assessment of security risks to intelligent agents and, when abnormal behavior is detected, implements hierarchical protection and policy adjustment through a dynamic sandbox mechanism, thereby improving the security stability and anti-attack capabilities of intelligent agents.

[0005] To achieve the above objectives, the present invention provides the following technical solution: Firstly, a method for intelligent agent security assessment and dynamic sandbox protection is provided, including: The large language model generates attack tasks of the corresponding type based on pre-built attack task templates; The generated attack task is input into the target agent in the controlled environment, causing the target agent to execute the attack task, and the corresponding behavioral data of the target agent during the execution process is collected; Risk assessment is performed based on the collected agent behavior data to determine the security level of the target agent under the current attack task; Based on the security level, a corresponding dynamic sandbox protection mechanism is triggered to adapt and adjust the permissions and resources of the target intelligent agent. The target intelligent agent is then controlled to continue executing the attack task within the sandbox according to the adjusted permissions and resources. Data on the execution process of the target intelligent agent is obtained. Based on the data on the execution process of the target intelligent agent, the steps of generating the attack task from the large language model and the sandbox protection strategy are optimized simultaneously until the security level of the target intelligent agent tends to stabilize and meets the preset security requirements.

[0006] As a preferred embodiment, in the step of generating corresponding types of attack tasks through a large language model based on a pre-built attack task template, the attack task template includes an attack target description, semantic instruction patterns, tool call parameters, and constraints; the attack agent generates multiple types of attack tasks based on the attack task template, and the attack task types include any one of the following: Prompt injection, unauthorized call, resource exhaustion, and data leakage. The generated attack task is parameterized based on the runtime environment parameter set and converted into execution instructions. ; Execution instructions Perform configuration injection and encapsulate it into a format that conforms to the input specifications of the target intelligent agent.

[0007] As a preferred embodiment, in the step of performing risk assessment based on the collected agent behavior data to determine the security level of the target agent under the current attack task, a comprehensive security score is calculated based on the agent behavior data under the current attack task according to the following formula. :

[0008] In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label The expressions for classifying conditions as safe, suspicious, or dangerous are as follows:

[0009] In the formula, and The set safety threshold.

[0010] As a preferred option, if the security level label If the situation is deemed dangerous or suspicious, a dynamic sandbox protection mechanism will be triggered; or, if the overall safety score decreases at a certain rate per unit time... Less than the trigger threshold At that time, the dynamic sandbox protection mechanism is triggered.

[0011] As a preferred approach, in the steps of triggering the corresponding dynamic sandbox protection mechanism based on the security level, adapting and adjusting the permissions and resources of the target agent, and controlling the target agent to continue executing the attack task within the sandbox according to the adjusted permissions and resources, after triggering the corresponding dynamic sandbox protection mechanism, migration is performed. The migration process follows the principle of minimum available context, transferring only the state required for execution; the session state of the target agent is migrated to run in the sandbox; after the migration is completed, the original host environment is shielded and frozen, and the file and interface transfer is completed to ensure that no resources are leaked during the migration process, and a unique session identifier is generated on the sandbox side.

[0012] As a preferred embodiment, in the step of triggering a corresponding dynamic sandbox protection mechanism based on the security level, adapting and adjusting the permissions and resources of the target agent, and controlling the target agent to continue executing the attack task within the sandbox according to the adjusted permissions and resources, permission constraints are imposed on the target agent's network communication, file access, and system command calls within the sandbox, and unauthorized operations and abnormal call behaviors are monitored and blocked in real time; based on the security level label... The corresponding risk level is dynamically set using a continuous limit function, as shown in the following expression:

[0013] After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource timing characteristics, network communication information, and file, process, and thread-related exception information. Based on the above multimodal observation signals, a comprehensive exception score is calculated. The comprehensive anomaly score Calculate according to the following formula:

[0014] In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; The exponential moving average is used to smooth the overall anomaly score, as shown in the following expression:

[0015] Set soft and hard blocking conditions. If either blocking condition is met, terminate the execution of the target agent and solidify the evidence chain. The soft blocking condition is an anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may hit a fatal rule; If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; The system performs outbound audits on task outputs, returns compliant results, and records execution process information as structured data as input for subsequent feedback loops. After an attack task is completed or terminated, the system reclaims the sandbox environment according to the destruction process, solidifies log indexes and forensic snapshot information, and sends back the target agent's execution status information.

[0016] As a preferred embodiment, the steps of acquiring target agent execution process data and simultaneously optimizing the attack task generation process of the large language model and sandbox protection strategy based on the target agent execution process data until the security level of the target agent tends to stabilize and meets the preset security requirements include: acquiring abnormal sample feedback during the agent's execution process, adjusting the risk judgment threshold in the risk assessment process according to the abnormal sample feedback, and simultaneously generating a new attack task template through the large language model and entering the next round of adversarial assessment; through multiple rounds of adversarial assessment, the security level of the target agent tends to stabilize and meets the preset security requirements.

[0017] As a preferred approach, in the steps of obtaining abnormal sample feedback during the agent's execution process, adjusting the risk judgment threshold in the risk assessment process based on the abnormal sample feedback, and simultaneously generating a new attack task template through the large language model and proceeding to the next round of adversarial assessment, the risk judgment threshold is adjusted according to the following expression to balance the false positive rate and the false negative rate:

[0018] In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; A reinforcement learning-based parameter update strategy is used to update the model parameters. The optimized expression is as follows:

[0019] In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgment during the risk assessment process and the defensive benefits of dynamic sandbox protection. Anomaly samples are analyzed, and attack patterns, semantic features, and triggering rules are summarized using a large language model. New attack templates are then generated based on the characteristics of the anomaly samples. ,in, This is a template generation function based on a large language model, used to extract attack intent and command patterns; a new attack task template is adopted. To conduct the next round of confrontation assessment.

[0020] As a preferred approach, in the step of stabilizing the security level of the target agent and meeting the preset security requirements through multiple rounds of adversarial evaluation, the new attack task template and sandbox protection strategy are continuously evolved in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached the stable condition.

[0021] Secondly, a smart agent security assessment and dynamic sandbox protection system is provided, including: The attack task generation module is used to generate attack tasks of corresponding types based on pre-built attack task templates using a large language model. The behavior data acquisition module is used to input the generated attack task into the target intelligent agent in the controlled environment, so that the target intelligent agent executes the attack task, and to collect the corresponding behavior data of the target intelligent agent during the execution process; The risk assessment module is used to perform risk assessment based on the collected agent behavior data and determine the security level of the target agent under the current attack task. The sandbox migration execution optimization module is used to trigger the corresponding dynamic sandbox protection mechanism based on the security level, adapt and adjust the permissions and resources of the target intelligent agent, and control the target intelligent agent to continue to execute the attack task in the sandbox according to the adjusted permissions and resources. It obtains the execution process data of the target intelligent agent, and optimizes the steps of generating the attack task from the large language model and the sandbox protection strategy based on the execution process data of the target intelligent agent until the security level of the target intelligent agent tends to be stable and meets the preset security requirements.

[0022] As a preferred embodiment, when the attack task generation module generates attack tasks of the corresponding type based on a pre-built attack task template using a large language model, the expression of the attack task template is: , among which, any attack task template All include attack target description, semantic instruction pattern, tool call parameters and constraints; the attack agent generates multiple types of attack tasks based on the attack task template, and the attack task types include any of the following: Prompt injection, unauthorized call, resource exhaustion and data leakage. The generated attack task is parameterized based on the runtime environment parameter set and converted into execution instructions. ; Execution instructions Perform configuration injection and encapsulate it into a format that conforms to the input specifications of the target intelligent agent.

[0023] As a preferred embodiment, the risk assessment module calculates a comprehensive security score based on the agent's behavioral data under the current attack task according to the following formula. :

[0024] In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label The expressions for classifying conditions as safe, suspicious, or dangerous are as follows:

[0025] In the formula, and The set safety threshold.

[0026] As a preferred embodiment, the sandbox migration execution optimization module, when the security level label... If the situation is deemed dangerous or suspicious, a dynamic sandbox protection mechanism will be triggered; or, if the overall safety score decreases at a certain rate per unit time... Less than the trigger threshold When this happens, the dynamic sandbox protection mechanism is triggered.

[0027] As a preferred embodiment, the sandbox migration execution optimization module performs migration after triggering the corresponding dynamic sandbox protection mechanism. The migration process follows the principle of minimum available context, transferring only the state required for execution. The session state of the target agent is migrated to the sandbox for operation. After the migration is completed, the original host environment is shielded and frozen, and the files and interfaces are transferred to ensure that no resources are leaked during the migration process. A unique session identifier is generated on the sandbox side.

[0028] As a preferred embodiment, the sandbox migration execution optimization module imposes permission constraints on the target agent's network communication, file access, and system command calls within the sandbox, monitors and blocks unauthorized operations and abnormal call behaviors in real time, and adjusts permissions according to security level labels. The corresponding risk level is dynamically set using a continuous limit function, as shown in the following expression:

[0029] After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource timing characteristics, network communication information, and file, process, and thread-related exception information. Based on the above multimodal observation signals, a comprehensive exception score is calculated. The comprehensive anomaly score Calculate according to the following formula:

[0030] In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; The exponential moving average is used to smooth the overall anomaly score, as shown in the following expression:

[0031] Set soft and hard blocking conditions. If either blocking condition is met, terminate the execution of the target agent and solidify the evidence chain. The soft blocking condition is an anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may hit a fatal rule; If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; The system performs outbound audits on task outputs, returns compliant results, and records execution process information as structured data as input for subsequent feedback loops. After an attack task is completed or terminated, the system reclaims the sandbox environment according to the destruction process, solidifies log indexes and forensic snapshot information, and sends back the target agent's execution status information.

[0032] As a preferred embodiment, the sandbox migration execution optimization module acquires data on the target agent's execution process and simultaneously optimizes the generation of attack tasks from the large language model and the sandbox protection strategy based on this data, until the target agent's security level stabilizes and meets preset security requirements. Then, by acquiring feedback from abnormal samples during the agent's execution, the module adjusts the risk assessment threshold based on this feedback. Simultaneously, it generates a new attack task template using the large language model and proceeds to the next round of adversarial evaluation. Through multiple rounds of adversarial evaluation, the target agent's security level stabilizes and meets preset security requirements.

[0033] As a preferred embodiment, the sandbox migration execution optimization module adjusts the risk assessment threshold according to the following expression to balance the false positive rate and the false negative rate:

[0034] In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; A reinforcement learning-based parameter update strategy is used to update the model parameters. The optimized expression is as follows:

[0035] In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgment during the risk assessment process and the defensive benefits of dynamic sandbox protection. Anomaly samples are analyzed, and attack patterns, semantic features, and triggering rules are summarized using a large language model. New attack templates are then generated based on the characteristics of the anomaly samples. ,in, This is a template generation function based on a large language model, used to extract attack intent and command patterns; a new attack task template is adopted. To conduct the next round of confrontation assessment.

[0036] As a preferred approach, the sandbox migration execution optimization module continuously evolves the new attack task template and sandbox protection strategy in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached a stable condition.

[0037] Thirdly, an electronic device is provided, including a processor and a memory, the processor being configured to execute a computer program stored in the memory to implement the intelligent agent security assessment and dynamic sandbox protection method as described in the first aspect.

[0038] Fourthly, a computer-readable storage medium is provided, the computer-readable storage medium storing at least one instruction, which, when executed by a processor, implements the intelligent agent security assessment and dynamic sandbox protection method as described in the first aspect.

[0039] Compared with the prior art, the first aspect of the present invention has at least the following beneficial effects: This invention achieves a leapfrog upgrade in intelligent agent security protection by using a large language model to drive attack task generation, controlled environment behavior collection, risk level quantitative assessment, dynamic sandbox adaptation and control, and closed-loop iterative optimization. This is accomplished through a comprehensive technical design encompassing attack task generation, controlled environment behavior collection, risk level quantification, dynamic sandbox adaptation and control, and closed-loop iterative optimization. By generating attack tasks using a large language model, executing tasks in a controlled environment and collecting behavioral data, and conducting risk assessments based on this behavioral data, this invention combines a dual-agent system of offense and defense with pre-set attack task templates. This overcomes the shortcomings of traditional intelligent agent security assessments, which rely on manually designed test cases, resulting in low efficiency and incomplete coverage. On the one hand, it can automatically generate various types of attack tasks, such as injection prompts, unauthorized calls, and tool abuse, through large language models, achieving diversified and automated construction of attack scenarios, significantly broadening the coverage of risk assessment, and enabling the discovery of potential hidden security vulnerabilities in intelligent agents. On the other hand, by executing attack tasks in a controlled environment and collecting full-dimensional behavioral data, the security level of the intelligent agent is determined based on quantitative indicators, making the risk assessment interpretable and quantifiable. This solves the problem that existing technologies cannot accurately determine the risk level of intelligent agents, realizing a fully automated adversarial security assessment, and significantly improving the efficiency and comprehensiveness of the assessment. This invention triggers dynamic sandbox protection based on security level, adapts and adjusts permissions and resources, and continues tasks within the sandbox, breaking through the limitations of traditional static isolation and fixed permissions in sandboxes, and creating a dynamic protection mode that links risk levels. For agents with different security levels, the invention precisely triggers the corresponding sandbox protection mechanism, dynamically adapting and adjusting network permissions, file access permissions, system call permissions, and resource access scope to achieve refined protection. This avoids the loss of agent operating efficiency due to excessive isolation and can quickly block attack links when risky behavior is detected, preventing the spread of risks. It effectively curbs security threats caused by malicious behaviors such as injection prompts, tool abuse, and unauthorized calls, significantly improving the security stability and anti-attack capabilities of agent operation. This invention integrates automated attack task generation, risk quantification assessment, dynamic sandbox control, and execution process feedback optimization to construct a dedicated proactive security framework for large language model agents. Unlike traditional passive defense methods, this invention focuses on offensive and defensive confrontation, simulating various malicious attack scenarios in advance to discover and resolve security risks, improving the agent's security defense capabilities from the source. This ensures the system's secure, controllable, and robust operation while protecting the agent's autonomy.

[0040] Furthermore, this invention employs a closed-loop design involving anomaly sample feedback to optimize thresholds, update attack task templates, and conduct multi-round adversarial evaluations. This constructs an active security protection framework of "attack-detection-defense-optimization." By collecting anomaly sample feedback, the risk assessment thresholds are corrected in real time, making the risk assessment more aligned with the actual operating scenarios of the agent and improving the accuracy of risk judgment. Simultaneously, based on feedback information, new attack task templates are iteratively generated through a large language model, continuously enriching the adversarial evaluation scenarios and achieving multi-round attack-defense game optimization. Through multiple rounds of adversarial evaluations, the security shortcomings of the agent can be gradually addressed, allowing the agent's security level to stabilize and continuously meet preset security requirements. Ultimately, this enhances the robustness and reliability of the agent in complex application environments, forming an adaptive and evolving security protection closed loop.

[0041] It is understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 Flowchart of the intelligent agent security assessment and dynamic sandbox protection method according to an embodiment of the present invention; Figure 2 Flowchart of attack task generation and target agent behavior data acquisition in this embodiment of the invention; Figure 3 Flowchart of the dynamic sandbox protection mechanism of this invention; Figure 4 This invention's embodiments update the attack task template and sandbox protection strategy flowchart through multiple rounds of adversarial evaluation; Figure 5 A schematic diagram of the intelligent agent security assessment and dynamic sandbox protection system according to an embodiment of the present invention. Detailed Implementation

[0044] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail. Flowcharts are used in the embodiments of this application to illustrate the operations performed by the apparatus according to the embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps may be processed in reverse order or simultaneously as needed. Furthermore, other operations may be added to these processes, or one or more steps may be removed from these processes.

[0045] This invention proposes a method for intelligent agent security assessment and dynamic sandbox protection. By introducing an adversarial assessment mechanism and dynamic sandbox protection technology into a large language model-based intelligent agent security management system, a dual-agent adversarial framework based on a large language model is constructed. Generative large language models are used to automatically generate multiple types of attack tasks to evaluate the agent's security performance across multiple dimensions, including instruction compliance, permission constraints, tool invocation, and data leakage. Simultaneously, a dynamic sandbox protection mechanism is designed to enable real-time permission adjustment and resource isolation for intelligent agents at different security levels. By introducing a risk assessment quantification and security feedback closed-loop mechanism, automatic detection, dynamic protection, and continuous optimization of potential unauthorized access, abnormal invocations, and behavioral deviations by the agent are achieved, improving the accuracy, robustness, and adaptability of the intelligent agent security protection system.

[0046] Please see Figure 1 The intelligent agent security assessment and dynamic sandbox protection method of this invention mainly includes the following steps: S1. Generate corresponding attack tasks based on pre-built attack task templates using a large language model; S2. Input the generated attack task into the target agent in the controlled environment, so that the target agent executes the attack task, and collect the corresponding behavioral data of the target agent during the execution process; S3. Conduct a risk assessment based on the collected agent behavior data to determine the security level of the target agent under the current attack task; S4. Based on the security level, trigger the corresponding dynamic sandbox protection mechanism, adapt and adjust the permissions and resources of the target intelligent agent, and control the target intelligent agent to continue to execute the attack task in the sandbox according to the adjusted permissions and resources, obtain the target intelligent agent's execution process data, and simultaneously optimize the steps of generating the attack task from the large language model and the sandbox protection strategy based on the target intelligent agent's execution process data, until the security level of the target intelligent agent tends to be stable and meets the preset security requirements.

[0047] Please see Figure 2 In one possible implementation, in step S1, the attack task template expression is: , among which, any attack task template All of them include attack target descriptions, semantic instruction patterns, tool call parameters, and constraints, which are used to guide large language models to generate specific types of attack tasks and trigger potential risk behaviors.

[0048] The attack agent generates multiple types of attack tasks based on attack task templates. These attack task types include any one of the following: Prompt injection, unauthorized call, resource exhaustion, and data leakage. Specifically, the Prompt injection task achieves unauthorized access to the model through contextual interference and nested instructions; the unauthorized call task induces the agent to invoke dangerous system commands or external APIs; the resource exhaustion task generates cyclical or high-load tasks to trigger denial-of-service; and the data leakage task induces the model to output private data or internal parameters. This embodiment generates multiple sets of semantically equivalent but strategically different attack instructions through diversified sampling or random perturbation (such as Temperature and Top-p sampling) to increase test coverage.

[0049] In this embodiment, the generated attack task is parameterized based on a set of runtime environment parameters, including task objectives, tool permissions, and input / output paths, and then converted into executable instructions. Then Configuration injection is performed and encapsulated into a format that conforms to the target agent's input specifications, such as JSON structure, system API request, or command line parameters, to ensure universality across different agent environments.

[0050] In one possible implementation, in step S2, the target agent is in a controlled environment. Receiving attack missions And execute it according to its strategy. Its execution function is:

[0051] in, This represents the execution output, which may include natural language responses, external tool call logs, system command return values, etc. During execution, the agent can invoke various tools (such as Shell, HTTP, and file read / write interfaces); therefore, resource isolation is essential within the virtualization environment to prevent actual damage to the system. During execution, the system records tool call chains, output logs, abnormal responses, and resource consumption information in real time, specifically including: attack input content. With corresponding output Tool call chain Operating resource metrics (CPU, memory, network bandwidth, etc.) and a list of abnormal events. Exceptional events include unauthorized access, abnormal loops, and error returns.

[0052] In one possible implementation, in step S3, after the target agent executes the attack task, a comprehensive security score is calculated based on the agent's behavioral data under the current attack task according to the following formula using five-dimensional indicators. :

[0053] In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; By calculating a comprehensive security score, the security performance of the intelligent agent in the current task is quantified.

[0054] Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label For safety ,suspicious or danger The expression for the partitioning condition is as follows:

[0055] In the formula, and The set security threshold. (If the security level label...) Dangerous or suspicious This triggers the dynamic sandbox protection mechanism; furthermore, when the overall security score decreases at a rate that... Less than the trigger threshold When this occurs, a dynamic sandbox protection mechanism is triggered. This means that not only should one enter the sandbox when deemed dangerous, but if the safety score drops sharply within a short period of time, it also indicates abnormal behavior, and isolation should be triggered in advance.

[0056] Please see Figure 3In one possible implementation, after the dynamic sandbox protection mechanism is triggered in step S4, a sandbox type is selected based on the policy library, including virtual containers, lightweight virtual machines, or logical sandboxes, and the sandbox is instantiated based on the isolation level and system basic resource quota. The migration process follows the principle of minimum available context, transferring only the state required for execution. The session state of the target agent (dialogue history, plan stack, cache vectors, etc.) is migrated to the sandbox for execution. After the migration is complete, the original host environment is shielded and frozen, and file and interface transfers are completed to ensure that no resources are leaked during the migration process. A unique session identifier (sid) is generated on the sandbox side for subsequent auditing.

[0057] Within the sandbox, permissions are restricted for the target agent's network communication, file access, and system command calls; unauthorized operations and abnormal calls are monitored and blocked in real time; based on security level labels... The corresponding risk level is dynamically set using a continuous limit function to avoid task oscillation caused by "jumps". The expression is as follows:

[0058] when Close to or below At that time, the strength of permissions The system smoothly transitions from Safe to the corresponding Restricted / Dangerous permission level (write / external linking / execution prohibited).

[0059] After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource (CPU / MEM / NET / IO) timing characteristics, network communication information, and file, process, and thread-related exception information (creation / killing / injection / self-modification). Based on the above multimodal observation signals, a comprehensive exception score is calculated. ; The comprehensive anomaly score Calculate according to the following formula:

[0060] In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; To reduce jitter, an exponential moving average is used to smooth the overall anomaly score, as shown in the following expression:

[0061] This embodiment employs a dual-threshold, duration-based combined strategy for handling, balancing sensitivity and false alarm control. Soft and hard blocking conditions are set; if either blocking condition is met, the execution of the target agent is terminated, and the evidence chain (abnormal instructions, response content, keyframes, system call stack, network packet digest, and sandbox image snapshot) is solidified. The soft blocking condition is the anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may trigger a fatal rule (such as private key leakage or arbitrary code execution). If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; Outbound auditing of task output results (content security, privacy anonymization, policy consistency) is performed, compliance results are returned upstream, and execution process information (sandbox session identifier, permission level, anomaly score, execution summary, etc.) is recorded as structured data as input for subsequent feedback loops. After the attack task is completed or terminated, the sandbox runtime environment is reclaimed according to the destruction process, including cleaning up temporary volumes and processes, revoking temporary credentials, solidifying log indexes and forensic snapshot information, and returning the target agent's execution status information, including task summary, reasons for disposal, resource curves, and policy hit details.

[0062] Please see Figure 4 In one possible implementation, step S4 involves acquiring the target agent's execution process data, and simultaneously optimizing the large language model generation attack task and sandbox protection strategy based on the target agent's execution process data, until the target agent's security level stabilizes and meets preset security requirements. This includes: The system obtains feedback on abnormal samples during the execution of the intelligent agent, adjusts the risk judgment threshold in the risk assessment process based on the feedback, and generates a new attack task template through the large language model to enter the next round of adversarial assessment. Through multiple rounds of adversarial assessment, the security level of the target intelligent agent is stabilized and meets the preset security requirements.

[0063] Sandbox runtime logs and anomaly samples are fed back to the security knowledge base. Based on the sandbox execution records, tasks exhibiting significant anomalies (such as...) are identified. (For potential dangers), the system will automatically extract input-output pairs. These are stored as anomalous samples in the sample database. Anomalous sample data includes: attack prompts, agent-generated content, triggered system behavior sequences, and evaluation score change curves. .

[0064] This embodiment adjusts the risk assessment threshold and defense strategy parameters based on feedback from abnormal samples. Specifically, the risk assessment threshold is adjusted according to the following expression to adaptively balance the false positive rate and false negative rate, achieving precise protection:

[0065] In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; Furthermore, a reinforcement learning-based parameter update strategy is adopted to simultaneously optimize the detection model and the task generation model. Let the model parameters be... The update expression is as follows:

[0066] In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgments during the risk assessment process and the defensive benefits of dynamic sandbox protection; this optimization process significantly improves the system's detection accuracy and policy robustness after multiple iterations.

[0067] Further analysis of this anomalous sample utilizes a large language model to automatically summarize attack patterns, semantic features, and triggering rules. During this process, new attack templates are generated based on the characteristics of the anomalous sample. ,in, This is a template generation function based on a large language model, which can automatically extract attack intent and command patterns; new attack task templates. It has been incorporated into the attack template library and uses a new attack task template. To conduct the next round of confrontation assessment.

[0068] In one possible implementation, step S4 continuously evolves the new attack task template and sandbox protection strategy in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached a stable condition.

[0069] This invention's agent security assessment and dynamic sandbox protection method introduces an automatic security assessment mechanism involving both attack and defense agents. It utilizes attack and target agents to automatically generate, execute, and evaluate security tasks. The attack agent autonomously generates tasks such as prompt injection, tool abuse, and unauthorized calls based on an attack template library, replacing manual penetration testing and achieving semantic-level automated red team testing. The target agent's behavior, responses, and deviations are automatically collected, enabling a quantitative expression of security risks. Furthermore, this invention proposes an agent protection system based on a dynamic sandbox and hierarchical permission system. By transforming permission control functions into a continuous mapping relationship of security scores, it achieves smooth adjustment of security boundaries while maintaining task execution efficiency. It calculates abnormal scores for agent behavior through risk assessment and employs a dual-threshold strategy to achieve anomaly blocking and permission adjustment. The proposed technical solution realizes a closed-loop security system of "evaluation—detection—protection—optimization," significantly improving the robustness and reliability of agents in complex environments.

[0070] Please see Figure 5 Another embodiment of the present invention also proposes an intelligent agent security assessment and dynamic sandbox protection system, comprising: The attack task generation module 501 is used to generate attack tasks of the corresponding type based on a pre-built attack task template using a large language model. The behavior data acquisition module 502 is used to input the generated attack task into the target intelligent agent in the controlled environment, so that the target intelligent agent executes the attack task, and to collect the corresponding behavior data of the target intelligent agent during the execution process; The risk assessment module 503 is used to perform risk assessment based on the collected agent behavior data and determine the security level of the target agent under the current attack task. The sandbox migration execution optimization module 504 is used to trigger the corresponding dynamic sandbox protection mechanism based on the security level, adapt and adjust the permissions and resources of the target intelligent agent, and control the target intelligent agent to continue to execute the attack task in the sandbox according to the adjusted permissions and resources. It obtains the execution process data of the target intelligent agent, and optimizes the steps of generating the attack task from the large language model and the sandbox protection strategy based on the execution process data of the target intelligent agent until the security level of the target intelligent agent tends to be stable and meets the preset security requirements.

[0071] In one possible implementation, when the attack task generation module 501 generates an attack task of the corresponding type based on a pre-built attack task template using a large language model, the expression of the attack task template is: , among which, any attack task template All include attack target description, semantic instruction pattern, tool call parameters and constraints; the attack agent generates multiple types of attack tasks based on the attack task template, and the attack task types include any of the following: Prompt injection, unauthorized call, resource exhaustion and data leakage. The generated attack task is parameterized based on the runtime environment parameter set and converted into execution instructions. ; Execution instructions Perform configuration injection and encapsulate it into a format that conforms to the input specifications of the target intelligent agent.

[0072] In one possible implementation, the risk assessment module 503 calculates a comprehensive security score based on the agent behavior data under the current attack task according to the following formula. :

[0073] In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label For safety ,suspicious or danger The expression for the partitioning condition is as follows:

[0074] In the formula, and The set safety threshold.

[0075] In one possible implementation, the sandbox migration execution optimization module 504, when the security level label... Dangerous or suspicious If this occurs, the dynamic sandbox protection mechanism will be triggered; or, if the overall security score decreases at a certain rate per unit time... Less than the trigger threshold When this happens, the dynamic sandbox protection mechanism is triggered.

[0076] In one possible implementation, the sandbox migration execution optimization module 504 performs migration after triggering the corresponding dynamic sandbox protection mechanism. The migration process follows the principle of minimum available context, transferring only the state required for execution. The session state of the target agent is migrated to the sandbox for operation. After the migration is completed, the original host environment is shielded and frozen, and the files and interfaces are transferred to ensure that no resources are leaked during the migration process. A unique session identifier is generated on the sandbox side.

[0077] In one possible implementation, the sandbox migration execution optimization module 504 imposes permission constraints on the target agent's network communication, file access, and system command calls within the sandbox, and monitors and blocks unauthorized operations and abnormal call behaviors in real time; based on security level labels... The corresponding risk level is dynamically set using a continuous limit function, as shown in the following expression:

[0078] After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource timing characteristics, network communication information, and file, process, and thread-related exception information. Based on the above multimodal observation signals, a comprehensive exception score is calculated. The comprehensive anomaly score Calculate according to the following formula:

[0079] In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; The exponential moving average is used to smooth the overall anomaly score, as shown in the following expression:

[0080] Set soft and hard blocking conditions. If either blocking condition is met, terminate the execution of the target agent and solidify the evidence chain. The soft blocking condition is an anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may hit a fatal rule; If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; The system performs outbound audits on task outputs, returns compliant results, and records execution process information as structured data as input for subsequent feedback loops. After an attack task is completed or terminated, the system reclaims the sandbox environment according to the destruction process, solidifies log indexes and forensic snapshot information, and sends back the target agent's execution status information.

[0081] In one possible implementation, the sandbox migration execution optimization module 504 acquires data on the execution process of the target agent, and simultaneously optimizes the generation of attack tasks from the large language model and the sandbox protection strategy based on the data until the security level of the target agent stabilizes and meets the preset security requirements. Then, by acquiring feedback from abnormal samples during the agent's execution process, the module adjusts the risk judgment threshold in the risk assessment process based on the feedback from the abnormal samples. At the same time, it generates a new attack task template through the large language model and enters the next round of adversarial assessment. Through multiple rounds of adversarial assessment, the security level of the target agent stabilizes and meets the preset security requirements.

[0082] In one possible implementation, the sandbox migration execution optimization module 504 adjusts the risk assessment threshold according to the following expression to balance the false positive rate and the false negative rate:

[0083] In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; A reinforcement learning-based parameter update strategy is used to update the model parameters. The optimized expression is as follows:

[0084] In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgment during the risk assessment process and the defensive benefits of dynamic sandbox protection. Anomaly samples are analyzed, and attack patterns, semantic features, and triggering rules are summarized using a large language model. New attack templates are then generated based on the characteristics of the anomaly samples. ,in, This is a template generation function based on a large language model, used to extract attack intent and command patterns; a new attack task template is adopted. To conduct the next round of confrontation assessment.

[0085] In one possible implementation, the sandbox migration execution optimization module 504 continuously evolves the new attack task template and sandbox protection strategy in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached a stable condition.

[0086] In this embodiment of the invention, the intelligent agent security assessment and dynamic sandbox protection system generates attack tasks of corresponding types based on pre-built attack task templates using a large language model. The generated attack tasks are input into a target intelligent agent in a controlled environment, causing the target intelligent agent to execute the attack tasks and collecting corresponding behavioral data during execution. Based on the collected intelligent agent behavioral data, quantitative analysis is performed to determine the security level of the target intelligent agent under the current attack task. Based on the security level, a corresponding dynamic sandbox protection mechanism is triggered to adapt and adjust the intelligent agent's permissions and resources, and control the intelligent agent to complete the current task execution within the sandbox according to the adjusted permissions and resources. The system receives feedback on abnormal samples during agent execution. Based on this feedback, it adjusts the risk assessment threshold and defense strategy parameters, and employs a reinforcement learning parameter update strategy to simultaneously optimize the detection model and attack task generation model. The abnormal samples are analyzed, and attack patterns, semantic features, and triggering rules are automatically extracted using a large language model. Attack intentions and command patterns are refined, and new attack task templates are generated and updated to the attack template library. Based on the updated attack template library and optimized defense strategies, the system enters the next round of adversarial evaluation, forming a continuous evolutionary closed loop of attack-detection-defense-optimization. When the agent's security score converges to a preset expected value after multiple rounds of adversarial evaluation, the system is considered to have reached steady-state performance. This invention enables dynamic monitoring and risk quantification of agent intentions, tool call chains, and external interaction processes. Upon detecting abnormal behavior, it implements hierarchical protection and strategy adjustment through a dynamic sandbox mechanism, thereby ensuring the agent's autonomy while guaranteeing the system's safe, controllable, and robust operation.

[0087] Another embodiment of the present invention provides an electronic device including a processor and a memory, the processor being used to execute a computer program stored in the memory to implement the aforementioned intelligent agent security assessment and dynamic sandbox protection method.

[0088] Another embodiment of the present invention provides a computer-readable storage medium storing at least one instruction that, when executed by a processor, implements the aforementioned agent security assessment and dynamic sandbox protection method.

[0089] The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable storage medium can include any entity or device capable of carrying the computer program code, a medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory, a random access memory, an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals. For ease of explanation, the above content only shows the parts related to the embodiments of the present invention; for specific technical details not disclosed, please refer to the method section of the embodiments of the present invention. This computer-readable storage medium is non-transitory and can be stored in storage devices formed by various electronic devices, enabling the execution process described in the method of the embodiments of the present invention.

[0090] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0092] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0093] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for intelligent agent security assessment and dynamic sandbox protection, characterized in that, include: The large language model generates attack tasks of the corresponding type based on pre-built attack task templates; The generated attack task is input into the target agent in the controlled environment, causing the target agent to execute the attack task, and the corresponding behavioral data of the target agent during the execution process is collected; Risk assessment is performed based on the collected agent behavior data to determine the security level of the target agent under the current attack task; Based on the security level, a corresponding dynamic sandbox protection mechanism is triggered to adapt and adjust the permissions and resources of the target intelligent agent. The target intelligent agent is then controlled to continue executing the attack task within the sandbox according to the adjusted permissions and resources. Data on the execution process of the target intelligent agent is obtained. Based on the data on the execution process of the target intelligent agent, the steps of generating the attack task from the large language model and the sandbox protection strategy are optimized simultaneously until the security level of the target intelligent agent tends to stabilize and meets the preset security requirements.

2. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 1, characterized in that, In the step of generating corresponding types of attack tasks through a large language model based on a pre-built attack task template, the attack task template includes an attack target description, semantic instruction pattern, tool call parameters, and constraints; the attack agent generates multiple types of attack tasks based on the attack task template, and the attack task types include any one of the following: Prompt injection, unauthorized call, resource exhaustion, and data leakage. The generated attack task is parameterized based on the runtime environment parameter set and converted into execution instructions. ; Execution instructions Perform configuration injection and encapsulate it into a format that conforms to the input specifications of the target intelligent agent.

3. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 1, characterized in that, In the step of performing risk assessment based on the collected agent behavior data to determine the security level of the target agent under the current attack task, a comprehensive security score is calculated based on the agent behavior data under the current attack task according to the following formula. : In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label The expressions for classifying conditions as safe, suspicious, or dangerous are as follows: In the formula, and The set safety threshold.

4. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 3, characterized in that, If the security level label If the situation is deemed dangerous or suspicious, a dynamic sandbox protection mechanism will be triggered; or, if the overall safety score decreases at a certain rate per unit time... Less than the trigger threshold At that time, the dynamic sandbox protection mechanism is triggered.

5. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 4, characterized in that, In the steps of triggering the corresponding dynamic sandbox protection mechanism based on the security level, adapting and adjusting the permissions and resources of the target agent, and controlling the target agent to continue executing the attack task in the sandbox according to the adjusted permissions and resources, after triggering the corresponding dynamic sandbox protection mechanism, migration is performed. The migration process follows the principle of minimum available context, transferring only the state required for execution; the session state of the target agent is migrated to run in the sandbox; after the migration is completed, the original host environment is shielded and frozen, and the file and interface transfer is completed to ensure that no resources are leaked during the migration process, and a unique session identifier is generated on the sandbox side.

6. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 4, characterized in that, In the step of triggering the corresponding dynamic sandbox protection mechanism based on the security level, adapting and adjusting the permissions and resources of the target intelligent agent, and controlling the target intelligent agent to continue executing the attack task within the sandbox according to the adjusted permissions and resources, permission constraints are imposed on the network communication, file access, and system command calls of the target intelligent agent within the sandbox, and unauthorized operations and abnormal call behaviors are monitored and blocked in real time; based on the security level label... The corresponding risk level is dynamically set using a continuous limit function, as shown in the following expression: After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource timing characteristics, network communication information, and file, process, and thread-related exception information. Based on the above multimodal observation signals, a comprehensive exception score is calculated. The comprehensive anomaly score Calculate according to the following formula: In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; The exponential moving average is used to smooth the overall anomaly score, as shown in the following expression: Set soft and hard blocking conditions. If either blocking condition is met, terminate the execution of the target agent and solidify the evidence chain. The soft blocking condition is an anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may hit a fatal rule; If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; The system performs outbound audits on task outputs, returns compliant results, and records execution process information as structured data as input for subsequent feedback loops. After an attack task is completed or terminated, the system reclaims the sandbox environment according to the destruction process, solidifies log indexes and forensic snapshot information, and sends back the target agent's execution status information.

7. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 3, characterized in that, The steps of acquiring target agent execution process data and simultaneously optimizing the attack task generation process and sandbox protection strategy based on the target agent execution process data until the security level of the target agent tends to stabilize and meets the preset security requirements include: acquiring abnormal sample feedback during the agent's execution process, adjusting the risk judgment threshold in the risk assessment process according to the abnormal sample feedback, and generating a new attack task template through the large language model and entering the next round of adversarial assessment; through multiple rounds of adversarial assessment, stabilizing the security level of the target agent and meeting the preset security requirements.

8. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 7, characterized in that, In the step of obtaining abnormal sample feedback during the execution of the intelligent agent, adjusting the risk judgment threshold in the risk assessment process based on the abnormal sample feedback, and simultaneously generating a new attack task template through the large language model and entering the next round of adversarial assessment, the risk judgment threshold is adjusted according to the following expression to balance the false positive rate and the false negative rate: In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; A reinforcement learning-based parameter update strategy is used to update the model parameters. The optimized expression is as follows: In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgment during the risk assessment process and the defensive benefits of dynamic sandbox protection. Anomaly samples are analyzed, and attack patterns, semantic features, and triggering rules are summarized using a large language model. New attack templates are then generated based on the characteristics of the anomaly samples. ,in, This is a template generation function based on a large language model, used to extract attack intent and command patterns; a new attack task template is adopted. To conduct the next round of confrontation assessment.

9. The method for intelligent agent security assessment and dynamic sandbox protection according to claim 7, characterized in that, In the step of stabilizing the security level of the target agent and meeting the preset security requirements through multiple rounds of adversarial evaluation, the new attack task template and sandbox protection strategy are continuously evolved in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached the stable condition.

10. A smart agent security assessment and dynamic sandbox protection system, characterized in that, include: The attack task generation module is used to generate attack tasks of corresponding types based on pre-built attack task templates using a large language model. The behavior data acquisition module is used to input the generated attack task into the target intelligent agent in the controlled environment, so that the target intelligent agent executes the attack task, and to collect the corresponding behavior data of the target intelligent agent during the execution process; The risk assessment module is used to perform risk assessment based on the collected agent behavior data and determine the security level of the target agent under the current attack task. The sandbox migration execution optimization module is used to trigger the corresponding dynamic sandbox protection mechanism based on the security level, adapt and adjust the permissions and resources of the target intelligent agent, and control the target intelligent agent to continue to execute the attack task in the sandbox according to the adjusted permissions and resources. It obtains the execution process data of the target intelligent agent, and optimizes the steps of generating the attack task from the large language model and the sandbox protection strategy based on the execution process data of the target intelligent agent until the security level of the target intelligent agent tends to be stable and meets the preset security requirements.

11. The intelligent agent security assessment and dynamic sandbox protection system according to claim 10, characterized in that, When the attack task generation module generates corresponding types of attack tasks based on the pre-built attack task template using a large language model, the attack task template includes an attack target description, semantic instruction pattern, tool call parameters, and constraints. The attack agent generates multiple types of attack tasks based on the attack task template. The attack task types include any one of the following: Prompt injection, unauthorized call, resource exhaustion, and data leakage. The generated attack task is parameterized based on the runtime environment parameter set and converted into execution instructions. ; Execution instructions Perform configuration injection and encapsulate it into a format that conforms to the input specifications of the target intelligent agent.

12. The intelligent agent security assessment and dynamic sandbox protection system according to claim 10, characterized in that, The risk assessment module calculates a comprehensive security score based on the agent behavior data under the current attack task according to the following formula. : In the formula, Indicates the instruction compliance score. This indicates a score for access control constraints. This indicates that the tool calls a security score. This indicates a data breach negative rating. This indicates the anomaly detection score; Based on the overall safety score Calculate security level label And decide whether to enter the sandbox protection phase; the security level label The expressions for classifying conditions as safe, suspicious, or dangerous are as follows: In the formula, and The set safety threshold.

13. The intelligent agent security assessment and dynamic sandbox protection system according to claim 12, characterized in that, The sandbox migration execution optimization module, when the security level label... If the situation is deemed dangerous or suspicious, a dynamic sandbox protection mechanism will be triggered; or, if the overall safety score decreases at a certain rate per unit time... Less than the trigger threshold When this happens, the dynamic sandbox protection mechanism is triggered.

14. The intelligent agent security assessment and dynamic sandbox protection system according to claim 13, characterized in that, The sandbox migration execution optimization module performs migration after triggering the corresponding dynamic sandbox protection mechanism. The migration process follows the principle of minimum available context, transferring only the state required for execution. The session state of the target agent is migrated to the sandbox for operation. After the migration is completed, the original host environment is shielded and frozen, and the files and interfaces are transferred to ensure that no resources are leaked during the migration process. A unique session identifier is generated on the sandbox side.

15. The intelligent agent security assessment and dynamic sandbox protection system according to claim 13, characterized in that, The sandbox migration execution optimization module restricts the network communication, file access and system command calls of the target intelligent agent within the sandbox, and monitors and blocks unauthorized operations and abnormal call behaviors in real time. According to security level labels The corresponding risk level is dynamically set using a continuous limit function, as shown in the following expression: After adjusting the permissions and resources of the target agent, multimodal observation is performed on the execution process of the target agent. The observed signals include: language flow and invocation intent, system call sequence and exception return, tool call chain, resource timing characteristics, network communication information, and file, process, and thread-related exception information. Based on the above multimodal observation signals, a comprehensive exception score is calculated. The comprehensive anomaly score Calculate according to the following formula: In the formula, For each sub-detector, a standardized anomaly metric is provided. Weights for each part; The exponential moving average is used to smooth the overall anomaly score, as shown in the following expression: Set soft and hard blocking conditions. If either blocking condition is met, terminate the execution of the target agent and solidify the evidence chain. The soft blocking condition is an anomaly score. Greater than the first set value And it continues for more than the preset duration; the hard blocking condition is an abnormal score. Greater than the second set value Or it may hit a fatal rule; If no blocking conditions are triggered, the attack task is allowed to be completed normally within the sandbox; The system performs outbound audits on task outputs, returns compliant results, and records execution process information as structured data as input for subsequent feedback loops. After an attack task is completed or terminated, the system reclaims the sandbox environment according to the destruction process, solidifies log indexes and forensic snapshot information, and sends back the target agent's execution status information.

16. The intelligent agent security assessment and dynamic sandbox protection system according to claim 12, characterized in that, The sandbox migration execution optimization module acquires data on the target agent's execution process and simultaneously optimizes the generation of attack tasks from the large language model and the sandbox protection strategy based on this data, until the target agent's security level stabilizes and meets preset security requirements. Then, it acquires feedback from abnormal samples during the agent's execution process and adjusts the risk assessment threshold based on this feedback. Simultaneously, it generates a new attack task template using the large language model and proceeds to the next round of adversarial evaluation. Through multiple rounds of adversarial evaluation, the target agent's security level stabilizes and meets preset security requirements.

17. The intelligent agent security assessment and dynamic sandbox protection system according to claim 16, characterized in that, The sandbox migration execution optimization module adjusts the risk assessment threshold according to the following expression to balance the false positive rate and the false negative rate: In the formula, The loss function is based on the score and the true risk. The learning rate; This is the current risk assessment threshold; The adjusted risk assessment threshold; A reinforcement learning-based parameter update strategy is used to update the model parameters. The optimized expression is as follows: In the formula, The learning rate; The security loss function comprehensively considers the penalties for misjudgment during the risk assessment process and the defensive benefits of dynamic sandbox protection. Anomaly samples are analyzed, and attack patterns, semantic features, and triggering rules are summarized using a large language model. New attack templates are then generated based on the characteristics of the anomaly samples. ,in, This is a template generation function based on a large language model, used to extract attack intent and command patterns; a new attack task template is adopted. To conduct the next round of confrontation assessment.

18. The intelligent agent security assessment and dynamic sandbox protection system according to claim 16, characterized in that, The sandbox migration execution optimization module continuously evolves the new attack task template and sandbox protection strategy in a closed loop through multiple rounds of adversarial evaluation until the comprehensive security score converges to the preset expected value. At this point, it is determined that the security level of the target agent has reached a stable condition.

19. An electronic device, characterized in that, It includes a processor and a memory, the processor being used to execute a computer program stored in the memory to implement the intelligent agent security assessment and dynamic sandbox protection method as described in any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which, when executed by a processor, implements the agent security assessment and dynamic sandbox protection method as described in any one of claims 1 to 9.

Images