Hierarchical planning and specific task agency system, method and equipment and storage medium

Abstract

The invention discloses a hierarchical planning and specific task proxy system, method and device and a storage medium. According to the scheme, the security of the system is comprehensively improved through a monitor sub-module, an authorizer sub-module and an anomaly detection and responder sub-module, and the comprehensive capability of the system is improved; besides, by constructing an enhanced filter module and a registrar sub-module and optimizing a task execution process, the flexibility of the system is improved, convenient access of different tasks and custom expert agent modules is realized, the custom expert agent modules can be registered according to requirements, each expert agent module can complete its unique function, and the user experience is improved. Different application scenes can be migrated and adapted, so that the system capability is expanded in real time; meanwhile, the system adopts a hierarchical and modular design, core functions of the system are independently realized in each level and module, and the levels and the modules realize communication through a message mechanism, so that the system has the characteristics of high cohesion and low coupling.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to hierarchical planning and specific task agent systems, methods, devices and storage media. Background Art

[0002] With the continuous in-depth research and exploration of artificial intelligence applications, the capabilities of artificial intelligence agents are becoming more and more powerful, and the application scenarios are becoming more and more diversified. Artificial intelligence agents are already able to collaborate to complete a complex event.

[0003] At present, the hierarchical planning and task-specific agent system is a more practical multi-AI agent collaboration framework, which uses multi-level collaboration as the architecture and task-specific agents as the tentacles to collaboratively complete more complex tasks. It mainly consists of three components, namely a hierarchical planner, a group of task-specific expert agents, and a team manager who manages these task-specific agents.

[0004] However, the comprehensive capabilities of existing hierarchical planning and specific task agent systems are relatively poor. Therefore, how to improve the existing hierarchical planning and specific task agent systems to enhance their comprehensive capabilities is an urgent problem to be solved. Summary of the invention

[0005] The present application aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present application proposes a hierarchical planning and specific task agent system, which includes a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert agent modules, and the enhanced filter module includes a monitor submodule, an authorizer submodule, a registrar submodule, and an anomaly detection and responder submodule; wherein the team manager module is respectively communicated with the hierarchical planner module and the enhanced filter module, the enhanced filter module is communicated with a group of preset expert agent modules, and each preset expert agent module is communicated with each other;

[0006] A hierarchical planner module, configured to explore the environmental information of the current network site, generate target instructions based on the environmental information of the current network site, and send the target instructions to the team manager module;

[0007] A team manager module is used to receive target instructions, generate scheduling commands for each preset expert agent module based on the target instructions, and send the scheduling commands to the enhanced filter module;

[0008] An enhanced filter module is used to receive the scheduling command and send it to the preset expert agent module in the list of available expert agent modules. The monitor submodule in the enhanced filter module is used to monitor the attack status and usage status of each preset expert agent module in real time. The authorizer submodule is used to authorize the team manager module and each preset expert agent module. The registrar submodule is used to provide a service discovery registration interface for the custom expert agent module. The anomaly detection and responder submodule is used to detect and respond to the abnormal status of each preset expert agent module and the custom expert agent module in real time.

[0009] The preset expert agent module is used to receive the scheduling command and execute the corresponding preset attack plan based on the scheduling command.

[0010] In one possible implementation, if the attack status and usage status of each preset expert agent module returned by the monitor sub-module, and any one of the authorization information returned by the authorizer sub-module meet the preset requirements, the enhanced filter module is also used to obtain the task termination instruction generated by the monitor sub-module and / or the authorizer sub-module, and terminate the corresponding task based on the task termination instruction.

[0011] In a possible implementation, a set of preset expert proxy modules includes a current preset expert proxy module and other preset expert proxy modules;

[0012] The current preset expert agent module is used to send the current operation data to the target preset expert agent module in other preset expert agent modules when the module runs to the preset state; wherein the preset state includes any one of the operation completion state, the calculated target indicator value, and the abnormal operation state, and the target preset expert agent module includes other preset expert agent modules that are logically adjacent to the current preset expert agent module, and at least one of other pre-specified preset expert agent modules;

[0013] The target preset expert agent module is used to receive current operation data and determine the target behavior based on the current operation data and preset task execution rules.

[0014] In a possible implementation manner, the monitor submodule is further configured to:

[0015] Analyze the attack status and usage status of each preset expert proxy module monitored, and determine the abnormal behavior of each preset expert proxy module; wherein the abnormal behavior includes any one of attack behavior, hijacking behavior and abuse behavior;

[0016] When it is determined that the preset expert agent module has abnormal behavior, the abnormal behavior is sent to the enhanced filter module so that the enhanced filter module determines a corresponding control strategy based on the abnormal behavior; wherein the control strategy includes any one of terminating the operation of the preset expert agent module, isolating the preset expert agent module, and recovering the resource usage rights of the preset expert agent module.

[0017] In one possible implementation, the authorizer submodule is used to:

[0018] Identify the necessary permission set and necessary resource set corresponding to each preset expert proxy module; wherein the necessary permission set includes all permissions required by the preset expert proxy module during execution, and the necessary resource set includes all resources required by the preset expert proxy module during execution;

[0019] When the current permission application and the current resource application of the preset expert proxy module are obtained, the current permission application and the current resource application are verified by the necessary permission set and the necessary resource set corresponding to the preset expert proxy module;

[0020] After the verification is passed, the preset expert agent module is authorized.

[0021] In one possible implementation, the anomaly detection and responder submodule is used to:

[0022] Obtaining initialization normal behavior related data and current behavior related data of each preset expert agent module and custom expert agent module;

[0023] Compare the initialized normal behavior related data with the current behavior related data, and obtain the real-time detection results of the abnormal states of each preset expert agent module and the custom expert agent module according to the comparison results;

[0024] When abnormal behavior is determined based on the real-time detection results of each preset expert agent module and the custom expert agent module, the real-time detection results are sent to the enhanced filter module so that the enhanced filter module determines the corresponding control strategy based on the real-time detection results; wherein the abnormal behavior is used to characterize the inconsistency between the current behavior-related data and the initialized normal behavior-related data.

[0025] In a possible implementation, the register submodule is further used for:

[0026] List of preset expert agent modules for real-time monitoring system;

[0027] When it is determined that a custom expert proxy module is added to the preset expert proxy module list, a verification process is performed on the custom expert proxy module to obtain a verification result;

[0028] If the verification result is successful, the custom expert proxy module is initialized to obtain an initialized custom expert proxy module; wherein the initialization operation at least includes parsing the function description of the custom expert proxy module, parsing the required calling tool, and parsing and verifying the permissions and resources;

[0029] The initialized custom expert agent module is moved to the available expert agent module list, and the message corresponding to the available expert agent module list is sent to the team manager module and other preset expert agent modules.

[0030] In a second aspect, the present application proposes a hierarchical planning and specific task proxy method, which is applied to a hierarchical planning and specific task proxy system. The system includes a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert proxy modules. The enhanced filter module includes a monitor submodule, an authorizer submodule, a register submodule, and an anomaly detection and responder submodule; wherein the team manager module is respectively communicated with the hierarchical planner module and the enhanced filter module, the enhanced filter module is communicated with a group of preset expert proxy modules, and each preset expert proxy module is communicated with each other; the method includes:

[0031] Exploring the environmental information of the current network site through the hierarchical planner module, generating target instructions based on the environmental information of the current network site, and sending the target instructions to the team manager module;

[0032] Receive the target instruction through the team manager module, generate a dispatch command for each preset expert agent module based on the target instruction, and send the dispatch command to the enhanced filter module;

[0033] The enhanced filter module receives the scheduling command and sends it to the preset expert agent module in the list of available expert agent modules, the monitor submodule in the enhanced filter module monitors the attack status and usage status of each preset expert agent module in real time, the authorizer submodule authorizes the team manager module and each preset expert agent module, the registrar submodule provides the service discovery registration interface of the custom expert agent module, and the anomaly detection and responder submodule detects and responds to the abnormal status of each preset expert agent module and the custom expert agent module in real time;

[0034] The scheduling command is received through the preset expert agent module, and the corresponding preset attack plan is executed based on the scheduling command.

[0035] The third aspect of the present application proposes an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the hierarchical planning and specific task agent system as described in the second aspect.

[0036] The fourth aspect of the present application proposes a computer-readable storage medium, which stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by a processor to implement the hierarchical planning and specific task agent system as described in the second aspect.

[0037] The embodiments of the present application have the following beneficial effects:

[0038] The hierarchical planning and specific task agent system, method, device and storage medium provided by the embodiment of the present application, the system includes: a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert agent modules, the enhanced filter module includes a monitor submodule, an authorizer submodule, a registrar submodule, and an anomaly detection and responder submodule; wherein the team manager module is respectively communicated with the hierarchical planner module and the enhanced filter module, the enhanced filter module is communicated with a group of preset expert agent modules, and each preset expert agent module is communicated with each other. The hierarchical planner module is used to explore the environmental information of the current network site, generate target instructions based on the environmental information of the current network site, and send the target instructions to the team manager module. The team manager module is used to receive the target instructions, and generate scheduling commands for each preset expert agent module based on the target instructions, and send the scheduling commands to the enhanced filter module. The enhanced filter module is used to receive the scheduling command and send it to the preset expert agent module in the list of available expert agent modules. The monitor submodule in the enhanced filter module is used to monitor the attack status and usage status of each preset expert agent module in real time. The authorizer submodule is used to authorize the team manager module and each preset expert agent module. The registrar submodule is used to provide a service discovery registration interface for the custom expert agent module. The anomaly detection and responder submodule is used to detect and respond to the abnormal status of each preset expert agent module and the custom expert agent module in real time. The preset expert agent module is used to receive the scheduling command and execute the corresponding preset attack plan based on the scheduling command. This solution comprehensively improves the system security and the comprehensive capabilities of the system through the monitor sub-module, authorizer sub-module, anomaly detection and responder sub-module, and enables timely attention to tasks before, during, after and at the execution results, making the decision-making process more transparent and easy to analyze and understand; in addition, by constructing enhanced filter modules and registrar sub-modules and optimizing the task execution process, the flexibility of the system is improved, and convenient access to different tasks and custom expert agent modules is achieved. Custom expert agent modules can be registered according to needs. Each expert agent module can complete its unique functions and can be migrated and adapted to different application scenarios, thereby expanding the system capabilities in real time; at the same time, the system adopts a hierarchical and modular design, and each level and module independently implements its core functions. The levels and modules communicate through a message mechanism, which makes the system have the characteristics of high cohesion and low coupling. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A framework diagram of an existing HPTSA provided in an embodiment of the present application;

[0040] Figure 2 A block diagram of a computer device provided in an embodiment of the present application;

[0041] Figure 3 A framework diagram of a hierarchical planning and specific task agent system provided in an embodiment of the present application;

[0042] Figure 4 A flowchart of the steps of a hierarchical planning and specific task proxy method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] At present, the Hierarchical Planning and Specific Task Agent System, or HPTSA, is a relatively practical multi-AI agent collaboration framework that uses multi-level collaboration as its architecture and specific task agents as its tentacles to collaboratively complete more complex tasks. Figure 1 As shown, Figure 1 The framework diagram of an existing HPTSA provided for the embodiment of the present application mainly includes three components, namely, a hierarchical planner, a group of expert agents for specific tasks, and a team manager Manager who manages these specific task agents. Among them, the main task of the hierarchical planner is to explore the site environment, the team manager decides which specific agents to use in the task to perform the task, and a group of expert agents, including XSS Agent, SQLi Agent, CSRF Agent, and SSTIAgent.

[0045] However, the existing hierarchical planning and specific task agent systems have poor comprehensive capabilities, which are specifically reflected in the high failure rate in coping with complex environmental scenarios, insufficient direct collaboration capabilities between multiple artificial intelligence agents, lack of security protection capabilities, insufficient fine-grained access control, unreasonable resource allocation of each artificial intelligence agent, and poor anomaly detection and response capabilities. These problems directly restrict the application and implementation of HPTSA in more scenarios.

[0046] In view of this, the present application proposes a hierarchical planning and specific task agent system, method, device and storage medium, which comprehensively improves the system security and the comprehensive capabilities of the system through the monitor sub-module, the authorizer sub-module, the anomaly detection and responder sub-module, and enables timely attention to tasks before, during, after and at the execution results, making the decision-making process more transparent and easy to analyze and understand; in addition, by constructing an enhanced filter module and a registrar sub-module and optimizing the task execution process, the flexibility of the system is improved, and convenient access to different tasks and custom expert agent modules is achieved. Custom expert agent modules can be registered according to needs, and each expert agent module can complete its unique functions, and can be migrated and adapted to different application scenarios, thereby expanding the system capabilities in real time; at the same time, the system adopts a hierarchical and modular design, and each level and module independently implements its core functions, and the levels and modules communicate through a message mechanism, so that the system has the characteristics of high cohesion and low coupling.

[0047] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values ​​may be based on additional conditions or values ​​beyond the described values ​​in practice.

[0048] The hierarchical planning and specific task agent system provided in the present application can be applied to computer devices (electronic devices), and the computer devices can be servers or terminals, wherein the server can be a single server or a server cluster composed of multiple servers. The embodiments of the present application do not make specific limitations on this. The terminals can be, but are not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices.

[0049] Take the computer device as a server as an example. Figure 2 A block diagram of a server is shown, such as Figure 2 As shown, the server may include a processor and a memory connected via a system bus. The processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a hierarchical planning and specific task agent system is implemented.

[0050] Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. Optionally, the server may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0051] It should be noted that the execution subject of the embodiments of the present application may be a computer device or a data privacy protection device. The following method embodiments are described using a computer device as the execution subject.

[0052] Figure 3 A framework diagram of a hierarchical planning and specific task agent system provided in an embodiment of the present application. Figure 3 As shown, the system includes a hierarchical planner module, namely Planner, a team manager module, namely Manager, an enhanced filter module and a group of preset expert agent modules Agent, including XSS Agent, SQLi Agent, CSRF Agent, SSTI Agent, the enhanced filter module includes a monitor sub-module, an authorizer sub-module, a registrar sub-module, anomaly detection and responder sub-module, wherein the team manager module is communicated with the hierarchical planner module and the enhanced filter module respectively, the enhanced filter module is communicated with a group of preset expert agent modules, and each preset expert agent module is communicated with each other.

[0053] The hierarchical planner module is used to explore the environmental information of the current network site, generate target instructions based on the environmental information of the current network site, and send the target instructions to the team manager module.

[0054] The team manager module is used to receive the target instruction, generate a scheduling command for each preset expert agent module based on the target instruction, and send the scheduling command to the enhanced filter module.

[0055] The enhanced filter module is used to receive scheduling commands and send them to the preset expert agent modules in the list of available expert agent modules. The monitor submodule in the enhanced filter module is used to monitor the attack status and usage status of each preset expert agent module in real time. The authorizer submodule is used to authorize the team manager module and each preset expert agent module. The registrar submodule is used to provide a service discovery registration interface for the custom expert agent module. The anomaly detection and responder submodule is used to detect and respond to the abnormal status of each preset expert agent module and the custom expert agent module in real time.

[0056] The preset expert agent module is used to receive the scheduling command and execute the corresponding preset attack plan based on the scheduling command.

[0057] Among them, the existing HPTSA lacks the window for message filtering, information identification, and task execution process monitoring between the team manager module and the preset expert agent module, which is not conducive to task execution process monitoring, security assurance, abnormal behavior control, etc. In view of these shortcomings, an enhanced filter module, namely Strengthen&Filter, is added between the team manager module and the preset expert agent module. The main enhancements of the enhanced filter module include: data collection, enhanced window, and behavior termination.

[0058] For data collection, the enhanced filter module can collect the dispatching commands issued by the team manager module and the feedback information of the execution results of each preset expert agent module, providing data support for subsequent other enhancements. In other words, the enhanced filter module can be deployed on the main road of the hierarchical planning and specific task agent system, and all information passing through this main road can be collected.

[0059] For the enhanced window, the enhanced filter module is provided with an injection window for the monitor submodule, the authorizer submodule, the registrar submodule, and the anomaly detection and responder submodule. In other words, the enhanced filter module leaves standardized interfaces for various other submodules to connect with, and other submodules can connect with it according to the interface specifications.

[0060] For behavior termination, the enhanced filter module also provides the function of timely terminating the process of behaviors that do not meet the requirements to avoid damage. In some optional embodiments, if the attack status and use status of each preset expert agent module returned by the monitor submodule and any one of the authorization information returned by the authorizer submodule meet the preset requirements, the enhanced filter module is also used to obtain the task termination instruction generated by the monitor submodule and / or the authorizer submodule, and terminate the corresponding task based on the task termination instruction.

[0061] Among them, the attack status of each preset expert agent module returned by the monitor submodule is the attacked status, the use status is the abuse status, and the authorization information returned by the authorizer submodule is that a certain instruction is not authorized by the authorizer submodule, which can be regarded as meeting the preset conditions. Therefore, the monitor submodule and / or the authorizer submodule can send a task termination instruction of the subsequent behavior to the enhanced filter module, and the enhanced filter module obtains the task termination instruction and immediately terminates the corresponding task based on the task termination instruction to avoid the occurrence of security incidents.

[0062] In some optional embodiments, a group of preset expert agent modules includes a current preset expert agent module and other preset expert agent modules. The current preset expert agent module is used to send the current operation data to the target preset expert agent module in the other preset expert agent modules when the current operation data is running to the preset state. The target preset expert agent module is used to receive the current operation data and determine the target behavior based on the current operation data and the preset task execution rules.

[0063] The preset state includes any one of the following: the running completed state, the calculated target index value, and the running abnormal state; the target preset expert agent module includes other preset expert agent modules that are logically adjacent to the current preset expert agent module, and at least one of other pre-specified preset expert agent modules. The logical proximity here means that in the tasks planned by the team manager module, the preset expert agent modules have dependencies and a sequence of precedence, and a logically adjacent sequence is formed according to these relationships.

[0064] When the current preset expert agent module runs to the preset state, the current operation data is sent to the target preset expert agent module in other preset expert agent modules. The operation data may include target indicator values ​​or other information packaged in the form of messages. The target preset expert agent module can monitor messages at any time to receive the current operation data, and determine the target behavior based on the current operation data and the preset task execution rules.

[0065] Optionally, in some cases, the preset expert agent module no longer needs to wait for the team manager module to send instructions before starting, but executes autonomously after receiving relevant messages. Exemplarily, the preset expert agent module for abnormality analysis captures abnormal information in time when an abnormality occurs in another preset expert agent module, and can autonomously submit it to the team manager module after preliminary analysis, and then wait for further instructions.

[0066] In this embodiment, since there is a lack of information exchange between a group of preset expert agent modules of the existing HPTSA, that is, a group of preset expert agent modules of the existing HPTSA cannot communicate with each other, this mechanism has obvious defects when the number of preset expert agent modules is large and the task complexity is high. In view of these shortcomings, by enhancing the cooperation mechanism between the preset expert agent modules, multiple preset expert agent modules can be executed in sequence or automatically call up other preset expert agent modules to run in some cases without the intervention of the team manager module, without the need to request the team manager module multiple times, thereby improving efficiency, simplifying the operation process and reducing the complexity of the task.

[0067] In some optional embodiments, the monitor submodule, i.e., Monitor, is further used to analyze the attack status and usage status of each preset expert agent module monitored, and determine the abnormal behavior of each preset expert agent module. In the case of determining that the preset expert agent module has abnormal behavior, the abnormal behavior is sent to the enhanced filter module, so that the enhanced filter module determines a corresponding control strategy based on the abnormal behavior.

[0068] Among them, the monitor submodule can monitor the running status, running results, resource usage, etc. of each preset expert agent module in real time, and the relevant staff can also grasp the overall task implementation progress at any time through the monitor submodule. In addition, the monitor submodule can also provide a standard interface for other tools such as visualization tools, which can obtain the current running data for visualization, further enhancing the visualization effect.

[0069] Next, the monitor submodule can determine the attack status and usage status of each preset expert proxy module based on the monitored information, and analyze and determine the abnormal behavior of each preset expert proxy module, which includes any of attack behavior, hijacking behavior and abuse behavior. When performing the analysis, abnormal behavior can be discovered by pattern matching, historical behavior statistics, or deep neural network methods such as LSTM.

[0070] In the case where it is determined that the preset expert agent module has abnormal behavior, the abnormal behavior is sent to the enhanced filter module, so that the enhanced filter module determines a corresponding control strategy based on the abnormal behavior to avoid a more destructive security incident. The control strategy includes any one of terminating the operation of the preset expert agent module, isolating the preset expert agent module, and reclaiming the resource usage authority of the preset expert agent module.

[0071] In this embodiment, since the existing HPTSA's preset expert agent module and team manager module lack their own security protection mechanism, there may be a risk of being attacked, hijacked or abused. In view of these shortcomings, by adding a monitor submodule, the behavior of the preset expert agent module and the team manager module is detected and analyzed in real time to determine whether they are attacked, hijacked or abused, thereby enhancing the overall security of the system.

[0072] In some optional embodiments, the authorizer submodule, namely Authorizetor, is used to identify the necessary permission sets and necessary resource sets corresponding to each preset expert proxy module. When the current permission application and current resource application of the preset expert proxy module are obtained, the current permission application and current resource application are verified by the necessary permission set and necessary resource set corresponding to the preset expert proxy module. After the verification is passed, the preset expert proxy module is authorized.

[0073] Among them, when the preset expert agent module is registered in the system, that is, when it is initialized, the authorizer submodule fully identifies the permissions required by the preset expert agent module, including but not limited to the permission to execute a certain function, the permission to call a certain tool or tools, and uses all the identified permissions as the necessary permission set corresponding to the preset expert agent module, and assigns the necessary permission set to the preset expert agent module. The necessary permission set includes all permissions required by the preset expert agent module during execution. This ensures that the permissions required for the execution of the preset expert agent module are already possessed, and the permissions possessed are all necessary permissions at runtime, thereby strengthening the risk protection caused by the malicious use of the preset expert agent module.

[0074] At the same time, when the preset expert proxy module is registered in the system, that is, when it is initialized, the authorizer submodule fully identifies the resources required by the preset expert proxy module, including but not limited to system hardware and software resources, expansion tool resources, and other external resources, and uses all identified resources as the necessary resource set corresponding to the preset expert proxy module, and allocates the necessary resource set to the preset expert proxy module. The necessary resource set includes all the resources required by the preset expert proxy module during execution. This ensures that the resources required for the execution of the preset expert proxy module can be used by it, and the resources it has are all necessary resources for runtime, which strengthens the risk protection of system resources being maliciously used due to the malicious use of the preset expert proxy module.

[0075] Next, when the current permission application and current resource application of the preset expert proxy module are obtained, the current permission application and current resource application can be verified through the necessary permission set and necessary resource set corresponding to the preset expert proxy module. Finally, the authorizer submodule can also report the verification results to the enhanced filter module, and the enhanced filter module will take action based on the results to decide whether to agree or deny the use of the tool or the permission acquisition behavior. After the verification is passed, the preset expert proxy module is authorized.

[0076] In this embodiment, since the preset expert proxy module of the existing HPTSA can schedule or use all system resources by default, this mechanism has a greater impact when multiple preset expert proxy modules are executed in parallel or a preset expert proxy module is attacked, especially when a DDoc attack occurs. In view of these shortcomings, by constructing an authorizer submodule, the necessary permission set and necessary resource set of the preset expert proxy module are calculated to ensure that the preset expert proxy module can operate normally without occupying other system resources and generating unnecessary consumption.

[0077] In some optional embodiments, the registrar submodule, i.e. UDDI-Agents, is also used for the preset expert proxy module list of the real-time monitoring system. When the preset expert proxy module list is determined to have been increased, the custom expert proxy module is verified and processed to obtain a verification result. If the verification result is a successful verification, the custom expert proxy module is initialized to obtain the initialized custom expert proxy module. The initialized custom expert proxy module is moved to the available expert proxy module list, and the message corresponding to the available expert proxy module list is sent to the team manager module and other preset expert proxy modules.

[0078] Among them, when monitoring the preset expert proxy module list of the system in real time, the registrar submodule can scan the preset expert proxy module list once at a certain frequency. For example, the preset expert proxy module list can be scanned every 30 seconds. The preset expert proxy module list is a list of all preset expert proxy modules before the registration of the preset expert proxy module. After a preset expert proxy module is registered, it is moved to the available expert proxy module list. When planning tasks, the team manager module uses the expert proxy modules in the available expert proxy module list to disassemble and execute tasks.

[0079] When it is determined that a custom expert proxy module is added to the preset expert proxy module list, the custom expert proxy module is verified to obtain a verification result. When performing the verification process, it can be checked whether the necessary components are present, whether the functional description is accurate, whether the input and output are standardized, etc. If the verification result is a verification failure, it is removed from the preset expert proxy module list.

[0080] If the verification result is successful, the custom expert proxy module is initialized to obtain the initialized custom expert proxy module. The initialization operation at least includes the parsing of the function description of the custom expert proxy module, the parsing of the required calling tools, and the parsing and verification of permissions and resources. Finally, the initialized custom expert proxy module is moved to the list of available expert proxy modules, and the message corresponding to the list of available expert proxy modules is sent to the team manager module and other preset expert proxy modules.

[0081] In this embodiment, since the existing HPTSA provides a limited number of preset expert agent modules, if a customized expert agent module is needed, the team manager module needs to be modified, and if communication with other preset expert agent modules is required, the built-in completely consistent expert agent module specifications must be met, which is not conducive to scene migration and application expansion. In view of these shortcomings, the custom expert agent module extension mechanism is enhanced by building a registrar submodule, so that the custom expert agent module can be connected in a convenient, timely, and transparent way to the original preset expert agent module, and other preset expert agent modules can be notified in a timely manner, laying the foundation for later collaboration.

[0082] In some optional embodiments, the exception detection and responder submodule, also known as Exception-Operator, is used to obtain the initialization normal behavior related data and current behavior related data of each preset expert agent module and the custom expert agent module. The initialization normal behavior related data and the current behavior related data are compared, and the real-time detection results of the abnormal state of each preset expert agent module and the custom expert agent module are obtained according to the comparison results. In the case where it is determined that there is abnormal behavior according to the real-time detection results of each preset expert agent module and the custom expert agent module, the real-time detection results are sent to the enhanced filter module, so that the enhanced filter module determines the corresponding control strategy based on the real-time detection results.

[0083] Among them, the anomaly detection and responder submodule can collect the initialization normal behavior related data of each preset expert agent module and the custom expert agent module, and the initialization normal behavior related data may include normal behavior, expected results of key process operation, and overall expected results before task execution. These data can be determined based on the functional description and output items of each preset expert agent module and the custom expert agent module. In addition, these data have described the expected results of key process operation, the overall expected results and other information when each preset expert agent module and the custom expert agent module are initialized, and the relevant content is recorded in the system.

[0084] Next, the anomaly detection and responder submodule also needs to monitor the current behavior-related data such as the behavior, status, operation progress, interim results, and execution results of each preset expert agent module and custom expert agent module in real time. The initialized normal behavior-related data and the current behavior-related data are compared, and the real-time detection results of the abnormal status of each preset expert agent module and the custom expert agent module are obtained based on the comparison results. Optionally, when performing the comparison, the traditional pattern matching method can be used to compare whether the keywords or specific results in the execution results are consistent with the normal behavior, or the similarity algorithm can be used to calculate the similarity, such as using the cosine similarity algorithm to determine whether the similarity meets a certain threshold.

[0085] In the case where abnormal behavior is determined according to the real-time detection results of each preset expert agent module and the custom expert agent module, the real-time detection results are sent to the enhanced filter module, so that the enhanced filter module determines a corresponding control strategy based on the real-time detection results, and the control strategy may be to terminate a certain behavior. Among them, the abnormal behavior is used to characterize that the current behavior-related data is inconsistent with the initialized normal behavior-related data.

[0086] The present application provides a hierarchical planning and specific task agent system, which includes: a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert agent modules, the enhanced filter module includes a monitor submodule, an authorizer submodule, a registrar submodule, and an anomaly detection and responder submodule; wherein the team manager module is respectively communicated with the hierarchical planner module and the enhanced filter module, the enhanced filter module is communicated with a group of preset expert agent modules, and each preset expert agent module is communicated with each other. The hierarchical planner module is used to explore the environmental information of the current network site, generate target instructions based on the environmental information of the current network site, and send the target instructions to the team manager module. The team manager module is used to receive the target instructions, and generate scheduling commands for each preset expert agent module based on the target instructions, and send the scheduling commands to the enhanced filter module. The enhanced filter module is used to receive the scheduling command and send it to the preset expert agent module in the list of available expert agent modules. The monitor submodule in the enhanced filter module is used to monitor the attack status and usage status of each preset expert agent module in real time. The authorizer submodule is used to authorize the team manager module and each preset expert agent module. The registrar submodule is used to provide a service discovery registration interface for the custom expert agent module. The anomaly detection and responder submodule is used to detect and respond to the abnormal status of each preset expert agent module and the custom expert agent module in real time. The preset expert agent module is used to receive the scheduling command and execute the corresponding preset attack plan based on the scheduling command. This solution comprehensively improves the system security and the comprehensive capabilities of the system through the monitor sub-module, authorizer sub-module, anomaly detection and responder sub-module, and enables timely attention to tasks before, during, after and at the execution results, making the decision-making process more transparent and easy to analyze and understand; in addition, by constructing enhanced filter modules and registrar sub-modules and optimizing the task execution process, the flexibility of the system is improved, and convenient access to different tasks and custom expert agent modules is achieved. Custom expert agent modules can be registered according to needs. Each expert agent module can complete its unique functions and can be migrated and adapted to different application scenarios, thereby expanding the system capabilities in real time; at the same time, the system adopts a hierarchical and modular design, and each level and module independently implements its core functions. The levels and modules communicate through a message mechanism, which makes the system have the characteristics of high cohesion and low coupling.

[0087] The present application also provides a hierarchical planning and specific task proxy method, which is applied to the hierarchical planning and specific task proxy system. The system includes a hierarchical planner module, a team manager module, an enhanced filter module and a set of preset expert proxy modules. The enhanced filter module includes a monitor submodule, an authorizer submodule, a register submodule, and an anomaly detection and responder submodule. Among them, the team manager module is respectively connected to the hierarchical planner module and the enhanced filter module, the enhanced filter module is connected to a set of preset expert proxy modules, and each preset expert proxy module is connected to each other. Figure 4 As shown, Figure 4 A flowchart of a hierarchical planning and specific task proxy method provided in an embodiment of the present application includes:

[0088] Step 402: Explore the current network site's environmental information through the hierarchical planner module, generate target instructions based on the current network site's environmental information, and send the target instructions to the team manager module.

[0089] Step 404: Receive the target instruction through the team manager module, generate a scheduling command for each preset expert agent module based on the target instruction, and send the scheduling command to the enhanced filter module.

[0090] Step 406: Receive the scheduling command through the enhanced filter module and send it to the preset expert agent module in the list of available expert agent modules; monitor the attack status and usage status of each preset expert agent module in real time through the monitor sub-module in the enhanced filter module; authorize the team manager module and each preset expert agent module through the authorizer sub-module; provide a service discovery registration interface for the custom expert agent module through the registrar sub-module; and perform real-time detection and response to the abnormal status of each preset expert agent module and the custom expert agent module through the anomaly detection and responder sub-module.

[0091] Step 408: Receive the scheduling command through the preset expert agent module, and execute the corresponding preset attack plan based on the scheduling command.

[0092] The implementation principle and technical effect of the hierarchical planning and specific task proxy method provided in the embodiment of the present application are similar to those of the above-mentioned hierarchical planning and specific task proxy system embodiment, and will not be repeated here.

[0093] In one embodiment of the present application, a computer device is provided, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0094] Exploring the environmental information of the current network site through the hierarchical planner module, generating target instructions based on the environmental information of the current network site, and sending the target instructions to the team manager module;

[0095] Receive the target instruction through the team manager module, generate a dispatch command for each preset expert agent module based on the target instruction, and send the dispatch command to the enhanced filter module;

[0096] The enhanced filter module receives the scheduling command and sends it to the preset expert agent module in the list of available expert agent modules, the monitor submodule in the enhanced filter module monitors the attack status and usage status of each preset expert agent module in real time, the authorizer submodule authorizes the team manager module and each preset expert agent module, the registrar submodule provides the service discovery registration interface of the custom expert agent module, and the anomaly detection and responder submodule detects and responds to the abnormal status of each preset expert agent module and the custom expert agent module in real time;

[0097] The scheduling command is received through the preset expert agent module, and the corresponding preset attack plan is executed based on the scheduling command.

[0098] The computer device provided in the embodiment of the present application has similar implementation principles and technical effects to those of the above-mentioned method embodiment, and will not be described in detail here.

[0099] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0100] Exploring the environmental information of the current network site through the hierarchical planner module, generating target instructions based on the environmental information of the current network site, and sending the target instructions to the team manager module;

[0101] Receive the target instruction through the team manager module, generate a dispatch command for each preset expert agent module based on the target instruction, and send the dispatch command to the enhanced filter module;

[0102] The enhanced filter module receives the scheduling command and sends it to the preset expert agent module in the list of available expert agent modules, the monitor submodule in the enhanced filter module monitors the attack status and usage status of each preset expert agent module in real time, the authorizer submodule authorizes the team manager module and each preset expert agent module, the registrar submodule provides the service discovery registration interface of the custom expert agent module, and the anomaly detection and responder submodule detects and responds to the abnormal status of each preset expert agent module and the custom expert agent module in real time;

[0103] The scheduling command is received through the preset expert agent module, and the corresponding preset attack plan is executed based on the scheduling command.

[0104] The computer-readable storage medium provided in this embodiment has similar implementation principles and technical effects to those of the above method embodiments, and will not be described in detail here.

[0105] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0106] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0107] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A hierarchical planning and specific task agent system, characterized in that: The system comprises a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert agent modules, wherein the enhanced filter module comprises a monitor submodule, an authorizer submodule, a register submodule and an anomaly detection and responder submodule; wherein the team manager module is respectively connected in communication with the hierarchical planner module and the enhanced filter module, the enhanced filter module is connected in communication with the group of preset expert agent modules, and each of the preset expert agent modules is connected in communication with each other; The hierarchical planner module is used to explore the environmental information of the current network site, generate target instructions based on the environmental information of the current network site, and send the target instructions to the team manager module; The team manager module is used to receive the target instruction, generate a dispatch command for each of the preset expert agent modules based on the target instruction, and send the dispatch command to the enhanced filter module; The enhanced filter module is used to receive the scheduling command and send it to the preset expert agent module in the list of available expert agent modules. The monitor submodule in the enhanced filter module is used to monitor the attack status and usage status of each preset expert agent module in real time. The authorizer submodule is used to authorize the team manager module and each preset expert agent module. The registrar submodule is used to provide a service discovery registration interface for the custom expert agent module. The anomaly detection and responder submodule is used to detect and respond to the abnormal status of each preset expert agent module and the custom expert agent module in real time. The preset expert agent module is used to receive the scheduling command and execute the corresponding preset attack plan based on the scheduling command.

2. The system according to claim 1, characterized in that If the attack status and usage status of each of the preset expert agent modules returned by the monitor sub-module, and any one of the authorization information returned by the authorizer sub-module meet the preset requirements, the enhanced filter module is also used to obtain the task termination instruction generated by the monitor sub-module and / or the authorizer sub-module, and terminate the corresponding task based on the task termination instruction.

3. The system according to claim 1 or 2, characterized in that: The set of preset expert proxy modules includes the current preset expert proxy module and other preset expert proxy modules; The current preset expert agent module is used to send the current operation data to the target preset expert agent module in the other preset expert agent modules when the module runs to the preset state; wherein the preset state includes any one of the operation completion state, the calculated target indicator value, and the abnormal operation state, and the target preset expert agent module includes at least one of the other preset expert agent modules that are logically adjacent to the current preset expert agent module and the other pre-specified preset expert agent modules; The target preset expert agent module is used to receive the current operation data and determine the target behavior based on the current operation data and preset task execution rules.

4. The system according to claim 1 or 2, characterized in that: The monitor submodule is also used for: Analyze the monitored attack status and usage status of each preset expert proxy module to determine the abnormal behavior of each preset expert proxy module; wherein the abnormal behavior includes any one of attack behavior, hijacking behavior and abuse behavior; When it is determined that the preset expert agent module has the abnormal behavior, the abnormal behavior is sent to the enhanced filter module so that the enhanced filter module determines a corresponding control strategy based on the abnormal behavior; wherein the control strategy includes any one of terminating the operation of the preset expert agent module, isolating the preset expert agent module, and reclaiming the resource usage rights of the preset expert agent module.

5. The system according to claim 1 or 2, characterized in that: The authorizer submodule is used to: Identify the necessary permission set and necessary resource set corresponding to each of the preset expert proxy modules; wherein the necessary permission set includes all permissions required by the preset expert proxy module during execution, and the necessary resource set includes all resources required by the preset expert proxy module during execution; When the current permission application and the current resource application of the preset expert proxy module are obtained, the current permission application and the current resource application are verified by the necessary permission set and the necessary resource set corresponding to the preset expert proxy module; After the verification is passed, the preset expert agent module is authorized.

6. The system according to claim 1 or 2, characterized in that: The anomaly detection and responder submodule is used to: Obtaining initialization normal behavior related data and current behavior related data of each of the preset expert agent modules and the custom expert agent modules; Comparing the initialized normal behavior related data with the current behavior related data, and obtaining the real-time detection results of the abnormal states of each of the preset expert agent modules and the custom expert agent modules according to the comparison results; When abnormal behavior is determined based on the real-time detection results of each of the preset expert agent modules and the custom expert agent module, the real-time detection results are sent to the enhanced filter module so that the enhanced filter module determines a corresponding control strategy based on the real-time detection results; wherein the abnormal behavior is used to characterize the inconsistency between the current behavior-related data and the initialized normal behavior-related data.

7. The system according to claim 1 or 2, characterized in that: The registrar submodule is also used to: Monitor the preset expert agent module list of the system in real time; When it is determined that a custom expert proxy module is added to the preset expert proxy module list, a verification process is performed on the custom expert proxy module to obtain a verification result; If the verification result is successful, the custom expert agent module is initialized to obtain an initialized custom expert agent module; wherein the initialization operation at least includes parsing the function description of the custom expert agent module, parsing the required calling tools, and parsing and verifying the permissions and resources; The initialized custom expert agent module is moved to an available expert agent module list, and a message corresponding to the available expert agent module list is sent to the team manager module and other preset expert agent modules.

8. A hierarchical planning and specific task agent method, characterized in that: The invention is applied to a hierarchical planning and specific task agent system, the system comprises a hierarchical planner module, a team manager module, an enhanced filter module and a group of preset expert agent modules, the enhanced filter module comprises a monitor submodule, an authorizer submodule, a register submodule, and an anomaly detection and responder submodule; wherein the team manager module is respectively connected to the hierarchical planner module and the enhanced filter module in communication, the enhanced filter module is connected to the group of preset expert agent modules in communication, and each of the preset expert agent modules is connected to each other in communication; the method comprises: exploring the environmental information of the current network site through the hierarchical planner module, generating a target instruction based on the environmental information of the current network site, and sending the target instruction to the team manager module; The target instruction is received by the team manager module, and a dispatching command for each of the preset expert agent modules is generated based on the target instruction, and the dispatching command is sent to the enhanced filter module; The scheduling command is received through the enhanced filter module and sent to the preset expert agent module in the list of available expert agent modules, the attack status and usage status of each preset expert agent module are monitored in real time through the monitor submodule in the enhanced filter module, the team manager module and each preset expert agent module are authorized through the authorizer submodule, the service discovery registration interface of the custom expert agent module is provided through the registrar submodule, and the abnormal status of each preset expert agent module and the custom expert agent module is detected and responded to in real time through the anomaly detection and responder submodule; The scheduling command is received through the preset expert agent module, and the corresponding preset attack plan is executed based on the scheduling command.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the hierarchical planning and specific task agent method as described in claim 8.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the hierarchical planning and specific task agent method as described in claim 8.

Images