A safe operation method and device based on multi-agent collaboration

Abstract

The present invention discloses a security operation method and device based on multi-agent collaboration, which relates to the field of network security technology. The method includes: data collection steps, data preprocessing steps, a step in which an attack detection agent obtains network security request information for a first judgment; a step in which a control decision agent uses a second deep learning network to make a comprehensive judgment based on the initial judgment result of the attack detection agent and the network security response information in the structured input data; and a step in which an emergency response agent obtains the first comprehensive judgment result from a message queue and performs a defensive behavior. The present invention utilizes the powerful data processing capability of a large model and the division of labor and cooperation advantages of multiple agents to enhance the real-time defense capability and collaborative effect of the system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security operation method and device based on multi-agent collaboration. Background Art

[0002] In the current network security field, traditional security operations mainly rely on technologies such as rule matching and feature recognition. These methods usually use static analysis methods to detect and respond to network attacks. Although this method can provide effective security protection in specific scenarios, it has the following significant defects:

[0003] (1) Slow response speed: Traditional methods rely heavily on manual processing and expert experience, resulting in slow response times when dealing with new and complex attacks, and inability to provide real-time defense.

[0004] (2) Low accuracy: Because traditional methods are based on fixed rules and feature matching, they have a low detection rate for variant attacks and unknown threats and are prone to false positives and false negatives.

[0005] (3) Lack of coordination mechanism: Traditional security tools work independently and lack effective coordination mechanisms, making it difficult to form a comprehensive defense, resulting in an incomplete overall defense system.

[0006] (4) High maintenance cost: The rule base and system architecture need to be constantly updated and maintained, resulting in high labor and time costs.

[0007] Therefore, there is an urgent need for an efficient, accurate and intelligent network security operation platform to enhance the system's real-time defense capabilities and synergy effects. Summary of the invention

[0008] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a security operation method and device based on multi-agent collaboration, which improves the system's real-time defense capability and collaborative effect based on the powerful data processing capabilities of large models and the division of labor and cooperation advantages of multiple agents.

[0009] One aspect of the present invention provides a security operation method based on multi-agent collaboration, including: a data acquisition module submits the acquired network environment data to a message queue; a data preprocessing agent monitors the message queue, obtains the network environment data from the message queue, extracts key information through a large model to form structured input data, and submits the structured input data to the message queue; an attack detection agent monitors the message queue, obtains the network security request information in the structured input data from the message queue, uses a first deep learning network to determine whether there is an attack behavior, submits the initial determination result to the message queue and stores it in an agent memory module; a control decision agent monitors the message queue, obtains the initial determination result of the attack detection agent and the network security response information in the structured input data from the message queue, uses a second deep learning network to comprehensively determine whether there is an attack behavior based on the initial determination result of the attack detection agent and the network security response information in the structured input data, submits the first comprehensive determination result to the message queue and stores it in the agent memory module; an emergency response agent monitors the message queue, obtains the first comprehensive determination result from the message queue, and performs a defensive behavior.

[0010] Furthermore, it also includes: the attack detection agent monitors the message queue, obtains the network security response information in the structured input data from the message queue, reads the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, uses the first deep learning network to re-judge whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submits the second judgment result to the message queue and stores it in the agent memory module.

[0011] Furthermore, it also includes: controlling the decision-making agent to listen to the message queue, obtaining the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtaining the annotation information of the network security event from the agent memory module, using the second deep learning network to comprehensively judge whether there is an attack behavior again according to the initial judgment result, the second judgment result and the annotation information of the network security event, submitting the second comprehensive judgment result to the message queue and storing it in the agent memory module.

[0012] Furthermore, it also includes: the emergency response agent monitors the message queue, obtains the second comprehensive judgment result from the message queue, and executes defense behavior.

[0013] Furthermore, it also includes: in response to a user's input operation instruction, obtaining annotation information of the network security event.

[0014] In another aspect of the present invention, a security operation device based on multi-agent collaboration is provided, including: a data acquisition module, which is used to submit the acquired network environment data to a message queue; a data preprocessing agent, which is used to monitor the message queue and obtain the network environment data from the message queue, extract key information through a large model to form structured input data, and submit the structured input data to the message queue; an attack detection agent, which is used to monitor the message queue, obtain the network security request information in the structured input data from the message queue, use a first deep learning network to determine whether there is an attack behavior, submit the initial determination result to the message queue and store it in the agent memory module; a control decision agent, which is used to monitor the message queue, obtain the initial determination result of the attack detection agent and the network security response information in the structured input data from the message queue, use a second deep learning network to comprehensively determine whether there is an attack behavior based on the initial determination result of the attack detection agent and the network security response information in the structured input data, submit the first comprehensive determination result to the message queue and store it in the agent memory module; an emergency response agent, which is used to monitor the message queue, obtain the first comprehensive determination result from the message queue, and perform defensive behavior.

[0015] Furthermore, the attack detection agent is also used to: monitor the message queue, obtain the network security response information in the structured input data from the message queue, read the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, use the first deep learning network to re-judge whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submit the second judgment result to the message queue and store it in the agent memory module.

[0016] Furthermore, the control decision agent is also used to: monitor the message queue, obtain the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtain the annotation information of the network security event from the agent memory module, use the second deep learning network to comprehensively judge whether there is an attack behavior based on the initial judgment result, the second judgment result and the annotation information of the network security event, submit the second comprehensive judgment result to the message queue and store it in the agent memory module.

[0017] Furthermore, the emergency response agent is also used to: monitor the message queue, obtain the second comprehensive determination result from the message queue, and execute defense behavior.

[0018] Furthermore, it also includes: a labeling information acquisition module, which is used to obtain the labeling information of the network security event in response to the user's input operation instruction, and store the labeling information in the intelligent body memory module.

[0019] The present invention provides a multi-agent collaborative security operation method and device, which has the following beneficial effects:

[0020] (1) Instant response: Based on real-time data processing and rapid response of large model intelligent agents, it can instantly detect and respond to complex and unknown attacks, thereby improving response speed.

[0021] (2) High-precision defense: Through the joint operations of multiple intelligent agents and dynamic strategy generation, the system's ability to accurately detect variant attacks and new threats is improved, and the false alarm and missed alarm rates are reduced.

[0022] (3) Collaborative defense: Intelligent agents work closely together to form a closed-loop security defense system to improve the overall defense effect.

[0023] (4) Intelligent maintenance: Automated learning and optimization mechanisms significantly reduce manual intervention and lower maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0025] Figure 1 It is a flowchart of a multi-agent collaborative security operation method provided by an embodiment of the present application;

[0026] Figure 2 It is a system logic diagram of a multi-agent collaborative security operation device provided by an embodiment of the present application;

[0027] Figure 3 It is a structural diagram of a multi-agent collaborative security operation device provided by an embodiment of the present application;

[0028] Figure 4 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0031] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0032] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0033] It should be noted that the directional words such as "upper", "lower", "left", and "right" described in the embodiments of the present invention are described at the angles shown in the drawings and should not be understood as limiting the embodiments of the present invention. In addition, in the context, it should also be understood that when it is mentioned that an element is formed "on" or "under" another element, it can not only be formed directly "on" or "under" another element, but also be formed "on" or "under" another element indirectly through an intermediate element.

[0034] In order to overcome the various defects of the network security operation platform in the background technology, the present invention improves the intelligence and automation level of network security operation by introducing a multi-agent collaboration mechanism. The multi-agent system is divided into multiple agents according to different behavioral logics and responsibilities, such as data collection agents, data preprocessing agents, attack detection agents, control decision agents, emergency response agents, etc. These agents work closely together through message queues and central control schedulers to achieve efficient division of labor and cooperation. Each agent uses a large model based on a deep neural network to achieve real-time data processing and identification of complex attack patterns.

[0035] An embodiment of the present application provides a security operation method based on multi-agent collaboration. The method works on a security operation platform in the form of software or a combination of software and hardware. The overall architecture of the security operation platform includes the following parts:

[0036] (1) Data layer: used for data collection and storage, including log data, traffic data, and event data;

[0037] (2) Preprocessing layer: The data preprocessing agent integrates pre-trained large models to analyze and process complex data and identify potential security threats;

[0038] (3) Agent layer: It includes a variety of agent modules with different functions, responsible for different security tasks;

[0039] (4) Collaboration layer: message queue and central control scheduler, responsible for coordinating task allocation and information sharing among agents;

[0040] (5) Policy layer: Generate and adjust security policies, dynamically update based on real-time data to respond to various security threats;

[0041] (6) Display layer: Provides visual monitoring panels and reports to help users quickly understand security status and risks.

[0042] The security operation platform of the present invention is applicable to multiple network security scenarios, for example:

[0043] (1) Intranet: Deploying the platform in the enterprise's internal network can monitor internal network traffic in real time, detect and prevent potential attacks, and ensure enterprise data security;

[0044] (2) Online services: Provide real-time protection for online services of Internet companies and defend against common Web application attacks such as DDoS attacks and SQL injections;

[0045] (3) Industrial control systems: When used in industrial control systems, it can monitor and defend against cyber attacks against SCADA systems in real time, thus ensuring industrial production safety.

[0046] (4) Government and public facilities: Used for security protection of government agencies and public infrastructure (such as energy and water conservancy) to prevent attacks on important systems and data.

[0047] See also Figure 1 The security operation method based on multi-agent collaboration provided in this embodiment includes the following steps:

[0048] Step S101: the data collection module submits the acquired network environment data to a message queue.

[0049] Specifically, the data collection module senses and collects real-time network environment data, such as log data, traffic data, and event data, and sends the collected data to the data collection channel in the message queue. Among them, the message queue is a protocol or interface used for communication between various components or modules in the system. Each module of the system, such as the data collection module and each intelligent agent (an intelligent agent refers to an agent that can perceive the environment and take actions to achieve specific goals. It can be software, hardware, or a system with autonomy, adaptability, and interaction capabilities, and is implemented through a deep learning network or a large model) can pass the message data collected or generated by itself to the message queue. Other modules monitor the data channels they are concerned about in the message queue in real time, obtain relevant message data, and process them in a timely manner.

[0050] Step S102, the data preprocessing agent monitors the message queue, obtains network environment data from the message queue, extracts key information to form structured input data, and submits the structured input data to the message queue.

[0051] Specifically, the data preprocessing agent is implemented based on a large model, which monitors the message queue in real time and obtains network environment data in any format from the message queue. For example, different security devices may generate many different forms of log alarms for a SQL injection payload xxx sent from device A to device B, including but not limited to different orders, different field names, and different expressions:

[0052] Src: A Dst: B payload: xxx

[0053] 2024-11-04 attacker: A target B message: xxx

[0054] payload: xxx Src: A Dst: B

[0055] The task of the data preprocessing agent is to extract key information from the log data in the above-mentioned various expressions, such as source address A, destination address B, attack payload: xxx.

[0056] Compared with traditional data preprocessing methods, there is no need to write a parser, feature extractor, or specific regular expression for each type of data to identify the feature content. Feature processing and pattern recognition can be performed to extract key information to form structured input data, thereby reducing the workload of manual entry and data analysis. The input data is provided to intelligent agents in need through message queues.

[0057] Step S103, the attack detection agent monitors the message queue, obtains the network security request information in the structured input data from the message queue, uses the first deep learning network to determine whether there is an attack behavior, submits the initial determination result to the message queue and stores it in the agent memory module.

[0058] Specifically, the input data includes the request information of the network security event, such as the attack request data GET / id=1'select count (1) from user HTTP / 1.1. The request information is submitted to the message queue in the form of message data, and the attack detection agent monitors the processable message data in the message queue in real time. When the attack detection agent obtains the network security request information in the message queue, the attack detection agent determines whether the request information contains attack behavior through its own deep learning network (such as a large model based on deep learning). For example, it determines that the payload "select count (1) fromuser" accessing system A is a sql injection attack payload, submits the initial determination result to the event channel of the message queue, and stores it in the agent memory module.

[0059] Step S104, control the decision-making agent to listen to the message queue, obtain the initial judgment result of the attack detection agent and the network security response information in the structured input data from the message queue, use the second deep learning network to comprehensively judge whether there is an attack behavior based on the initial judgment result of the attack detection agent and the network security response information in the structured input data, submit the first comprehensive judgment result to the message queue and store it in the agent memory module.

[0060] Specifically, the control decision agent is equivalent to the decision maker and manager among multiple agents, and is used to make a comprehensive judgment on the judgment results of the attack detection agent again, and send the security policy to the execution agency. When the control decision agent listens to the initial judgment results of the attack detection agent in the message queue, it uses its own deep learning network (such as a large model based on deep learning) to make a comprehensive judgment on the initial judgment results and the network security response information in the structured input data again, and submits the comprehensive judgment results to the message queue and stores them in the agent memory module. In other words, the attack detection agent judges the request information of the security event based on its own knowledge, while the control decision agent makes a comprehensive judgment based on the judgment results of the attack detection agent and the response information of the security event. Since the comprehensive judgment process incorporates the response information and the judgment results of other agents, the comprehensive judgment result is more accurate than the judgment result of the attack detection agent.

[0061] It should be noted that network security response information refers to the device's response information to network security requests. For example, the response information to the attack request GET / id=1' select count (1) from user HTTP / 1.1 includes:

[0062] (1) Response to a successful attack ......

[0063] HTTP / 1.0 200 OK

[0064] Server: SimpleHTTP / 0.6 Python / 3.10.12

[0065] Date: Tue, 19 Nov 2024 11:21:46 GMT

[0066] Content-type: text / html; charset=utf-8

[0067] Content-Length: 1809 ......

[0068] (2) Response to execution failure ......

[0069] HTTP / 1.1 400 Bad Request

[0070] Date: Tue, 26 Nov 2024 16:30:00 GMT

[0071] Server: Apache / 2.4.41 (Ubuntu)

[0072] Content-Type: text / html; charset=UTF-8

[0073] Content-Length: 137 ......

[0074] Step S105, the emergency response agent monitors the message queue, obtains the first comprehensive determination result from the message queue, and executes defense behavior.

[0075] Specifically, the emergency response agent is the implementation agency of the security strategy. It monitors the message queue, obtains the comprehensive judgment result of the control decision agent from the message queue, and executes the security strategy according to the comprehensive judgment result, such as adjusting the defense measures of the attack in real time.

[0076] Furthermore, the security operation method based on multi-agent collaboration of this embodiment also includes the following collaboration mechanisms of the agents, the introduction of historical memory and human intervention factors, thereby greatly improving the recognition accuracy of security incidents.

[0077] Step S106, the attack detection agent monitors the message queue, obtains the network security response information in the structured input data from the message queue, reads the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, uses the first deep learning network to determine again whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submits the second judgment result to the message queue and stores it in the agent memory module.

[0078] Specifically, the attack detection agent monitors the message queue in real time. When it monitors the network security response information in the structured input data, it reads the preliminary judgment result previously made by the attack detection agent from the agent memory module (that is, the historical judgment result made solely based on the request information), and reads the comprehensive judgment result previously made by the control decision agent. The attack detection agent uses its own deep learning network (for example, a large model based on deep learning) to determine again whether there is an attack behavior based on the monitored network security response information, the preliminary judgment result of historical memory, and the comprehensive judgment result of historical memory, and submits the second judgment result to the message queue and stores it in the agent memory module.

[0079] According to the above content, the initial judgment result of the attack detection agent is made based on the network security request information, while the second judgment result is made based on the network security response information, the preliminary judgment result of the historical memory, and the comprehensive judgment result of the historical memory. Therefore, the second judgment result is theoretically more accurate than the initial judgment result. In addition, storing the second judgment result in the agent memory module for subsequent reference by other agents will greatly enhance the synergy between agents.

[0080] Step S107, control the decision-making agent to listen to the message queue, obtain the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtain the annotation information of the network security event from the agent memory module, use the second deep learning network to comprehensively judge whether there is an attack behavior again according to the initial judgment result, the second judgment result and the annotation information of the network security event, submit the second comprehensive judgment result to the message queue and store it in the agent memory module.

[0081] Specifically, the control decision agent monitors the message queue in real time. When the initial judgment result and the second judgment result of the attack detection agent are monitored, in order to more accurately determine whether there is an attack behavior, the annotation information of the network security event is obtained from the agent memory module. The annotation information can be fed back to the security operation platform regularly or irregularly by manual means and recorded in the agent memory module. For example, in response to the user's check operation on the option in the operation interface or operation window, the annotation information of the network security event is obtained. The control decision agent uses its own deep learning network to comprehensively determine whether there is an attack behavior again based on the initial judgment result, the second judgment result and the annotation information of the network security event, and submits the second comprehensive judgment result to the message queue and stores it in the agent memory module. Due to the introduction of human feedback and the two judgment results of the attack detection agent, a more accurate conclusion on whether the security event is an attack behavior can be obtained.

[0082] Step S108, the emergency response agent monitors the message queue, obtains the second comprehensive determination result from the message queue, and executes defense behavior.

[0083] In summary, the multi-agent collaborative security operation method of this embodiment continuously improves the accuracy of its judgment with the collaboration between multiple agents. When subsequent payloads representing similar attacks are sent to the same system or device, they are more likely to be judged as similar results.

[0084] The technical concept of the present invention can be better understood through several specific examples below.

[0085] Example 1:

[0086] Step 1: The attack detection agent determines that a certain payload accessing system A is a SQL injection attack payload;

[0087] Step 2: The control decision agent obtains the judgment result of the attack detection agent in the message queue, combines the response detection result of the security event request with various information such as the annotation of system A in the human feedback, and comprehensively judges whether this event is a non-attack (i.e., a false alarm);

[0088] Step 3: The attack detection agent determines that the payload accessing system B is a SQL injection attack payload;

[0089] Step 4: The control decision agent obtains the judgment result of the attack detection agent in the message queue, combines the response detection result of the security event request with the annotation of system B in the human feedback and other information, and comprehensively determines that this event is an attack;

[0090] Step 5: When subsequent payloads with similar attack characteristics are sent to system A, they are more likely to be automatically judged as non-attacks.

[0091] The above process will continuously enhance the accuracy of its judgment with the collaboration between multiple intelligent agents.

[0092] Example 2:

[0093] Step 1: The data collection module collects real-time data and sends it to the collector channel in the message queue. The message data of the collector channel is recorded as message A.

[0094] Step 2: Data preprocessing agent monitors the collector channel in real time, extracts key information from messageA and sends it to the event channel of the message queue. The message data of the event channel is recorded as messageB.

[0095] Step 3: The attack detection agent monitors the event channel in real time, uses its own knowledge, analysis tool results, and historical memory to analyze messageB, determines that messageB is an attack, and sends it to the result channel of the message queue. The message data of the result channel is recorded as messageC.

[0096] Step 4: The control decision agent monitors the result channel in real time, uses its own knowledge, analysis tool results, and historical memory to analyze message C, and makes a judgment based on the response information, and records the judgment result in the agent memory module. If the judgment result is an attack, it will be handed over to the emergency response agent for subsequent processing.

[0097] Step 5: The attack detection agent monitors the event channel in real time. After reading the response information of messageB, it reads the historical memory of the agent memory module, combines the historical judgment results of messageB by the attack detection agent and the historical judgment results of the control decision agent, and makes another comprehensive judgment, and sends the result to the result channel of the message queue;

[0098] Step 6: The control decision agent monitors the result channel. After obtaining the two judgment results of the attack detection agent on messageB and messageB's response, it makes another comprehensive judgment based on the annotation information fed back by humans. If the security event is judged to be an attack, it sends a message to the action channel of the message queue, and the emergency response agent implements the defense against the attack behavior.

[0099] See also Figure 2 , 3Another embodiment of the present invention further provides a multi-agent collaboration-based security operation device 200, comprising a data acquisition module 201, a data preprocessing agent 202, an attack detection agent 203, a control decision agent 204, and an emergency response agent 205. The security operation device 200 can execute the multi-agent collaboration-based security operation method in the method embodiment.

[0100] Specifically, the multi-agent collaborative security operation device 200 includes:

[0101] The data collection module 201 is used to submit the acquired network environment data to the message queue;

[0102] The data preprocessing agent 202 is used to monitor the message queue, obtain network environment data from the message queue, extract key information through the large model to form structured input data, and submit the structured input data to the message queue;

[0103] The attack detection agent 203 is used to monitor the message queue, obtain the network security request information in the structured input data from the message queue, use the first deep learning network to determine whether there is an attack behavior, submit the initial determination result to the message queue and store it in the agent memory module;

[0104] The control decision agent 204 is used to monitor the message queue, obtain the initial determination result of the attack detection agent and the network security response information in the structured input data from the message queue, use the second deep learning network to comprehensively determine whether there is an attack behavior based on the initial determination result of the attack detection agent and the network security response information in the structured input data, submit the first comprehensive determination result to the message queue and store it in the agent memory module;

[0105] The emergency response agent 205 is used to monitor the message queue, obtain the first comprehensive determination result from the message queue, and execute defense behavior.

[0106] Furthermore, the attack detection agent 203 is also used to: monitor the message queue, obtain the network security response information in the structured input data from the message queue, read the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, use the first deep learning network to re-judge whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submit the second judgment result to the message queue and store it in the agent memory module.

[0107] Furthermore, the control decision agent 204 is also used to: monitor the message queue, obtain the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtain the annotation information of the network security event from the agent memory module, use the second deep learning network to comprehensively judge whether there is an attack behavior based on the initial judgment result, the second judgment result and the annotation information of the network security event, submit the second comprehensive judgment result to the message queue and store it in the agent memory module.

[0108] Furthermore, the emergency response agent 205 is also used to: monitor the message queue, obtain the second comprehensive determination result from the message queue, and execute defense behavior.

[0109] Furthermore, it also includes: an annotation information acquisition module, which is used to obtain the annotation information of the network security event in response to the user's input operation instruction, and store the annotation information in the intelligent body memory module.

[0110] It should be noted that the security operation device 200 based on multi-agent collaboration provided in this embodiment corresponds to a technical solution that can be used to execute each method embodiment. Its implementation principle and technical effect are similar to the method and will not be repeated here.

[0111] See also Figure 4 Another embodiment of the present invention provides a schematic diagram of the structure of an electronic device 300, which is used to implement the multi-agent collaborative security operation method in the method embodiment. The electronic device 300 in the embodiment of the present invention may include but is not limited to a PC and a server. Figure 4 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0112] like Figure 4 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303 to implement the method of the embodiment of the present invention. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0113] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 4 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0114] The above description is only a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A security operation method based on multi-agent collaboration, characterized in that: include: The data collection module submits the acquired network environment data to the message queue; The data preprocessing agent monitors the message queue, obtains network environment data from the message queue, extracts key information through the large model to form structured input data, and submits the structured input data to the message queue; The attack detection agent monitors the message queue, obtains the network security request information in the structured input data from the message queue, determines whether there is an attack behavior using the first deep learning network, submits the initial determination result to the message queue and stores it in the agent memory module; The control decision agent monitors the message queue, obtains the initial determination result of the attack detection agent and the network security response information in the structured input data from the message queue, uses the second deep learning network to comprehensively determine whether there is an attack behavior according to the initial determination result of the attack detection agent and the network security response information in the structured input data, submits the first comprehensive determination result to the message queue and stores it in the agent memory module; The emergency response agent monitors the message queue, obtains the first comprehensive determination result from the message queue, and executes defense behavior.

2. A security operation method based on multi-agent collaboration according to claim 1, characterized in that: Also includes: The attack detection agent monitors the message queue, obtains the network security response information in the structured input data from the message queue, reads the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, uses the first deep learning network to determine again whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submits the second judgment result to the message queue and stores it in the agent memory module.

3. A multi-agent collaborative security operation method according to claim 2, characterized in that: Also includes: The control decision agent monitors the message queue, obtains the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtains the annotation information of the network security event from the agent memory module, uses the second deep learning network to comprehensively judge whether there is an attack behavior again according to the initial judgment result, the second judgment result and the annotation information of the network security event, submits the second comprehensive judgment result to the message queue and stores it in the agent memory module.

4. A security operation method based on multi-agent collaboration according to claim 3, characterized in that: Also includes: The emergency response agent monitors the message queue, obtains the second comprehensive determination result from the message queue, and executes defense behavior.

5. A multi-agent collaborative security operation method according to claim 3, characterized in that: Also includes: In response to an input operation instruction from a user, annotation information of the network security event is obtained.

6. A security operation device based on multi-agent collaboration, characterized in that: include: A data collection module is used to submit the acquired network environment data to a message queue; A data preprocessing agent is used to monitor the message queue, obtain network environment data from the message queue, extract key information through a large model to form structured input data, and submit the structured input data to the message queue; An attack detection agent, configured to monitor a message queue, obtain network security request information in the structured input data from the message queue, determine whether an attack behavior exists using a first deep learning network, submit an initial determination result to the message queue, and store it in an agent memory module; A control decision agent is used to monitor the message queue, obtain the initial determination result of the attack detection agent and the network security response information in the structured input data from the message queue, use the second deep learning network to comprehensively determine whether there is an attack behavior based on the initial determination result of the attack detection agent and the network security response information in the structured input data, submit the first comprehensive determination result to the message queue and store it in the agent memory module; The emergency response agent is used to monitor the message queue, obtain the first comprehensive judgment result from the message queue, and execute defense behavior.

7. A multi-agent collaborative security operation device according to claim 6, characterized in that: The attack detection agent is also used to: monitor the message queue, obtain the network security response information in the structured input data from the message queue, read the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent from the agent memory module, use the first deep learning network to re-judge whether there is an attack behavior based on the network security response information, the preliminary judgment result of the attack detection agent and the first comprehensive judgment result of the control decision agent, and submit the second judgment result to the message queue and store it in the agent memory module.

8. A multi-agent collaborative security operation device according to claim 7, characterized in that: The control decision agent is also used to: monitor the message queue, obtain the initial judgment result and the second judgment result of the attack detection agent from the message queue, obtain the annotation information of the network security event from the agent memory module, use the second deep learning network to comprehensively judge whether there is an attack behavior based on the initial judgment result, the second judgment result and the annotation information of the network security event, submit the second comprehensive judgment result to the message queue and store it in the agent memory module.

9. A multi-agent collaborative security operation device according to claim 8, characterized in that: The emergency response agent is also used to: monitor the message queue, obtain the second comprehensive determination result from the message queue, and execute defense behavior.

10. A multi-agent collaborative security operation device according to claim 8, characterized in that: Also includes: The annotation information acquisition module is used to obtain the annotation information of the network security event in response to the user's input operation instruction, and store the annotation information in the intelligent body memory module.

Images