Data analysis and conclusion generation method and device based on multi-agent proxy interaction

Abstract

The invention discloses a data analysis and conclusion generation method and device based on multi-agent proxy interaction. The method comprises the following steps: constructing a multi-node distributed federated learning architecture; each node extracts communication protocol data; performing data feature extraction and dimension reduction on the communication protocol data to obtain low-dimensional network communication protocol features; generating local training data, then respectively inputting the local training data into local models of corresponding nodes for training, and uploading trained model parameters to a global model of a central server so as to generate a generative model based on a Transform network; and aggregating and updating the parameters by adopting an ecological balance optimization algorithm, and then issuing the updated parameters to each node to start a new round of iterative training until a preset iterative requirement is met. According to the method, the problem of data resource islands is solved, and more effective data can be aggregated and obtained; the data is used locally, and the model is trained locally, so that the data security is effectively ensured.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a data analysis and conclusion generation method and device based on multi-agent interaction. Background Art

[0002] Traditional centralized training models have significant limitations when dealing with large-scale distributed data. These limitations include, but are not limited to, data silos, where data is scattered across different geographic locations and organizations, making it difficult to integrate and utilize effectively; data privacy and security issues, because centralized training requires data to be stored and processed centrally, which increases the risk of data leakage; and inefficient high-dimensional data processing, because traditional algorithms often require a lot of computing resources and time when processing high-dimensional data. In addition, with the rapid development of network communication technology, the complexity and diversity of network communication protocol data continues to increase, placing higher demands on data analysis and conclusion generation. Existing data analysis methods often lack sufficient flexibility and accuracy when dealing with such data, making it difficult to effectively identify and analyze risks and abnormal patterns in network communication protocols.

[0003] Therefore, the prior art has the following deficiencies:

[0004] (1) The centralized training model often results in data resources being dispersed across different nodes, making it difficult to achieve effective data aggregation and utilization;

[0005] (2) In the traditional training mode, data needs to be transmitted between different nodes, which poses the risk of data leakage and abuse;

[0006] (3) High-dimensional data can easily lead to a waste of computing resources during training, reducing the speed and efficiency of model training;

[0007] (4) When processing complex data, the models often lack sufficient generalization capabilities, making it difficult to accurately identify and analyze potential risks in network communication protocols.

[0008] In view of this, it is necessary to provide a data analysis and conclusion generation method and device based on multi-agent interaction to overcome the above-mentioned defects. Summary of the invention

[0009] The purpose of the present invention is to provide a data analysis and conclusion generation method and device based on multi-agent interaction, aiming to solve the above-mentioned technical problems.

[0010] In order to achieve the above-mentioned object, the first aspect of the present invention provides a data analysis and conclusion generation method based on multi-agent agent interaction, comprising:

[0011] Step S10: construct a multi-node distributed federated learning architecture; wherein each node of the federated learning acts as an intelligent agent, and each node performs a separate local model training based on the input training data;

[0012] Step S20: Each node captures data packets in the real-time network flow through a preset network monitoring tool, extracts communication protocol data therefrom, and then stores the communication protocol data in a structured data format;

[0013] Step S30: extracting features and reducing dimensions of the communication protocol data in a structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm;

[0014] Step S40: merging the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then inputting the local training data into the local models of the corresponding nodes for training, and uploading the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network;

[0015] Step S50: The central server aggregates and updates the parameters of the generative model using an ecological balance optimization algorithm, and then sends the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met;

[0016] Step S60: After receiving the network protocol data, the trained generative model outputs a conclusion including a risk assessment accordingly.

[0017] In a preferred embodiment, in step S40, during the model training process of the distributed federated learning architecture, the federated average algorithm is used as the model aggregation algorithm to achieve collaborative training of local models through multiple global iterations; specifically, for each global iteration, the number of nodes is defined as N leb , the total number of samples is D leb , and the number of samples of the kth node is Then the objective function of federated learning is defined as:

[0018]

[0019] In the formula, f leb () is the objective function of federated learning, ω leb are model parameters, is the model parameter ω leb The loss prediction for the jth sample data, L tra() is the training loss, is the sample feature of the jth sample data, The label of the jth sample data;

[0020] For the kth node, the objective function of the node is defined as:

[0021] In the formula, is the number of samples of the kth node, is the objective function of the kth node, is the data distribution of the kth node;

[0022] At the tth iteration, the parameter gradient of the kth node is defined as Then the way the local model updates parameters at the tth iteration is expressed as:

[0023] In the formula, is the model parameter of the tth iteration, is the model parameter of the t+1th iteration, R nod is the learning rate for the current parameter update, is the number of samples of the kth node;

[0024] Among them, the parameter update method of the global model of the central server is expressed as:

[0025] In the formula, are the parameters of the global model of the central server at the t+1th iteration.

[0026] In a preferred embodiment, the feature extraction and dimensionality reduction model uses a 6-layer fully connected layer neural network for feature extraction and dimensionality reduction processing. The structure of the fully connected layer neural network includes:

[0027] a Input layer: used to receive and transmit sample data after sample expansion;

[0028] b Hidden layer: It contains four hidden layers, each layer consists of a predetermined number of neurons;

[0029] b1 The first hidden layer: has 128 neurons and is used for preliminary feature extraction;

[0030] b2 The second hidden layer: has 256 neurons, which is used to further abstract features;

[0031] b3 The third hidden layer: has 512 neurons, which is used to further deepen feature extraction;

[0032] b4: the fourth hidden layer has 1024 neurons and is used to further deepen feature extraction;

[0033] b5 output layer: has 512 neurons and is used to output low-dimensional network communication protocol features.

[0034] In a preferred embodiment, the step S30 includes:

[0035] Step S31: Initialize the parameters of the neural network, including the weight and bias parameters of the neural network; wherein the initialization method is expressed as:

[0036]

[0037] Where W p，i is the weight matrix of the i-th layer of the neural network; b p，i is the bias vector of the i-th layer of the neural network; σ p is the scaling factor of the neural network weights, β p is the scaling factor of the bias of the neural network; represents a normal distribution with a mean of 0 and a standard deviation of 1; ∈ p is a preset tiny noise vector;

[0038] Step S32: The input communication protocol data passes through each layer of the neural network, and each fully connected layer is subjected to linear transformation and nonlinear activation function processing, and finally the feature representation of the output layer is obtained; wherein the output calculation method of each fully connected layer is:

[0039] a p,i =Rez(W p，i ·a p,i-1 +b p，i ), where a p,i represents the activation output of the i-th layer of the neural network; a p,i-1 is the output of the i-1th layer of the neural network; Rez() is the adaptive ReLU activation function;

[0040] Step S33: adopting an exploratory gradient descent update strategy, predicting possible gradient changes before each update of the neural network parameters, and adjusting the step size and direction of the gradient update according to the prediction results, optimizing the parameter adjustment during the training process to avoid falling into the local optimum too early; wherein, the calculation method is expressed as:

[0041]

[0042] In the formula, ΔW p，i and Δb p，i are the update amounts of the i-th layer weight and i-th layer bias of the neural network respectively; η p is the learning rate of the neural network; is the loss function with respect to parameter W p，iThe gradient of is the loss function with respect to parameter b p，i The gradient of is the loss function of the neural network; α p is the exploration intensity coefficient; is the prediction function of the gradient;

[0043] Step S34: Repeat the iteration steps S31-S33 until the preset stop iteration condition is met, indicating that the feature extraction and dimensionality reduction model training is completed.

[0044] In a preferred embodiment, in step S32, the adaptive ReLU activation function is expressed as:

[0045] Rez(x zsy )=γ p max(0,x zsy )+ξ p min(0,x zsy ),

[0046] In the formula, x zsy is the input of the adaptive ReLU activation function, γ p and p are the adaptive coefficients of the positive and negative parts respectively, max() is the maximum value function, and min() is the minimum value function.

[0047] In a preferred embodiment, in step S33, linear regression prediction is performed using historical gradient data based on an exploratory gradient prediction function; wherein the calculation method of the exploratory prediction function is expressed as:

[0048]

[0049] In the formula, Represents the loss function at the t-1th iteration with respect to the parameter W p，i The gradient of t is the attenuation factor; α p is the exploration intensity coefficient; Tgz is the total number of iterations.

[0050] In a preferred embodiment, in step S50, the training process of the Transformer network based on the ecological balance optimization algorithm includes the following:

[0051] Step S51: Initialize the ecosystem and generate an initial population, where each individual represents a potential solution, i.e., a set of parameters of the Transformer network; the initialization method is expressed as:

[0052] Where W p，irepresents the weight of the i-th neuron in the Transformer network, represents the initial weight of the i-th neuron in the Transformer network, b p，i represents the bias of the i-th neuron in the Transformer network, Represents the initial bias of the i-th neuron in the Transformer network; The mean is 0 and the variance is σ 2 Normal distribution of

[0053] Step S52: Evaluate the fitness of each individual according to a preset fitness function to determine its survival ability in the ecosystem; wherein the fitness function is calculated as:

[0054]

[0055] In the formula, f p (i) is the fitness value of the i-th individual, f p () is the fitness function, L p (i) is the loss function value of the i-th individual, L p () is the loss function of the Transformer network, ∈ is a small constant added to prevent the denominator from being zero; E p (i, j) is the energy conversion factor between the i-th species and the j-th species; N is the total number of samples, y n is the true label of the nth sample, is the predicted label of the nth sample; w p,n is the weight of the nth sample;

[0056] Step S53: Allocate resources according to the fitness of individuals so that individuals with more resources have higher reproduction rates and lower extinction rates; wherein resource allocation is calculated based on fitness, expressed as:

[0057]

[0058] In the formula, R p (i) is the amount of resources allocated to the i-th individual, M is the total population, R total is the total allocatable resource, f p (j) is the fitness value of the jth individual;

[0059] Step S54: Simulate niche competition to make species compete for resources. Species that are not strong enough to support themselves may become extinct. At the same time, weaker species can choose to cooperate with other species to form a symbiotic relationship and share resources. The competition and cooperation between species are represented by the symbiotic coefficient, which is calculated as follows:

[0060]

[0061] In the formula, S p (i, j) represents the symbiotic coefficient between the i-th species and the j-th species, α is a hyperparameter for adjusting the strength of the symbiotic relationship, δ is a hyperparameter for adjusting the width of the symbiotic relationship; λ is a hyperparameter for adjusting the label effect, which indicates the influence of introducing predicted similarity in the similarity assessment between species. is the predicted label of the nth sample corresponding to the i-th species, is the predicted label of the nth sample corresponding to the jth species;

[0062] Step S55: Generate new individuals by simulating biological evolution mechanisms including genetic variation and recombination, so that the new individuals may have higher fitness; wherein, species evolution updates the weights and biases of the Transformer network through variation and recombination simulation in the genetic algorithm, and the update method is expressed as:

[0063]

[0064] Where W′ p，i represents the weight of the i-th neuron in the updated Transformer network, b′ p，i represents the bias of the i-th neuron in the updated Transformer network; Γ p (i) is the variation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness. η is the variation rate. A higher amount of resources leads to a smaller variation rate. represents normal distribution;

[0065] Step S56: adjusting the mutation rate according to the change of the average fitness; wherein the adjustment method is expressed as:

[0066]

[0067] Where η new is the adjusted mutation rate, β is the feedback adjustment coefficient, is the average fitness of the current population;

[0068] Step S57: Repeat the iteration steps S51-S56 until the preset stop iteration condition is met, which means that the generative model training is completed.

[0069] In a preferred embodiment, in step S52, the energy conversion factor E p (i, j) dynamically adjusts the resource sharing and competition strategies among species based on environmental pressure, and its calculation method is expressed as:

[0070]

[0071] In the formula, ΔL p (i) and ΔL p (j) are the change rates of the loss functions of the ith species and the ith species, respectively; ζ is the first hyperparameter of the conversion factor to control the conversion intensity; σ E is the conversion factor second hyperparameter to control the sensitivity of the response;

[0072] The calculation method of the weight of the nth sample is expressed as:

[0073]

[0074] In the formula, x p，n is the feature vector of the nth sample, μ p is the mean of the feature vectors of all samples in the current population, σ gf is a hyperparameter that controls the divergence of the weight distribution, / / / / is the L2 norm.

[0075] In a preferred embodiment, in step S55, the calculation method of the variation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness is expressed as:

[0076]

[0077] Where γ is a hyperparameter that adjusts the steepness of the curve.

[0078] A second aspect of the present invention provides a data analysis and conclusion generation device based on multi-agent agent interaction, comprising:

[0079] The federated learning building module is used to build a multi-node distributed federated learning architecture. Each node in the federated learning serves as an intelligent agent, and each node performs separate local model training based on the input training data.

[0080] A data capture and conversion module is used to capture data packets in a real-time network flow at each node through a preset network monitoring tool, extract communication protocol data therefrom, and then store the communication protocol data in a structured data format;

[0081] A low-dimensional feature extraction module is used to extract features and reduce the dimension of the communication protocol data in a structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm;

[0082] A model collaborative training module is used to merge the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then input the local training data into the local models of the corresponding nodes for training, and upload the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network;

[0083] A model aggregation and update module, which is used for the central server to aggregate and update the parameters of the generative model using an ecological equilibrium optimization algorithm, and then send the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met;

[0084] The risk conclusion generation module is used to enable the trained generative model to output a conclusion including a risk assessment accordingly after receiving network protocol data.

[0085] The third aspect of the present invention provides a terminal, which includes a memory, a processor, and a computer program stored in the memory. When the computer program is executed by the processor, it implements the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any one of the above embodiments.

[0086] A fourth aspect of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any one of the above embodiments.

[0087] A fifth aspect of the present invention provides a computer program product, including a computer program or instructions, which, when processed and executed, implement the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any one of the above-mentioned embodiments.

[0088] The data analysis and conclusion generation method and device based on multi-agent agent interaction provided by the present invention have the following beneficial effects:

[0089] (1) In the federated learning framework, each node does not need to share the data of its local training model. Instead, it trains the local model and sends the updated model to the centralized learning unit (global model) for aggregation, breaking the data resource island problem of the traditional centralized training model and aggregating more effective data.

[0090] (2) The distributed federated learning architecture can prevent the leakage of local data on each node. Data is used locally and models are trained locally, effectively ensuring data security.

[0091] (3) By reducing the dimension of the data of each node, the fitting speed of the model in the training process is improved;

[0092] (4) The neural network based on exploratory gradient descent is used as a feature extraction and dimensionality reduction model. It not only considers the current gradient information, but also adopts a forward exploration mechanism to predict the possible change trend of the gradient before the gradient is updated, and adjusts the learning step size and direction to achieve faster convergence speed and better local minimum, thereby enhancing the generalization ability of the feature;

[0093] (5) The ecological equilibrium optimization algorithm is used to optimize the parameters of the Transformer network, thereby finding the optimal balance between global search and local development, so that the algorithm can dynamically adjust the search strategy according to environmental changes during the optimization process. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0095] Figure 1 A flow chart of the data analysis and conclusion generation method based on multi-agent agent interaction provided by the present invention;

[0096] Figure 2 Diagram of the training architecture for the agent;

[0097] Figure 3 This is the training flow chart of the feature extraction and dimensionality reduction model;

[0098] Figure 4 A framework diagram of the data analysis and conclusion generation device based on multi-agent interaction provided by the present invention. DETAILED DESCRIPTION

[0099] In order to make the purpose, technical solution and beneficial technical effect of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the specific implementation methods described in this specification are only for explaining the present invention, not for limiting the present invention.

[0100] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0101] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0102] Embodiment 1

[0103] In an embodiment of the present invention, a data analysis and conclusion generation method based on multi-agent agent interaction is provided to accurately identify and analyze potential risks in network communication protocols, and to provide a generative model with high generalization ability and no risk of data leakage and abuse of training data.

[0104] like Figure 1-Figure 3 As shown, the data analysis and conclusion generation method based on multi-agent interaction includes steps S10-S60.

[0105] Step S10: Construct a multi-node distributed federated learning architecture; wherein each node of the federated learning acts as an intelligent agent, and each node performs a separate local model training based on the input training data.

[0106] Among them, the distributed federated learning architecture can realize distributed model training and data mining of multi-node joint models to break the data resource island problem of the traditional centralized training model and aggregate to obtain more effective data. At the same time, the distributed federated learning architecture can prevent the leakage of local data of each node. The data is used locally and the model is trained locally, which effectively ensures data security. In the federated learning framework, each node does not need to share the data of its local training model, but trains the local model and sends the updated model to the centralized learning unit (ie, the global model) for aggregation.

[0107] Step S20: Each node captures data packets in the real-time network flow through a preset network monitoring tool, extracts communication protocol data therefrom, and then stores the communication protocol data in a structured data format.

[0108] Among them, when conducting data analysis and conclusion generation for network communication protocols, data collection is achieved through specific network monitoring tools, which can capture data packets in real-time network flows and extract protocol information from them. The collected communication protocol data is stored in a structured data format, such as JSON (JavaScript Object Notation) format.

[0109] In an exemplary embodiment, the attributes of the data include: ax is the source IP address, indicating the network address of the sender of the data packet; ay is the destination IP address, indicating the network address of the receiver of the data packet; az is the transmission protocol, such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), etc.; aa is the source port number, associated with the sender's application; ab is the destination port number, associated with the receiver's application; ac is the data packet size, indicating the byte size of the data packet; ad is the timestamp, recording the sending time of the data packet; ae is the data payload, containing the actual data content of the transmission; af is the flag information, such as TCP flags such as SYN (Transmission Control Protocol) and ACK (Acknowledgement); ag is the encryption status, indicating whether the data packet is encrypted for transmission.

[0110] It should be emphasized that this embodiment is only an exemplary data format and type for illustrating the present invention. In actual applications, the attributes of data are usually more than 10 attributes, and the number of data attributes may reach dozens or even hundreds. Therefore, the above data attributes are not intended to be a specific limitation of the present invention.

[0111] Step S30: extracting features and reducing dimensions of the communication protocol data in a structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm.

[0112] It is understandable that if the dimension of the data of each node is too high, it may affect the fitting speed of the model training process. That is, the data of each node is not the more attributes the better, but the fewer attributes of the data the better while maximizing the role of data analysis and conclusion generation tasks.

[0113] In this embodiment, the feature extraction and dimensionality reduction model uses a 6-layer fully connected layer neural network for feature extraction and dimensionality reduction processing. The structure of the fully connected layer neural network includes:

[0114] a Input layer: used to receive and transmit sample data after sample expansion;

[0115] b Hidden layer: It contains four hidden layers (i.e., b1, b2, b3, and b4), each of which consists of a predetermined number of neurons;

[0116] b1 The first hidden layer: has 128 neurons and is used for preliminary feature extraction;

[0117] b2 The second hidden layer: has 256 neurons, which is used to further abstract features;

[0118] b3 The third hidden layer: has 512 neurons, which is used to further deepen feature extraction;

[0119] b4: the fourth hidden layer has 1024 neurons and is used to further deepen feature extraction;

[0120] b5 output layer: has 512 neurons and is used to output low-dimensional network communication protocol features.

[0121] It should be noted that when some solutions in the prior art use neural networks for feature extraction, in certain neural network structures, they may encounter problems such as gradient vanishing, gradient explosion, or falling into local optimal solutions, thereby affecting the stability of training and the performance of the model. The present invention uses a neural network based on exploratory gradient descent as a feature extraction and dimensionality reduction model. In the traditional neural network training process, the exploratory gradient descent method is used to not only consider the current gradient information, but also adopt a forward exploration mechanism to predict the possible change trend of the gradient before the gradient is updated, and adjust the learning step size and direction to achieve faster convergence speed and better local minimum, thereby enhancing the generalization ability of the feature.

[0122] Specifically, combined Figure 3 As shown, step S30 includes steps S31-S34.

[0123] Step S31: Initialize the parameters of the neural network, including the weight and bias parameters of the neural network; wherein the initialization method is expressed as:

[0124]

[0125] Where W p，i is the weight matrix of the i-th layer of the neural network; b p，i is the bias vector of the i-th layer of the neural network; σ p is the scaling factor of the neural network weights, β p is the scaling factor of the bias of the neural network; represents a normal distribution with a mean of 0 and a standard deviation of 1; is a preset small noise vector. In this embodiment, ∈ p is a noise vector whose elements are all 0.001.

[0126] Step S32: The input communication protocol data passes through each layer of the neural network, and each fully connected layer is subjected to linear transformation and nonlinear activation function processing, and finally the feature representation of the output layer is obtained; wherein the output calculation method of each fully connected layer is:

[0127] a p,i =Rez(Wp，i ·a p,i-1 +b p，i ), where a p,i represents the activation output of the i-th layer of the neural network; a p,i-1 is the output of the i-1th layer of the neural network; Rez() is the adaptive ReLU activation function;

[0128] Furthermore, the adaptive ReLU activation function is expressed as:

[0129] Rez(x zsy )=γ p max(0,x zsy )+ξ p min(0,x zsy ),

[0130] In the formula, x zsy is the input of the adaptive ReLU activation function, γ p and p are the adaptive coefficients of the positive part and the negative part respectively, max() is the maximum value function, and min() is the minimum value function. In this embodiment, γ p Set to 0.3, ξ p Set to 0.7.

[0131] Step S33: adopting an exploratory gradient descent update strategy, predicting possible gradient changes before each update of the neural network parameters, and adjusting the step size and direction of the gradient update according to the prediction results, optimizing the parameter adjustment during the training process to avoid falling into the local optimum too early; wherein the calculation method is expressed as:

[0132]

[0133] In the formula, ΔW p，i and Δb p，i are the update amounts of the i-th layer weight and i-th layer bias of the neural network respectively; η p is the learning rate of the neural network; is the loss function with respect to parameter W p，i The gradient of is the loss function with respect to parameter b p，i The gradient of is the loss function of the neural network; α p is the exploration intensity coefficient is the prediction function of the gradient. In this embodiment, η p Set to 0.03, Cross entropy loss is used.

[0134] Furthermore, linear regression prediction is performed based on the exploratory gradient prediction function using historical gradient data; wherein the calculation method of the exploratory prediction function is expressed as:

[0135]

[0136] In the formula, Represents the loss function at the t-1th iteration with respect to the parameter W p，i The gradient of t is the attenuation factor; α p is the exploration intensity coefficient; Tgz is the total number of iterations. In this embodiment, β t Set to 0.98, alpha p Set to 2.

[0137] Here, the present invention can use the error back propagation method to update the weight and bias parameters of the neural network.

[0138] Step S34: Repeat the iteration steps S31-S33 until the preset stop iteration condition is met, indicating that the feature extraction and dimensionality reduction model training is completed. For example, the preset stop iteration condition is reaching the preset maximum number of iterations. In this embodiment, the preset maximum number of iterations is set to 1000 times.

[0139] Step S40: Merge the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then input the local training data into the local models of the corresponding nodes for training, and upload the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network.

[0140] Specifically, the low-dimensional network communication protocol features after feature extraction are combined with the document data related to the network communication protocol as training data for the generative large model. The document data related to the network communication protocol can be standard documents, literature, webpage content and other knowledge related to the network communication protocol, and can also include related code data.

[0141] The generative large model is trained using the training data set constructed for the generative large model. The underlying algorithm of the generative large model is the Transformer network. The Transformer network is a deep learning model based on the self-attention mechanism, and its core structure includes encoder and decoder modules. Each encoder consists of a multi-head self-attention mechanism and a feedforward neural network, and the decoder adds a masked self-attention mechanism on this basis. The self-attention mechanism generates a weighted representation by calculating the correlation between each word in the input sequence and other words, thereby capturing global dependencies. The multi-head mechanism allows the model to focus on different feature subspaces, enhancing the representation ability. Through parallel processing and position encoding, the Transformer solves the long-distance dependency problem in traditional sequence models and accelerates the training process. The decoder uses the encoder output to generate the target sequence, and finally generates a probability distribution through the softmax layer and outputs the result. This structure makes the Transformer a basic architecture in natural language processing, and is widely used in tasks such as machine translation, text generation, and question-answering systems.

[0142] In the distributed federated learning model training architecture, each agent performs local model training in each round of selection and uploads the trained model parameters to the central server. The central server completes parameter aggregation and update, and sends the updated parameters to each node to start a new round of iteration until the training converges. Furthermore, in the model training process of the distributed federated learning architecture, the federated average algorithm is used as the model aggregation algorithm to achieve collaborative training of local models through multiple global selections.

[0143] Specifically, for each global iteration, the number of nodes is defined as N leb , the total number of samples is D leb , and the number of samples of the kth node is Then the objective function of federated learning is defined as:

[0144]

[0145] In the formula, f leb () is the objective function of federated learning, ω leb are model parameters, is the model parameter ω leb The loss prediction for the jth sample data, L tra () is the training loss, is the sample feature of the jth sample data, The label of the jth sample data. In this embodiment, the training loss L tra () is calculated using the cross entropy loss function.

[0146] For the kth node, the objective function of the node is defined as:

[0147] In the formula, is the number of samples of the kth node, is the objective function of the kth node, is the data distribution of the kth node.

[0148] At the tth iteration, the parameter gradient of the kth node is defined as Then the way the local model updates parameters at the tth iteration is expressed as:

[0149] In the formula, is the model parameter of the tth iteration, is the model parameter of the t+1th iteration, R nod is the learning rate for the current parameter update, is the number of samples of the kth node.

[0150] Among them, the parameter update method of the global model of the central server is expressed as:

[0151] In the formula, are the parameters of the global model of the central server at the t+1th iteration.

[0152] Then, the above iteration operation is repeated, indicating that the training of the global model of the central server and the local model of each node is completed. For example, the preset stop iteration condition is reaching the preset maximum number of iterations. In this embodiment, the preset maximum number of iterations is set to 5000 times.

[0153] Step S50: The central server aggregates and updates the parameters of the generative model using an ecological balance optimization algorithm, and then sends the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met.

[0154] It can be understood that the present invention uses the ecological equilibrium optimization algorithm to optimize the parameters of the Transformer network, which is inspired by the ecological balance phenomenon in nature, especially the dynamic balance between the niche theory and species diversity. In the natural ecosystem, each species forms a dynamic equilibrium state through competition and cooperation, so that the entire ecosystem remains stable. The Ecological Environment Optimization Algorithm (EEOA) simulates this biological phenomenon by defining a simulated ecosystem in which each individual (i.e., the Transformer network parameters) is striving for the opportunity to survive and reproduce, thereby finding the optimal balance between global search and local development, so that the algorithm can dynamically adjust the search strategy according to environmental changes during the optimization process.

[0155] In optimization algorithms, individuals usually represent a candidate solution in the problem space. Each individual has a set of attributes or parameters that define its position in the problem space and also determine its fitness, that is, how well the individual solves the problem. A species is a collection of individuals with similar characteristics, and its concept mimics the definition of species in biology, that is, a group of individuals that share a set of characteristics. In this algorithm, a species can be regarded as a group that searches a specific area in the problem space.

[0156] Each individual belongs to a specific species, and this affiliation is based on the characteristics or attributes of the individual, such as determined by similarity measures. Individuals can interact within their species and with individuals of other species. The fitness of an individual determines its position in the species, similar to the "survival of the fittest" principle in natural selection. Individuals evolve through learning (such as genetic manipulation) and adapting to the environment, affecting the overall characteristics and evolutionary direction of the species. The diversity of individuals within a species contributes to the global search ability of the algorithm, while the diversity between species helps the algorithm avoid premature convergence.

[0157] Specifically, the training process of the Transformer network based on the ecological balance optimization algorithm includes steps S51-S57 as follows.

[0158] Step S51: Initialize the ecosystem and generate an initial population, where each individual represents a potential solution, i.e., a set of parameters (weights and biases) of the Transformer network; the initialization method is expressed as:

[0159] Where W p，i represents the weight of the i-th neuron in the Transformer network, represents the initial weight of the i-th neuron in the Transformer network, b p，i represents the bias of the i-th neuron in the Transformer network, Represents the initial bias of the i-th neuron in the Transformer network; The mean is 0 and the variance is σ 2 In this embodiment, σ 2 Set to 0.01.

[0160] Step S52: Evaluate the fitness of each individual according to a preset fitness function (such as the inverse of the loss function) to determine its survival ability in the ecosystem; wherein the fitness function is calculated as:

[0161]

[0162] In the formula, f p (i) is the fitness value of the i-th individual, f p () is the fitness function, L p (i) is the loss function value of the i-th individual, L p () is the loss function of the Transformer network, ∈ is a small constant added to prevent the denominator from being zero; E p (i, j) is the energy conversion factor between the i-th species and the j-th species; N is the total number of samples, y n is the true label of the nth sample, is the predicted label of the nth sample; w p,n is the weight of the nth sample. In this embodiment, ∈ is set to 10 -8 .

[0163] Furthermore, in the simulated natural ecosystem, the energy conversion between species depends not only on the interaction between individuals, but also on the influence of environmental factors. The energy conversion factor E p (i, j) dynamically adjusts the resource sharing and competition strategies among species based on environmental pressure (i.e., the rate of change of the loss function), and its calculation method is expressed as:

[0164]

[0165] In the formula, ΔL p (i) and ΔL p (j) are the change rates of the loss functions of the i-th species and the j-th species respectively; ζ is the first hyperparameter of the conversion factor to control the conversion intensity; σ E is the conversion factor and the second hyperparameter to control the sensitivity of the response. In this example, ζ is set to 0.5, σ E Set to 0.05.

[0166] Furthermore, the calculation method of the weight of the nth sample is expressed as:

[0167]

[0168] In the formula, x p,n is the feature vector of the nth sample, μ p is the mean of the feature vectors of all samples in the current population, σ gf is a hyperparameter that controls the divergence of the weight distribution, / / / / is the L2 norm. In this embodiment, σ gf Set to the mean of the sample characteristic standard deviations.

[0169] Step S53: Allocate resources according to the fitness of individuals so that individuals with more resources have higher reproduction rates and lower extinction rates; wherein resource allocation is calculated based on fitness, expressed as:

[0170]

[0171] In the formula, R p (i) is the amount of resources allocated to the i-th individual, M is the total population, R total is the total allocatable resource, f p (j) is the fitness value of the jth individual.

[0172] Step S54: Simulate niche competition to make species compete for resources. Species that are not strong enough to support themselves may become extinct. At the same time, weaker species can choose to cooperate with other species to form a symbiotic relationship and share resources. The competition and cooperation between species are represented by the symbiotic coefficient, which is calculated as follows:

[0173]

[0174] In the formula, S p (i, j) represents the symbiotic coefficient between the i-th species and the j-th species, α is a hyperparameter for adjusting the strength of the symbiotic relationship, δ is a hyperparameter for adjusting the width of the symbiotic relationship; λ is a hyperparameter for adjusting the label effect, which indicates the influence of introducing predicted similarity in the similarity assessment between species. is the predicted label of the nth sample corresponding to the i-th species, is the predicted label of the nth sample corresponding to the i-th species. In this embodiment, α is set to 5, δ is set to 0.1, and λ is set to 0.1.

[0175] Step S55: Generate new individuals by simulating biological evolution mechanisms including genetic variation and recombination, so that the new individuals may have higher fitness; wherein, species evolution updates the weights and biases of the Transformer network through variation and recombination simulation in the genetic algorithm, and the update method is expressed as:

[0176]

[0177] Where W′ p，i represents the weight of the i-th neuron in the updated Transformer network, b′ p，i represents the bias of the i-th neuron in the updated Transformer network; Γ p (i) is the variation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness. η is the variation rate. A higher amount of resources leads to a smaller variation rate. Represents a normal distribution.

[0178] Furthermore, the calculation method of the variation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness is expressed as:

[0179]

[0180] Wherein, γ is a hyperparameter for adjusting the steepness of the curve. In this embodiment, γγ is set to 10.

[0181] Step S56: adjusting the mutation rate according to the change of the average fitness; wherein the adjustment method is expressed as:

[0182]

[0183] Where η new is the adjusted mutation rate, β is the feedback adjustment coefficient, is the average fitness of the current population. In this embodiment, β is set to 0.3.

[0184] Step S57: Repeat the iteration steps S51-S56 until the preset stop iteration condition is met, indicating that the generative model training is completed. For example, the preset stop iteration condition is reaching a preset maximum number of iterations. In this embodiment, the preset maximum number of iterations is set to 1000 times.

[0185] Step S60: After receiving the network protocol data, the trained generative model outputs a conclusion including a risk assessment accordingly.

[0186] Specifically, after the generative large model is trained, the trained generative large model is used to perform data analysis and generate conclusions based on low-dimensional network communication protocol features and document data related to the network communication protocol. For example, after the generative large model receives data, for risky network protocol data in an exemplary embodiment, the answer that may be output is: "This model detects multiple abnormal communication patterns, which include high-frequency communications between multiple IP addresses and malicious external servers, and the IP addresses of these servers match the malicious IPs in the known threat intelligence database. At the same time, the model also captures abnormal traffic on non-standard ports (such as 6667 and 8080), which are often used for unauthorized IRC communications or proxy servers, indicating the possible existence of C2 (Command and Control) communication behavior. In addition, the model identifies some unusual traffic peaks and abnormal connection frequencies, which are often related to data leakage or persistent threat activities."

[0187] Embodiment 2

[0188] The present invention provides a data analysis and conclusion generation device 100 based on multi-agent agent interaction, which is used to generate a large model that can accurately identify and analyze potential risks in network communication protocols. It should be noted that the implementation principle and specific implementation method of the data analysis and conclusion generation device 100 based on multi-agent agent interaction can refer to the above-mentioned data analysis and conclusion generation method based on multi-agent agent interaction, so it will not be repeated below.

[0189] like Figure 4 As shown, the data analysis and conclusion generation device 100 based on multi-agent agent interaction includes:

[0190] The federated learning construction module 10 is used to construct a multi-node distributed federated learning architecture; wherein each node of the federated learning acts as an intelligent agent, and each node performs a separate local model training according to the input training data;

[0191] The data capture and conversion module 20 is used to capture data packets in the real-time network flow through a preset network monitoring tool at each node, extract communication protocol data therefrom, and then store the communication protocol data in a structured data format;

[0192] The low-dimensional feature extraction module 30 is used to extract features and reduce the dimension of the communication protocol data in the structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm;

[0193] The model collaborative training module 40 is used to merge the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then input the local training data into the local models of the corresponding nodes for training, and upload the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network;

[0194] The model aggregation and updating module 50 is used for the central server to aggregate and update the parameters of the generative model using the ecological equilibrium optimization algorithm, and then send the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met;

[0195] The risk conclusion generation module 60 is used to enable the trained generative model to output a conclusion including a risk assessment accordingly after receiving the network protocol data.

[0196] Embodiment 3

[0197] The present invention provides a terminal, which includes a memory, a processor, and a computer program stored in the memory. When the computer program is executed by the processor, the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any one of the above-mentioned embodiments are implemented.

[0198] Embodiment 4

[0199] The present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any of the above-mentioned implementation modes.

[0200] Embodiment 5

[0201] The present invention provides a computer program product, including a computer program or instructions, which, when processed and executed, implement the various steps of the data analysis and conclusion generation method based on multi-agent interaction as described in any of the above-mentioned embodiments.

[0202] In summary, the data analysis and conclusion generation method and device based on multi-agent agent interaction provided by the present invention have the following beneficial effects:

[0203] (1) In the federated learning framework, each node does not need to share the data of its local training model. Instead, it trains the local model and sends the updated model to the centralized learning unit (global model) for aggregation, breaking the data resource island problem of the traditional centralized training model and aggregating more effective data.

[0204] (2) The distributed federated learning architecture can prevent the leakage of local data on each node. Data is used locally and models are trained locally, effectively ensuring data security.

[0205] (3) By reducing the dimension of the data of each node, the fitting speed of the model in the training process is improved;

[0206] (4) The neural network based on exploratory gradient descent is used as a feature extraction and dimensionality reduction model. It not only considers the current gradient information, but also adopts a forward exploration mechanism to predict the possible change trend of the gradient before the gradient is updated, and adjusts the learning step size and direction to achieve faster convergence speed and better local minimum, thereby enhancing the generalization ability of the feature;

[0207] (5) The ecological equilibrium optimization algorithm is used to optimize the parameters of the Transformer network, thereby finding the optimal balance between global search and local development, so that the algorithm can dynamically adjust the search strategy according to environmental changes during the optimization process.

[0208] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0209] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0210] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0211] In the embodiments provided by the present invention, it should be understood that the disclosed systems or devices / terminal equipment and methods can be implemented in other ways. For example, the system or device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the system or unit can be electrical, mechanical or other forms.

[0212] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0213] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0214] The present invention is not limited to what is described in the specification and implementation modes, and therefore additional advantages and modifications can be easily realized by those skilled in the art. Therefore, without departing from the spirit and scope of the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details, representative devices, and illustrative examples shown and described herein.

Claims

1. A data analysis and conclusion generation method based on multi-agent agent interaction, characterized in that: include: Step S10: construct a multi-node distributed federated learning architecture; wherein each node of the federated learning acts as an intelligent agent, and each node performs a separate local model training based on the input training data; Step S20: Each node captures data packets in the real-time network flow through a preset network monitoring tool, extracts communication protocol data therefrom, and then stores the communication protocol data in a structured data format; Step S30: extracting features and reducing dimensions of the communication protocol data in a structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm; Step S40: merging the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then inputting the local training data into the local models of the corresponding nodes for training, and uploading the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network; Step S50: The central server aggregates and updates the parameters of the generative model using an ecological balance optimization algorithm, and then sends the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met; Step S60: After receiving the network protocol data, the trained generative model outputs a conclusion including a risk assessment accordingly.

2. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 1, characterized in that: In step S40, during the model training process of the distributed federated learning architecture, the federated average algorithm is used as the model aggregation algorithm to achieve collaborative training of local models through multiple global iterations; specifically, for each global iteration, the number of nodes is defined as N leb , the total number of samples is D leb , and the number of samples of the kth node is Then the objective function of federated learning is defined as: In the formula, f leb () is the objective function of federated learning, ω leb are model parameters, is the model parameter ω leb The loss prediction for the jth sample data, L tra () is the training loss, is the sample feature of the jth sample data, The label of the jth sample data; For the kth node, the objective function of the node is defined as: In the formula, is the number of samples of the kth node, is the objective function of the kth node, is the data distribution of the kth node; At the tth iteration, the parameter gradient of the kth node is defined as Then the way the local model updates parameters at the tth iteration is expressed as: In the formula, is the model parameter of the tth iteration, is the model parameter of the t+1th iteration, R nod is the learning rate for the current parameter update, is the number of samples of the kth node; Among them, the parameter update method of the global model of the central server is expressed as: In the formula, are the parameters of the global model of the central server at the t+1th iteration.

3. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 1, characterized in that: The feature extraction and dimensionality reduction model uses a 6-layer fully connected layer neural network for feature extraction and dimensionality reduction processing. The structure of the fully connected layer neural network includes: a Input layer: used to receive and transmit sample data after sample expansion; b Hidden layer: It contains four hidden layers, each layer consists of a predetermined number of neurons; b1 The first hidden layer: has 128 neurons and is used for preliminary feature extraction; b2 The second hidden layer: has 256 neurons, which is used to further abstract features; b3 The third hidden layer: has 512 neurons, which is used to further deepen feature extraction; b4: the fourth hidden layer has 1024 neurons and is used to further deepen feature extraction; b5 output layer: has 512 neurons and is used to output low-dimensional network communication protocol features.

4. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 3, characterized in that: The step S30 comprises: Step S31: Initialize the parameters of the neural network, including the weight and bias parameters of the neural network; wherein the initialization method is expressed as: Where W p，i is the weight matrix of the i-th layer of the neural network; b p，i is the bias vector of the i-th layer of the neural network; σ p is the scaling factor of the neural network weights, β p is the scaling factor of the bias of the neural network; represents a normal distribution with a mean of 0 and a standard deviation of 1; ∈ p is a preset tiny noise vector; Step S32: The input communication protocol data passes through each layer of the neural network, and each fully connected layer is subjected to linear transformation and nonlinear activation function processing, and finally the feature representation of the output layer is obtained; wherein the output calculation method of each fully connected layer is: a p，i =Rez(W p，i ·a p，i-1 +b p，i ), where a p，i represents the activation output of the i-th layer of the neural network; a p，i-1 is the output of the i-1th layer of the neural network; Rez( ) is the adaptive ReLU activation function; Step S33: adopting an exploratory gradient descent update strategy, predicting possible gradient changes before each update of the neural network parameters, and adjusting the step size and direction of the gradient update according to the prediction results, optimizing the parameter adjustment during the training process to avoid falling into the local optimum too early; wherein the calculation method is expressed as: In the formula, ΔW p，i and Δb p，i are the update amounts of the i-th layer weight and i-th layer bias of the neural network respectively; η p is the learning rate of the neural network; is the loss function with respect to parameter W p，i The gradient of is the loss function with respect to parameter b p，i The gradient of is the loss function of the neural network; α p is the exploration intensity coefficient; is the prediction function of the gradient; Step S34: Repeat the iteration steps S31-S33 until the preset stop iteration condition is met, indicating that the feature extraction and dimensionality reduction model training is completed.

5. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 4, characterized in that: In step S32, the adaptive ReLU activation function is expressed as: Rez(x zsy )=γ p ·max(0,x zsy )+ξ p ·min(0,x zsy ), In the formula, x zsy is the input of the adaptive ReLU activation function, γ p and p are the adaptive coefficients of the positive and negative parts respectively, max() is the maximum value function, and min() is the minimum value function.

6. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 4, characterized in that: In step S33, linear regression prediction is performed using historical gradient data based on an exploratory gradient prediction function; wherein the calculation method of the exploratory prediction function is expressed as: In the formula, Represents the loss function at the t-1th iteration with respect to the parameter W p，i The gradient of t is the attenuation factor; α p is the exploration intensity coefficient; Tgz is the total number of iterations.

7. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 1, characterized in that: In step S50, the training process of the Transformer network based on the ecological balance optimization algorithm includes the following: Step S51: Initialize the ecosystem and generate an initial population, where each individual represents a potential solution, i.e., a set of parameters of the Transformer network; the initialization method is expressed as: Where W p，i represents the weight of the i-th neuron in the Transformer network, represents the initial weight of the i-th neuron in the Transformer network, b p，i represents the bias of the i-th neuron in the Transformer network, Represents the initial bias of the i-th neuron in the Transformer network; The mean is 0 and the variance is σ 2 Normal distribution of Step S52: Evaluate the fitness of each individual according to a preset fitness function to determine its survival ability in the ecosystem; wherein the fitness function is calculated as: In the formula, f p (i) is the fitness value of the i-th individual, f p () is the fitness function, L p (i) is the loss function value of the i-th individual, L p () is the loss function of the Transformer network, ∈ is a small constant added to prevent the denominator from being zero; E p (i, j) is the energy conversion factor between the i-th species and the j-th species; N is the total number of samples, y n is the true label of the nth sample, is the predicted label of the nth sample; w p，n is the weight of the nth sample; Step S53: Allocate resources according to the fitness of individuals so that individuals with more resources have higher reproduction rates and lower extinction rates; wherein resource allocation is calculated based on fitness, expressed as: In the formula, R p (i) is the amount of resources allocated to the i-th individual, M is the total population, R total is the total allocatable resource, f p (j) is the fitness value of the jth individual; Step S54: Simulate niche competition to make species compete for resources. Species that are not strong enough to support themselves may become extinct. At the same time, weaker species can choose to cooperate with other species to form a symbiotic relationship and share resources. The competition and cooperation between species are represented by the symbiotic coefficient, which is calculated as follows: In the formula, S p (i, j) represents the symbiotic coefficient between the i-th species and the j-th species, α is a hyperparameter for adjusting the strength of the symbiotic relationship, δ is a hyperparameter for adjusting the width of the symbiotic relationship; λ is a hyperparameter for adjusting the label effect, which indicates the influence of the predicted similarity introduced in the similarity assessment between species; is the predicted label of the nth sample corresponding to the i-th species, is the predicted label of the nth sample corresponding to the jth species; Step S55: Generate new individuals by simulating biological evolution mechanisms including genetic variation and recombination, so that the new individuals may have higher fitness; wherein, species evolution updates the weights and biases of the Transformer network through variation and recombination simulation in the genetic algorithm, and the update method is expressed as: Where W′ p，i represents the weight of the i-th neuron in the updated Transformer network, b′ p，i represents the bias of the i-th neuron in the updated Transformer network; Γ p (i) is the mutation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness; η is the mutation rate, and a higher amount of resources leads to a smaller mutation rate; represents normal distribution; Step S56: adjusting the mutation rate according to the change of the average fitness; wherein the adjustment method is expressed as: Where η new is the adjusted mutation rate, β is the feedback adjustment coefficient, is the average fitness of the current population; Step S57: Repeat the iteration steps S51-S56 until the preset stop iteration condition is met, which means that the generative model training is completed.

8. The data analysis and conclusion generation method based on multi-agent agent interaction as claimed in claim 7, characterized in that: In step S52, the energy conversion factor E p (i, j) dynamically adjusts the resource sharing and competition strategies among species based on environmental pressure, and its calculation method is expressed as: In the formula, ΔL p (i) and ΔL p (j) are the change rates of the loss functions of the i-th species and the j-th species respectively; ζ is the first hyperparameter of the conversion factor to control the conversion intensity; σ E is the conversion factor second hyperparameter to control the sensitivity of the response; The calculation method of the weight of the nth sample is expressed as: In the formula, x p，n is the feature vector of the nth sample, μ p is the mean of the feature vectors of all samples in the current population, σ gf is a hyperparameter that controls the divergence of the weight distribution, / / / / is the L2 norm.

9. The data analysis and conclusion generation method based on multi-agent agent interaction according to claim 7, characterized in that: In step S55, the calculation method of the variation intensity coefficient of the i-th neuron dynamically adjusted according to the individual fitness is expressed as: Where γ is a hyperparameter that adjusts the steepness of the curve.

10. A data analysis and conclusion generation device based on multi-agent agent interaction, characterized in that: include: The federated learning building module is used to build a multi-node distributed federated learning architecture. Each node in the federated learning serves as an intelligent agent, and each node performs separate local model training based on the input training data. A data capture and conversion module is used to capture data packets in a real-time network flow at each node through a preset network monitoring tool, extract communication protocol data therefrom, and then store the communication protocol data in a structured data format; A low-dimensional feature extraction module is used to extract features and reduce the dimension of the communication protocol data in a structured data format through a preset feature extraction and dimensionality reduction model to obtain low-dimensional network communication protocol features; wherein the feature extraction and dimensionality reduction model is a neural network using an exploratory gradient descent algorithm; A model collaborative training module is used to merge the low-dimensional network communication protocol features with the document data related to the network communication protocol to generate local training data, and then input the local training data into the local models of the corresponding nodes for training, and upload the trained model parameters to the global model of the central server to generate a generative model based on the Transformer network; A model aggregation and update module, which is used for the central server to aggregate and update the parameters of the generative model using an ecological equilibrium optimization algorithm, and then send the updated parameters to each node to start a new round of iterative training until the preset iteration requirements are met; The risk conclusion generation module is used to enable the trained generative model to output a conclusion including a risk assessment accordingly after receiving network protocol data.

Images