A method for implementing a secure agent system oriented to operating systems

Abstract

The present invention provides an implementation method for a security agent system oriented to an operating system. The security agent system includes a local agent and a security knowledge base; the local agent has a multi-task learning assistance model. The implementation method includes the following steps: step S1: initializing the local agent and mounting the security knowledge base; step S2: the local agent loading the multi-task learning assistance model; step S3: the local agent sensing and monitoring the resources of the operating system and collecting resource data of the operating system; step S4: the local agent performing a preliminary analysis of the security status of the operating system based on the resource data to determine whether a threat event exists; if a threat event exists, further analysis is performed to obtain an analysis result of the threat event; and step S5: the local agent generates and adjusts a security policy based on the analysis result of the threat event and the load condition of the operating system through the multi-task learning assistance model.

Description

Technical Field

[0001] The present invention relates to the field of operating system security, and in particular to a method for implementing an operating system-oriented security Agent system. Background Art

[0002] In modern operating systems, with the rapid development of technology, the complexity and diversity of security threats have increased significantly. Traditional security monitoring and protection mechanisms are no longer able to cope with increasingly complex attack methods and changing threat scenarios. Therefore, operating system security protection urgently requires more intelligent and automated solutions to ensure system robustness and security.

[0003] Traditional operating system security mechanisms are typically based on static rules and predefined protection policies. While these approaches can address common, known threats, they often exhibit limited capabilities against advanced persistent threats and zero-day attacks. Especially in today's network environment, attackers often bypass traditional protections to carry out malicious activities. For example, they employ specific malicious behavior patterns to disguise legitimate operations or use social engineering tactics to gain critical system permissions, allowing them to conduct further data theft or sabotage operations. Therefore, the intelligent operation system security center is key to combating these complex threats.

[0004] In recent years, the rise of large language model technology has brought new opportunities for the intelligent development of security systems. Large language models, through deep learning of large amounts of security data, enable threat intelligence analysis, identification of abnormal behavior, and real-time response decision-making. Security systems based on large language models can automatically learn attacker behavior patterns through comprehensive analysis of multi-source data, enabling faster and more accurate identification of potential threats and the implementation of appropriate protective measures.

[0005] As a core component of the operating system's security center, the local agent is responsible for collecting, analyzing, and responding to security data. Traditional local agents often rely on rule engines and static signature libraries, and their detection effectiveness often depends on the speed of updates to the known threat database. However, with the advancement of attack techniques, attackers can circumvent signature detection technologies or exploit system vulnerabilities to launch attacks. Therefore, the adoption of more intelligent local agent systems has become a necessary trend. Summary of the Invention

[0006] To address the above issues, the present invention aims to provide a method for implementing an operating system-oriented security agent system. This method uses a local agent to achieve higher security detection accuracy and wider adaptability. The local agent can also collaborate with a cloud agent for protection.

[0007] The present invention provides a method for implementing an operating system-oriented security agent system, wherein the security agent system includes a local agent and a security knowledge base; the local agent has a multi-task learning assistance model;

[0008] The implementation method includes the following steps:

[0009] Step S1: Initialize the local agent and mount the security knowledge base; the security knowledge base is constructed by combining the RAG large language model and knowledge graph;

[0010] Step S2: The local agent loads the multi-task learning helper model, enabling the local agent to generate and adjust security policies;

[0011] Step S3: The local agent senses and monitors the resources of the operating system and collects the resource data of the operating system;

[0012] Step S4: The local agent uses the RAG large language model to perform a preliminary analysis of the security status of the operating system based on the resource data to determine whether there is a threat event; if there is a threat event, further analysis is performed to obtain the analysis result of the threat event;

[0013] Step S5: The local agent helps the model generate and adjust security policies through multi-task learning based on the analysis results of threat events and the load of the operating system.

[0014] A further improvement of the present invention is that the process of combining the security knowledge base with the knowledge graph and the RAG large language model is as follows:

[0015] Step S101, entity identification: extracting entities in the security field from security data; the entities include attackers, target systems, attack methods, vulnerability types, and mitigation measures; each entity is assigned a unique identifier; the security data includes security-related text data, threat intelligence, event logs, and intrusion detection rules;

[0016] Step S102, relationship extraction: Analyze the relationships between entities in the security data, extract the connections between entities, and construct a knowledge graph based on them; the relationships between entities are abstracted in the knowledge graph as connections between entity nodes and adjacent entity nodes;

[0017] Step S103: Generate a vector representation with neighborhood information based on the constructed knowledge graph neighborhood expansion, and pass the vector representation into the RAG large language model, so that the RAG large language model has context matching capabilities when calling the security knowledge base for retrieval and parsing.

[0018] A further improvement of the present invention is that the construction process of the multi-task learning assistance model is as follows:

[0019] Step S201: Determine multiple tasks that the multi-task learning helps the model solve;

[0020] The multi-task learning model is used to solve multiple tasks related to threat events; the multiple tasks are classification tasks, regression tasks, and generation tasks; the classification task classifies threat events and determines the threat category and threat level; the regression task scores the threat risk of threat events; and the generation task determines and generates corresponding security policies based on the threat risk score;

[0021] Step S202: preparing a data set based on the multiple tasks to be solved; the data set includes a classification data set, a regression data set, and a generation data set;

[0022] Step S203: constructing the architecture of the basic pre-training model;

[0023] The basic pre-trained model includes a shared layer and a task-specific layer; the task-specific layer includes a classification task output layer, a regression task output layer, and a generation task output layer; the shared layer has multiple layers and is used to extract common features of threat events; the classification task output layer uses a softmax layer to classify threat events and determine the threat category and threat level; the regression task output layer uses a linear layer to output a threat risk score; and the generation task output layer uses a decoder layer to generate a security policy.

[0024] Step S204: input the data set into the basic pre-training model for training to obtain a multi-task learning assistance model.

[0025] A further improvement of the present invention is that step S4 includes the following steps:

[0026] Step S41, data cleaning and standardization: performing data cleaning and standardization on the collected operating system resource data;

[0027] In step S42, the local agent uses the RAG large language model to perform a preliminary analysis on the resource data of the operating system that has completed data cleaning and standardization, and detects whether there are any threat events in the operating system in the form of a detection task;

[0028] Step S43: If a threat event exists, the local agent subdivides the detection task into multiple subtasks to further analyze the threat event and obtain analysis results of the multiple subtasks;

[0029] In step S44, based on the analysis results of the multiple subtasks, the local agent obtains the analysis results of the threat event.

[0030] A further improvement of the present invention is that the subtasks include abnormal network traffic analysis, system vulnerability repair suggestion generation, and threat tracing;

[0031] Abnormal network traffic analysis: The local agent analyzes threat events to determine whether there is persistent malicious traffic or DDoS attacks.

[0032] System vulnerability repair suggestion generation: If the threat event is a vulnerability, the local agent checks the vulnerability and generates preliminary repair suggestions;

[0033] Threat tracing: The local agent tracks the origin and propagation path of threat events.

[0034] A further improvement of the present invention is that in step S5, the local agent uses multi-task learning to help the model calculate the threat risk score of the threat event based on the analysis results of the threat event and the load of the operating system, and selects and adjusts the security policy based on the threat risk score of the threat event;

[0035] The threat risk score of a threat event is based on the risk value of the threat event assessed by a dynamic response algorithm; the risk value corresponds to a high-risk threat or a low-risk threat; if the risk value of the threat event corresponds to a high-risk threat, the security strategy adopted is traffic filtering or intrusion detection; if the risk value of the threat event corresponds to a low-risk threat, the security strategy adopted is alarm notification or log monitoring.

[0036] A further improvement of the present invention is that the calculation formula of the threat risk score is as follows:

[0037] Threat risk score = a·threat level score + b·impact factor score + c·system load score;

[0038] Where a is the weight factor for the threat level score, b is the weight factor for the impact factor score, and c is the weight factor for the system load score. The threat level score is determined based on the threat category and threat level of the threat event. The impact factor score is determined based on the potential impact of the threat event on the system resources and services of the operating system. The system load score is determined based on the current load of the operating system.

[0039] The dynamic response algorithm refers to setting a risk score threshold to distinguish the risk value of threat events. If the threat risk score of a threat event is greater than the risk score threshold, the risk value of the threat event corresponds to a high-risk threat; if the threat risk score of a threat event is less than or equal to the risk score threshold, the risk value of the threat event corresponds to a low-risk threat.

[0040] A further improvement of the present invention is that the security agent system further includes a cloud agent;

[0041] In step S5, if the local agent determines that the threat event cannot be handled, the local agent will request the cloud agent to assist in analysis;

[0042] The specific steps for cloud agent-assisted analysis are as follows:

[0043] Threat data upload: The local agent uploads threat event-related data to the cloud agent, which then formats the uploaded threat event-related data in a standardized format.

[0044] Cloud Agent Analysis: Cloud Agent uses distributed computing resources to analyze threat event-related data in a standardized format.

[0045] Feedback of cloud threat report: After the cloud agent completes the analysis, it generates a cloud threat report and feeds it back to the local agent.

[0046] A further improvement of the present invention is that it further includes step S6; Step S6: the local Agent generates a security status summary report, and the security status summary report records the security status and threat events of the operating system.

[0047] Beneficial effects of the present invention:

[0048] This invention, through the local agent empowered by a large language model, can achieve higher security detection accuracy and broader adaptability. The local agent not only monitors the operating system's operating status in real time but also intelligently analyzes abnormal behavior to determine whether the operating system is under attack or in an abnormal state. Furthermore, the local agent can dynamically adjust security policies based on the operating system's operating status, achieving adaptive protection. Furthermore, the local agent can also collaborate with other components of the security center to build a closed-loop security protection system encompassing monitoring, detection, decision-making, and response, providing comprehensive protection for operating system security. DETAILED DESCRIPTION

[0049] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the embodiments of the present invention. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0050] The present invention proposes a method for implementing a security agent system for an operating system. By deploying an intelligent local agent within the operating system, the operating status of the operating system is monitored in real time and security analysis is performed. The local agent uses large language model technology to conduct in-depth learning and analysis of system logs, operational behaviors and other data, and can identify complex attack patterns, especially zero-day attacks and advanced persistent threats, greatly improving the accuracy of detection. The security agent system can automatically adjust security policies based on real-time analysis results to ensure effective security responses in different threat events. In addition, the local agent has adaptive capabilities and can intelligently coordinate cloud agent computing resources for collaborative protection based on task complexity, urgency and local computing power conditions, ensuring that security detection tasks can still be completed efficiently in a resource-constrained environment.

[0051] This invention builds a closed-loop security protection system encompassing monitoring, detection, and response through the collaboration of local and cloud agents. The security agent system not only addresses traditional, known threats but also possesses the ability to automatically learn and adapt to new attacks, thereby achieving comprehensive, intelligent security protection for the operating system. Through dynamic task allocation and resource management mechanisms, the security agent system ensures that, in the face of complex attacks, it can fully utilize local resources while leveraging support from cloud agents, ensuring stable and secure operation of the operating system even in high-threat environments.

[0052] The security agent system includes a local agent, a security knowledge base, and a cloud agent. The local agent has a multi-task learning assistance model and multiple modules.

[0053] The present invention provides a method for implementing an operating system-oriented security agent system, comprising the following steps:

[0054] Step S1: Initialize the local Agent and mount the security knowledge base to enable it to have the ability to analyze various threat events, their attack modes, and common vulnerabilities.

[0055] The security knowledge base combines the RAG large language model and knowledge graph to achieve more accurate contextual understanding and reasoning capabilities. The security knowledge base combines the entity relationship information in the knowledge graph with the generation and retrieval capabilities of the RAG large language model. By constructing a knowledge graph in the security field and incorporating entity relationships from the knowledge graph during queries, it achieves deep semantic understanding and dynamic context matching.

[0056] The specific process is as follows:

[0057] Step S101, Entity Identification: Extract core security entities from security data, which includes security-related text data, threat intelligence, event logs, and intrusion detection rules. Entities include attackers, target systems, attack methods, vulnerability types, and mitigation measures. Each entity is assigned a unique identifier to facilitate tracking and association.

[0058] Step S102, Relationship Extraction: Analyze the relationships between entities in the security data, extract the connections between entities, and construct a knowledge graph based on these connections. The relationships between entities are abstracted in the knowledge graph as connections between entity nodes and adjacent entity nodes.

[0059] The relationships between entities, including:

[0060] Belongs to: A certain attack technique belongs to a certain attack type.

[0061] Contains: Multiple mitigations are available for a vulnerability.

[0062] Dependency: An operating system depends on a specific security configuration.

[0063] Impact: The impact of an attack technique on the security of the target operating system.

[0064] Step S103: Generate a vector representation with neighborhood information based on the neighborhood expansion of the knowledge graph, and pass the vector representation to the retrieval module of the RAG large language model, so that the retrieval module can perform accurate context matching when calling the security knowledge base for retrieval and analysis.

[0065] By expanding the neighborhood of the knowledge graph, the entity node corresponding to the queried entity and the adjacent entity nodes (neighbor nodes) can be represented as a vector representation of a context subgraph, enabling the retrieval module of the RAG large language model to have more extensive context matching and generation capabilities.

[0066] Assuming that the queried entity node v has N neighbor nodes in the knowledge graph, the following formula is used to generate the vector representation of the context subgraph of the entity node v:

[0067] ;

[0068] E context A vector representation of the context subgraph representing the query entity;

[0069] E v The vector representation of the entity node v representing the query;

[0070] Represents the vector representation of the i-th neighbor node;

[0071] It represents the graph distance between the queried entity node v and its neighbor nodes (such as the number of hops or edge weights in the knowledge graph), and is used to measure the relevance of the neighbor nodes to the queried entity node v.

[0072] α and β are balancing factors used to control the weights of the query entity node v and its adjacent entity nodes (neighbor nodes), generating a vector representation E with neighborhood information context , the vector represents E context It not only contains the basic information of the query entity, but also introduces a wider context through the influence of neighboring nodes. This vector represents E context The retrieval module of the RAG large language model is fed into the retrieval module for more accurate context matching, thereby significantly improving the semantic relevance of the retrieval.

[0073] Vector representation E context After being fed into the retrieval module of the RAG large language model, the RAG large language model also needs to use a multi-path expansion algorithm (search algorithm) for retrieval. The multi-path expansion algorithm, guided by the knowledge graph, is an information retrieval algorithm with the ability to associate contextual information. The multi-path expansion algorithm searches for contextual information spanning multiple entity nodes, integrates this information into a context subgraph, and generates a multi-layered context vector representation. This multi-layered context vector representation is then fed into the generation module of the RAG large language model to meet the needs of complex context queries.

[0074] Assume that a multi-level context path set related to an entity node v is queried in the knowledge graph. The steps of the multi-path expansion algorithm are as follows:

[0075] 1. Initialization: Set the maximum expansion depth k and initialize the entity node set of the path , that is, starting from the queried entity node v.

[0076] 2. Iterative expansion: For each entity node in the i-th layer , search for all entity nodes adjacent to entity node u and add them to the set P i+1 , and record the path information from the queried entity node v to the entity node u.

[0077] 3. Path selection: Filter all paths that reach the terminal entity node, and retain the path set P with the highest relevance based on indicators such as edge weight, path length or node importance score in the knowledge graph. k .

[0078] 4. Path Embedding: Convert the entity nodes and relationships on the path into vector representations, combine them into a multi-layer path context representation, and serve as the input to the generation module of the RAG large language model.

[0079] 5. The final context vector representation of the multi-layer path is generated by the following formula:

[0080] ;

[0081] in:

[0082] E path : Multi-layer path context vector representation of the query.

[0083] P j : The set of path nodes at the jth layer.

[0084] γ j : Layer weight factor, used to adjust the influence of different layers (usually gradually decreases as the number of layers increases).

[0085] Step S2: The local agent loads the multi-task learning helper model, enabling the local agent to have the ability to generate and adjust security policies.

[0086] The core capability of the local agent design relies on multi-task learning to fine-tune the model across multiple dimensions, particularly through collaborative optimization of key tasks such as threat classification, severity assessment (threat level), and security policy generation. Multi-task fine-tuning enables the local agent to respond quickly and accurately in a variety of complex security scenarios, enabling dynamic security policy adjustments and real-time protection.

[0087] The multi-task learning helps the model building process as follows:

[0088] Step S201: Determine the tasks that the multi-task learning helps the model to solve;

[0089] To enhance the local agent's global understanding of the security field, multi-task learning helps the model solve multiple security-related tasks simultaneously. These tasks are not only interrelated but also share features, thereby improving the multi-task learning model's ability to respond to threat events. The following are some of the main tasks:

[0090] Classification: This task is used to categorize threat events into threat categories (e.g., DDoS, malware, data breaches, etc.) and threat levels (e.g., high, medium, low). Therefore, the purpose of classification is to help multi-task learning models identify threat categories and levels, thereby prioritizing response plans.

[0091] Regression tasks: Regression tasks are primarily used to predict numerical indicators of threat events, such as threat risk scores. Through regression predictions, multi-task learning helps the model assign a risk score (threat risk score) to each threat event, further helping the local agent assess the severity of the threat event.

[0092] Generative tasks: Generative tasks allow multi-task learning to help the model generate recommended response strategies based on the threat category and severity of the threat event. These strategies may include specific measures such as isolating the target system, blocking malicious access, and performing virus scans. Generative tasks enable the local agent to provide flexible and targeted security policies for each threat event.

[0093] Step S202: Prepare corresponding data sets based on the multiple tasks to be solved.

[0094] To support multi-task learning, a dedicated dataset is needed for each task. This allows the model to share information between different tasks and be trained efficiently. The datasets include classification datasets, regression datasets, and generation datasets.

[0095] The classification dataset includes the "threat category" and "threat level" labels for each sample (threat event), which helps the multi-task learning model to determine the threat category and threat level of the threat event.

[0096] Regression dataset: records the threat risk score of each threat event (for example, calculated based on attack type, impact scope, etc.), providing quantitative threat assessment for the multi-task learning model.

[0097] Generate a dataset: This dataset includes recommended security policies for specific threat categories, threat levels, and threat risk scores. The security policies in this dataset can be described in natural language, and multi-task learning is used to train the model to generate specific security policies.

[0098] Step S203: Determine the architecture of the basic pre-training model;

[0099] In multi-task fine-tuning, in addition to the basic bottom, middle and high layers, the basic pre-training model also designs a structure of shared layers and task-specific layers to ensure that information can be efficiently shared between multiple tasks and improve feature extraction capabilities.

[0100] Shared layers: The first few layers of the basic pre-trained model (such as the Transformer encoder layer) are used to extract common features. These layers are shared by multiple tasks, allowing each task to benefit from the common features and improve the generalization ability of feature representation.

[0101] Task-specific layers: Based on the shared layers, a dedicated output layer is designed for each task, optimized for the needs of each task. Task-specific layers include classification task output layers, regression task output layers, and generation task output layers.

[0102] Classification task output layer: A softmax layer is used to predict threat events and determine the threat category and threat level. The threat levels include high, medium, and low.

[0103] Regression task output layer: A linear layer is used to output a threat risk score, which is used to quantitatively assess the harm of the threat event. The threat risk score is a quantitative value that is derived from a comprehensive analysis of the threat level, impact factor, and system load.

[0104] Generate task output layer: Use the Transformer decoder layer to generate natural language response strategies and generate specific security policies for threat events.

[0105] Step S204: input the data set into the basic pre-training model for training to obtain a multi-task learning assistance model.

[0106] The dataset is fed into a pre-trained base model for training, thereby fine-tuning the pre-trained base model. To improve fine-tuning efficiency and effectiveness, the pre-trained base model adopts a strategy of freezing some layers and training others. Specifically, the low-level and shared layers of the pre-trained base model are frozen, while training is focused on task-specific layers and some mid- and high-level network parameters. This strategy helps preserve the general features learned in the pre-trained base model while enabling adaptive fine-tuning for specific tasks.

[0107] The loss of each task is assigned a weight factor λ according to the importance of the task class ,λ reg and λ gen , these weights control the contribution of each task in the final optimization. Task parameter updates are performed using the following formula:

[0108] ;

[0109] in:

[0110] W updated : updated model parameters; W orig : original model parameters; η: learning rate;

[0111] ▽ W L class 、▽ W L reg 、▽ W L gen : Represents the gradient of the loss function of the classification task, regression task and generation task with respect to the model parameters respectively;

[0112] λ class ,λ reg ,λ gen: Represents the weight factors of classification task, regression task and generation task respectively, controlling the contribution of each task to parameter update.

[0113] The training is completed and a multi-task learning helper model is obtained.

[0114] Step S3: The local agent senses and monitors the resources of the operating system, and collects and analyzes the resource data of the operating system.

[0115] When the local agent starts, it calls the system environment perception module to intelligently perceive and monitor the resource status of the operating system. The system environment perception module triggers resource status monitoring based on system events and dynamically adjusts the monitoring strategy based on a dynamic perception algorithm.

[0116] System event trigger monitoring includes monitoring of file system events and subscription to key system events.

[0117] File system event monitoring: For file and disk resources, use system event monitoring tools (such as inotify on Linux) to monitor file or directory changes. When a file or directory in the file system changes, a related event is triggered to initiate subsequent monitoring operations. For example, changes to a log file can trigger further monitoring of disk usage or other resource status, eliminating the need for frequent file system polling and unnecessary performance overhead.

[0118] Subscription to critical system events: Dynamically initiate monitoring by subscribing to critical system events, such as high CPU or memory load. When the load approaches a preset threshold, the relevant monitoring task is triggered, providing more timely feedback and response during high load conditions. This mechanism effectively avoids excessive monitoring when the operating system is overloaded, reducing resource waste.

[0119] The local agent uses a dynamic perception algorithm to dynamically adjust the monitoring strategy according to the resource status of the operating system, reducing the impact on the operating system performance and providing timely security response when needed.

[0120] The dynamic perception algorithm is: set a usage threshold T threshold , if the usage R(t) of a resource exceeds the usage threshold T threshold When the monitoring is triggered:

[0121] if R(t) > T threshold , then trigger intensive monitoring

[0122] At the same time, the monitoring frequency f(t) will be dynamically adjusted according to resource usage:

[0123] ;

[0124] in:

[0125] R(t): The resource status of the operating system at time t.

[0126] T threshold : The set usage threshold is used to determine whether monitoring needs to be triggered.

[0127] f1: low-frequency monitoring (when resource usage is low); f2: high-frequency monitoring (when resource usage is high).

[0128] The local agent can dynamically adjust the monitoring strategy according to the actual resource status, thereby reducing the impact on the operating system performance and providing timely security response when needed.

[0129] In this step, the collected operating system resource data includes system environment data, real-time data of key resources, and system logs. Key resources include CPU, memory, and disk usage. System environment data includes basic information such as the operating system's hardware configuration, network status, running processes, network traffic data, and static code files.

[0130] After the local agent collects system logs, it can use the log collection framework (Elastic Stack) to perform structured processing on them, generating structured system logs to improve the efficiency and accuracy of subsequent analysis. System logs include system events, network connections, process behavior, user login records, and more.

[0131] Step S4: The local agent performs a preliminary analysis on the security status of the operating system based on the resource data to determine whether a threat event exists; if a threat event exists, the analysis result of the threat event is further determined.

[0132] Specifically, the following steps are included:

[0133] Step S41, Data Cleaning and Standardization: The collected operating system resource data is cleaned and standardized to ensure a consistent structure and the absence of redundant information. System logs are formatted to extract key events (such as failed logins and abnormal processes). Network traffic data is parsed into a structured data format using a traffic analysis tool. Static code files are scanned using a code scanning tool (SonarQube) to identify potential security vulnerabilities.

[0134] In step S42, the RAG large language model performs a preliminary analysis to determine whether a threat event exists. After data preprocessing is complete, the local agent invokes the RAG large language model to perform a preliminary analysis of the cleansed and standardized operating system resource data. Using historical threat patterns, the RAG large language model detects threat events (such as abnormal behavior, potential malicious activity, or security vulnerabilities) in the operating system as a detection task. This preliminary analysis helps identify initial security risks and provides a basis for subsequent response and resolution.

[0135] In step S43, if there is a threat event, the local agent calls the task decomposition module to subdivide the detection task corresponding to the threat event into multiple subtasks to further analyze and confirm the threat event.

[0136] The detection task corresponding to the threat event is subdivided into multiple subtasks based on the type, complexity and current status of the threat. The subtasks include: network traffic analysis, generation of system vulnerability repair suggestions, threat tracing, etc.

[0137] The subtasks are assigned as follows:

[0138] Abnormal network traffic analysis: The local agent calls the traffic analysis module to further analyze whether there is persistent malicious traffic or DDoS attacks.

[0139] System vulnerability repair suggestion generation: For detected vulnerabilities, the local agent calls the static code analysis module to deeply check the unrepaired vulnerabilities and generate preliminary repair suggestions.

[0140] Threat Tracing: During real-time monitoring, the local agent automatically records the behavior paths of each process, network connection, and key events in the operating system. This behavior path data includes process startup and termination records, user access behavior, network request links, and other information. This data is stored in a structured manner, enabling rapid tracing of the threat's origin and propagation path upon detection of abnormal activity or potential threats.

[0141] The specific process of threat tracing is as follows:

[0142] Behavior path recording: During the operation of the operating system, the local agent continuously collects and records the operating system's behavior path, generating detailed operation logs, including file operations, port access, system calls, etc. This process ensures that the execution order and dependencies of each operation are fully preserved.

[0143] Source Tracing Analysis: Once an unusual activity or threat event is detected, the local agent invokes the source tracing module to conduct an in-depth analysis of the previously recorded behavior path. By comparing the behavior paths before and after the threat event, the local agent can restore the attack chain, identifying the initial trigger point, propagation path, and affected system components.

[0144] Visualization of the threat propagation chain: The local agent visualizes threat tracing results, showing the attacker's path and the threat's spread within the operating system. The chart displays not only the attack source and affected modules, but also the attacker's actions at each node, helping administrators quickly understand the full scope of the threat.

[0145] After analyzing each subtask, the analysis results of the subtask are obtained.

[0146] In step S44, based on the analysis results of the subtasks, the local agent obtains the analysis results of the threat event.

[0147] If resources are limited or the detection task is too complex, the local agent evaluates the task's computing power requirements in real time and determines whether to call upon the cloud agent's computing resources. If so, the local agent uploads necessary data, such as system logs and static code, to the cloud agent, where the cloud agent's large language model performs in-depth analysis and vulnerability detection. Once the cloud agent's large language model analysis is complete, it automatically generates targeted patches and provides feedback to the local agent with patch testing results and deployment recommendations.

[0148] Step S5: The local agent helps the model generate and adjust security policies through multi-task learning based on the analysis results of threat events and the load of the operating system.

[0149] Based on threat event analysis and operating system load, the local agent uses multi-task learning to help the model calculate threat risk scores. It then intelligently selects and adjusts security policies based on these scores. Furthermore, when the local agent is unable to respond to complex threats, it requests analysis assistance from the cloud agent and adjusts security policies based on the cloud agent's feedback.

[0150] In order to reasonably assess the risk of threat events and decide on appropriate security strategies, the local agent helps the model to score the threat risk of each threat event through multi-task learning.

[0151] The threat risk score is calculated as follows:

[0152] Risk Score=a·Threat Level + b·Impact Factor + c·System Load

[0153] Risk Score: Threat risk score.

[0154] Threat Level: Based on the RAG large language model and analysis results, the system categorizes threat events (threat categories such as DDoS attacks and data breaches), determines the severity of the threat event (threat level), and assigns a threat level score. The threat level reflects the urgency of the threat event.

[0155] Impact Factor: This score measures the potential impact of a threat event on the operating system's resources and services, such as whether it will cause network outages or data loss. The Impact Factor reflects the extent of damage caused by the threat event.

[0156] System Load Score: Assess the current operating system load to avoid executing complex security policies when operating system resources are insufficient, thereby minimizing the impact on operating system performance. System Load is assessed by monitoring the usage of operating system resources such as CPU, memory, and network.

[0157] a, b, c: Weighting factors that control the impact of each factor on the final threat risk score. Weighting factors can be adjusted based on actual conditions to balance the effects of different factors.

[0158] After calculating the threat risk score, the local agent can assign a specific risk value to each threat event and select the most appropriate security policy based on it.

[0159] The risk value corresponds to a high-risk threat or a low-risk threat, which is implemented based on a dynamic response algorithm.

[0160] The dynamic response algorithm refers to a set risk score threshold that is used to distinguish whether the risk value of a threat event is a high-risk threat or a low-risk threat. The dynamic response algorithm is:

[0161] If Risk Score > T threshold , then Trigger High-Level Defense Strategy

[0162] If Risk Score≤T threshold , then Trigger Low-Level Defense Strategy

[0163] T threshold : risk score threshold;

[0164] High-Level Defense Strategy: Security strategy for high-risk threats;

[0165] Low-Level Defense Strategy: A security strategy for low-risk threats.

[0166] If the threat risk score is greater than the risk score threshold, the risk value of the threat event corresponds to a high-risk threat, and the security policy of high-risk threat is adopted; if the threat risk score is less than or equal to the risk score threshold, the risk value of the threat event corresponds to a low-risk threat, and the security policy of low-risk threat is adopted.

[0167] The specific security policies are:

[0168] Security strategies for high-risk threats (such as severe DDoS attacks) trigger more complex and timely protection strategies, such as traffic filtering and IP blocking.

[0169] Security policies for low-risk threats (such as minor system configuration errors) only require triggering alerts or performing lightweight resource checks.

[0170] For example: a: The classification task identifies the threat as "DDoS attack" (threat category) and "high" level (threat level).

[0171] b. The regression task calculates its threat risk score as 85 (assuming the risk score threshold is 80).

[0172] c. The dynamic response algorithm determines the risk value as a high-risk threat (85>80).

[0173] d. Generate a task output security policy: "Enable traffic filtering and request cloud agent assistance."

[0174] Step S6: The local agent generates a security status summary report, which records the operating system's security status and threat events. Based on the natural language generation capabilities of the RAG large language model, the security status summary report concisely describes the detected threat events, the potential impact, and the recommended security policies. The security status summary report displays threat tracing information in a visual chart format, helping administrators quickly understand the full picture of the threat event. The report is stored in the security center for review.

[0175] The local agent uses multi-task learning to help the model calculate threat risk scores based on threat events and operating system load. It then intelligently selects and adjusts security policies based on these scores. Furthermore, when the local agent is unable to respond to complex threats, it requests analysis assistance from the cloud agent and adjusts security policies based on the cloud agent's feedback.

[0176] When the local agent detects complex threats that it cannot handle alone, it requests assistance from the cloud agent through the security proxy. The cloud agent uses its powerful computing power to conduct in-depth analysis of uploaded threat data and identify complex attacks such as advanced persistent threats (APTs) or cross-system attacks.

[0177] The processing flow of the cloud agent is as follows:

[0178] Threat data upload: The local agent uploads relevant threat data (such as log fragments, abnormal network traffic, suspicious code files, etc.) to the cloud agent. The format of this threat data is standardized so that the cloud agent can process it quickly.

[0179] Cloud Agent Analysis: The cloud agent's large language model efficiently analyzes data using distributed computing resources to identify the complexity of threats and attack chains. The cloud agent's powerful computing power enables it to process large amounts of data and conduct deep learning to discover attack patterns that local agent detection methods cannot identify.

[0180] The specific process of cloud agent analysis is as follows:

[0181] 1. Advanced Threat Detection: Cloud-based agents can identify distributed attacks and advanced persistent threats (APTs) by integrating data from multiple systems. This step uses multi-layered, in-depth analysis to identify potential attackers, attack methods, and their correlation with other incidents.

[0182] 2. Threat Chain Analysis: By integrating with a global threat database, cloud-based agents can identify attackers' attack patterns, attack paths, and propagation chains. This provides rich contextual information for generating targeted security policies and helps local agents understand the overall attack landscape.

[0183] 3. Cloud Threat Report Feedback: After analysis, the cloud agent generates a detailed cloud threat report. This report includes information such as the attack chain, threat level, possible techniques used by the attacker, and the potential impact on the operating system. After the cloud threat report is fed back to the local agent, the local agent can adjust its security policy based on the cloud agent's analysis results.

[0184] Local security policy adjustment refers to the cloud threat report based on the cloud agent, the local agent can automatically adjust the security policy. For example:

[0185] Firewall rule update: Reconfigure the firewall based on cloud analysis results to restrict suspicious network access.

[0186] Isolate infected nodes: If the cloud agent analysis finds that certain nodes are under attack, it can trigger isolation operations to prevent the threat from spreading.

[0187] Operating system security policy update: Based on the recommendations provided by the cloud agent, the local agent can update the operating system's security policy to improve protection capabilities.

[0188] Beneficial effects of the present invention:

[0189] 1. Real-time Monitoring and Global Perception: This invention upgrades the operating system security center to a local agent, enabling real-time monitoring of the operating system's security status and global awareness. Compared to traditional static rule-based systems, the local agent can dynamically analyze the system environment, identify potential threats, and make intelligent decisions. This real-time perception capability enables the operating system to proactively respond to threats and achieve proactive protection.

[0190] 2. Intelligent decision-making and task coordination: This invention can not only automatically identify complex attack patterns, but also flexibly coordinate the computing power of local and cloud-based large models according to the complexity, urgency and local computing power conditions of the task, thereby greatly improving the resource utilization efficiency of the operating system. Even in a local environment with limited resources, it can complete highly complex threat detection and security protection tasks through the intelligent supplementation of cloud resources.

[0191] 3. Efficient Threat Detection and Response Mechanism: Local agents can automatically learn new threat patterns, eliminating the traditional reliance on manual rule updates. The security agent system features an adaptive threat detection and response mechanism that can quickly identify and address advanced threats, improving detection accuracy and speed. Furthermore, through collaboration with cloud-based agents, this invention can address a wider range of threat types, thereby strengthening comprehensive protection for operating system security.

[0192] 4. Dynamic Collaboration between Local and Cloud Resources: Limited local computing power is a bottleneck in existing threat detection systems. This invention overcomes this limitation by intelligently coordinating the capabilities of large models locally and in the cloud. When local resources are insufficient, the security agent system automatically offloads complex tasks to the cloud agent, ensuring that the operating system maintains robust security detection and protection capabilities even under high load.

[0193] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for implementing a secure agent system for an operating system, characterized in that: The security agent system includes a local agent and a security knowledge base; the local agent has a multi-task learning assistance model; The implementation method includes the following steps: Step S1: Initialize the local agent and mount the security knowledge base; the security knowledge base is constructed by combining the RAG large language model and knowledge graph; Step S2: The local agent loads the multi-task learning helper model, enabling the local agent to generate and adjust security policies; Step S3: The local agent senses and monitors the resources of the operating system and collects the resource data of the operating system; Step S4: The local agent uses the RAG large language model to perform a preliminary analysis of the security status of the operating system based on the resource data to determine whether there is a threat event; if there is a threat event, further analysis is performed to obtain the analysis result of the threat event; Step S5: The local agent uses multi-task learning to help the model generate and adjust security policies based on the analysis results of threat events and the load of the operating system; The process of combining the security knowledge base with the knowledge graph and the RAG large language model is as follows: Step S101, entity identification: extracting entities in the security field from security data; the entities include attackers, target systems, attack methods, vulnerability types, and mitigation measures; each entity is assigned a unique identifier; the security data includes security-related text data, threat intelligence, event logs, and intrusion detection rules; Step S102, relationship extraction: Analyze the relationships between entities in the security data, extract the connections between entities, and construct a knowledge graph based on them; the relationships between entities are abstracted in the knowledge graph as connections between entity nodes and adjacent entity nodes; Step S103: Generate a vector representation with neighborhood information based on the constructed knowledge graph neighborhood expansion, and pass the vector representation into the RAG large language model, so that the RAG large language model has context matching capabilities when calling the security knowledge base for retrieval and parsing; The construction process of the multi-task learning helper model is as follows: Step S201: Determine multiple tasks that the multi-task learning helps the model solve; The multi-task learning model is used to solve multiple tasks related to threat events; the multiple tasks are classification tasks, regression tasks, and generation tasks; the classification task classifies threat events and determines the threat category and threat level; the regression task scores the threat risk of threat events; and the generation task determines and generates corresponding security policies based on the threat risk score; Step S202: preparing a data set based on the multiple tasks to be solved; the data set includes a classification data set, a regression data set, and a generation data set; Step S203: constructing the architecture of the basic pre-training model; The basic pre-trained model includes a shared layer and a task-specific layer; the task-specific layer includes a classification task output layer, a regression task output layer, and a generation task output layer; the shared layer has multiple layers and is used to extract common features of threat events; the classification task output layer uses a softmax layer to classify threat events and determine the threat category and threat level; the regression task output layer uses a linear layer to output a threat risk score; and the generation task output layer uses a decoder layer to generate a security policy. Step S204: inputting the data set into the basic pre-training model for training to obtain a multi-task learning assistance model; In step S5, the local agent uses multi-task learning to help the model calculate the threat risk score of the threat event based on the analysis results of the threat event and the load of the operating system, and selects and adjusts the security policy based on the threat risk score of the threat event; The threat risk score of a threat event is based on the risk value of the threat event assessed by a dynamic response algorithm; the risk value corresponds to a high-risk threat or a low-risk threat; if the risk value of the threat event corresponds to a high-risk threat, the security strategy adopted is traffic filtering or intrusion detection; if the risk value of the threat event corresponds to a low-risk threat, the security strategy adopted is alarm notification or log monitoring.

2. The method for implementing an operating system-oriented security agent system according to claim 1, characterized in that: Step S4 includes the following steps: Step S41, data cleaning and standardization: performing data cleaning and standardization on the collected operating system resource data; In step S42, the local agent uses the RAG large language model to perform a preliminary analysis on the resource data of the operating system that has completed data cleaning and standardization, and detects whether there are any threat events in the operating system in the form of a detection task; Step S43: If a threat event exists, the local agent subdivides the detection task into multiple subtasks to further analyze the threat event and obtain analysis results of the multiple subtasks; In step S44, based on the analysis results of the multiple subtasks, the local agent obtains the analysis results of the threat event.

3. The method for implementing an operating system-oriented security agent system according to claim 2, characterized in that: The subtasks include abnormal network traffic analysis, system vulnerability repair suggestion generation, and threat tracing; Abnormal network traffic analysis: The local agent analyzes threat events to determine whether there is persistent malicious traffic or DDoS attacks. System vulnerability repair suggestion generation: If the threat event is a vulnerability, the local agent checks the vulnerability and generates preliminary repair suggestions; Threat tracing: The local agent tracks the origin and propagation path of threat events.

4. The method for implementing an operating system-oriented security agent system according to claim 1, wherein: The calculation formula for the threat risk score is as follows: Threat risk score = a·threat level score + b·impact factor score + c·system load score; Where a is the weight factor for the threat level score, b is the weight factor for the impact factor score, and c is the weight factor for the system load score. The threat level score is determined based on the threat category and threat level of the threat event. The impact factor score is determined based on the potential impact of the threat event on the system resources and services of the operating system. The system load score is determined based on the current load of the operating system. The dynamic response algorithm refers to setting a risk score threshold to distinguish the risk value of threat events. If the threat risk score of a threat event is greater than the risk score threshold, the risk value of the threat event corresponds to a high-risk threat; if the threat risk score of a threat event is less than or equal to the risk score threshold, the risk value of the threat event corresponds to a low-risk threat.

5. The method for implementing an operating system-oriented security agent system according to claim 3, characterized in that: The security agent system also includes a cloud agent; In step S5, if the local agent determines that the threat event cannot be handled, the local agent will request the cloud agent to assist in analysis; The specific steps for cloud agent-assisted analysis are as follows: Threat data upload: The local agent uploads threat event-related data to the cloud agent, which then formats the uploaded threat event-related data in a standardized format. Cloud Agent Analysis: Cloud Agent uses distributed computing resources to analyze threat event-related data in a standardized format. Feedback of cloud threat report: After the cloud agent completes the analysis, it generates a cloud threat report and feeds it back to the local agent.

6. The method for implementing an operating system-oriented security agent system according to claim 1, characterized in that: Also includes step S6; Step S6: The local agent generates a security status summary report, which records the security status and threat events of the operating system.