Safety operation full-process automatic closed-loop method and system driven by safety agent

Abstract

The invention relates to the technical field of network security, in particular to a security operation full-process automatic closed-loop method and system driven by a security agent, and the method comprises the following steps: collecting network behavior data, including network traffic, system logs and user behavior data, from various network devices, security devices and log systems in real time; performing cleaning, denoising and standardization processing on the original data by using a natural language processing technology; the method has the beneficial effects that the full-process automatic closed-loop management from threat detection, analysis, response to feedback is realized by constructing the security agent and combining technologies such as a large language model, artificial intelligence, machine learning, natural language processing (NLP) and the like. The security agent can monitor network behaviors in real time, automatically identify abnormal behaviors, generate security early warning and automatically execute a response strategy, so that the efficiency and accuracy of security operation are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a method and system for full-process automated closed-loop security operation driven by a security agent. Background Art

[0002] With the rapid development of information technology and the increasing complexity of the network environment, network security threats have shown the characteristics of diversification, concealment, and intelligence. Traditional security operation methods mainly rely on manual monitoring and manual response, with problems such as low efficiency, slow response speed, high false alarm rate, and difficulty in dealing with new threats. Especially in a large-scale network environment, the security operation team often faces a huge amount of security events and log data, making it difficult to quickly and accurately identify and handle potential threats.

[0003] To solve these problems, in recent years, the application of artificial intelligence and automation technology in the field of network security has gradually increased. However, most of the existing automated security operation solutions are limited to the automation of a single link, such as threat detection or response execution, lacking full-process automated closed-loop management. In addition, the existing automated solutions often show problems such as insufficient adaptability, high false alarm rate, and single response strategy when facing complex network environments and new threats. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for full-process automated closed-loop security operation driven by a security agent to solve the problems raised in the above background art.

[0005] To achieve the above purpose, the present invention provides the following technical solution: A method for full-process automated closed-loop security operation driven by a security agent, comprising the following steps:

[0006] Collect network behavior data in real time from various network devices, security devices, and log systems, including network traffic, system logs, and user behavior data;

[0007] Use natural language processing technology to clean, denoise, and standardize the original data, specifically:

[0008] Use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0009] For missing values in the text data, use the GPT generation model in NLP to generate content similar to the missing text;

[0010] Use the spelling check tool, grammar check tool, and text cleaning tool in NLP to identify and correct outliers such as spelling mistakes, grammar mistakes, and format mistakes;

[0011] Use the Word2Vec word embedding technique in NLP to map words or phrases into a high-dimensional vector space.

[0012] Preferably, the following steps are also included:

[0013] Conduct context analysis on the processed data, extract key information, including network traffic patterns, user behavior characteristics, system log anomalies, etc., and extract keywords from the text data using TF-IDF or keyword extraction algorithms;

[0014] Design a prompt template, and generate specific prompts according to the extracted keywords and the prompt template;

[0015] Input the prompts into the DeepSeek large model, and use the semantic understanding ability of DeepSeek to extract security-related features from the data;

[0016] Use a feature selection algorithm to screen out the most representative features. DeepSeek can also evaluate the importance of features through interaction with machine learning models and dynamically adjust the feature selection strategy;

[0017] Input the screened features into the DeepSeek large model for threat detection and output the threat detection results;

[0018] For threats with high confidence, generate security warnings and pass the results to subsequent modules. At the same time, feedback the threat detection results to DeepSeek for optimizing the prompt generation algorithm and feature extraction strategy.

[0019] Preferably, the following steps are also included:

[0020] Convert the threat data into a behavior graph model. Each device or user is represented as a node in the graph, and their interactions are represented as edges in the graph. Input the network behavior data into DeepSeek to generate prompts, and DeepSeek generates the structure and initial features of the behavior graph model according to the prompts;

[0021] Extract node features, edge features, local features, and global features from the behavior graph model. Input the behavior graph model into DeepSeek to generate prompts, and DeepSeek extracts more representative features according to the prompts;

[0022] Use a deep learning model to analyze the behavior features. Input the behavior features into DeepSeek to generate prompts, and DeepSeek outputs the behavior pattern recognition results according to the prompts;

[0023] Feed back the behavior analysis results to DeepSeek for optimizing the construction of the behavior graph model, feature extraction, and behavior pattern recognition strategy.

[0024] Preferably, the following steps are further included:

[0025] Match corresponding response strategies according to the threat types and severity levels output by the behavior analysis module;

[0026] Automatically execute the matched response strategies to ensure a response to threats within the shortest time;

[0027] Record the process and results of response execution for subsequent analysis and optimization.

[0028] Preferably, the following steps are further included:

[0029] Collect feedback data on security incidents, including the accuracy of threat detection and the effectiveness of response execution;

[0030] Adjust and optimize the parameters of the threat detection model and behavior analysis model according to the feedback data to improve the accuracy and adaptability of the models;

[0031] Update the response strategies according to the latest threat intelligence and feedback data to ensure that the security agent can respond to the latest threats.

[0032] A system for a fully automated closed-loop method of security operation driven by a security agent, including a data collection module for:

[0033] Collect real-time network behavior data from various network devices, security devices, and log systems, including network traffic, system logs, and user behavior data;

[0034] Use natural language processing technology to clean, denoise, and standardize the original data, specifically:

[0035] Use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0036] For missing values in the text data, use the GPT generation model in NLP to generate content similar to the missing text;

[0037] Use spelling check tools, grammar check tools, and text cleaning tools in NLP to identify and correct outliers such as spelling mistakes, grammar mistakes, and format mistakes;

[0038] Use the Word2Vec word embedding technology in NLP to map words or phrases into a high-dimensional vector space.

[0039] Preferably, it includes a threat detection module for:

[0040] Perform context analysis on the processed data, extract key information, including network traffic patterns, user behavior characteristics, and system log anomalies, and extract keywords from the text data using TF-IDF or keyword extraction algorithms;

[0041] Design prompt templates, and generate specific prompts based on the extracted keywords and prompt templates;

[0042] Input the prompts into the DeepSeek large model, and utilize DeepSeek's semantic understanding ability to extract security-related features from the data;

[0043] Use feature selection algorithms to screen out the most representative features. DeepSeek can also evaluate the importance of features through interaction with machine learning models and dynamically adjust the feature selection strategy;

[0044] Input the screened features into the DeepSeek large model for threat detection and output threat detection results;

[0045] For threats with high confidence, generate security warnings and pass the results to subsequent modules. At the same time, feedback the threat detection results to DeepSeek for optimizing the prompt generation algorithm and feature extraction strategy.

[0046] Preferably, it includes a behavior analysis module for:

[0047] Convert threat data into a behavior graph model. Each device or user is represented as a node in the graph, and their interactions are represented as edges in the graph. Input network behavior data into DeepSeek to generate prompts, and DeepSeek generates the structure and initial features of the behavior graph model according to the prompts;

[0048] Extract node features, edge features, local features, and global features from the behavior graph model. Input the behavior graph model into DeepSeek to generate prompts, and DeepSeek extracts more representative features according to the prompts;

[0049] Use a deep learning model to analyze behavior characteristics. Input the behavior characteristics into DeepSeek to generate prompts, and DeepSeek outputs behavior pattern recognition results according to the prompts;

[0050] Feed back the behavior analysis results to DeepSeek for optimizing the construction of the behavior graph model, feature extraction, and behavior pattern recognition strategy.

[0051] Preferably, it includes a response execution module for:

[0052] Match corresponding response strategies according to the threat types and severity levels output by the behavior analysis module;

[0053] Automatically execute the matching response strategy to ensure a response to threats within the shortest time;

[0054] Record the process and results of response execution for subsequent analysis and optimization.

[0055] Preferably, it includes a feedback optimization module for:

[0056] Collect feedback data on security incidents, including the accuracy of threat detection and the effectiveness of response execution;

[0057] Adjust and optimize the parameters of the threat detection model and the behavior analysis model according to the feedback data to improve the accuracy and adaptability of the models;

[0058] Update the response strategy according to the latest threat intelligence and feedback data to ensure that the security agent can handle the latest threats.

[0059] Compared with the prior art, the beneficial effects of the present invention are:

[0060] The method and system for full-process automated closed-loop security operation driven by a security agent proposed by the present invention realizes full-process automated closed-loop management from threat detection, analysis, response to feedback by constructing a security agent and combining technologies such as large language models, artificial intelligence, machine learning, and natural language processing (NLP). The security agent can monitor network behaviors in real time, automatically identify abnormal behaviors, generate security warnings, and automatically execute response strategies, thus significantly improving the efficiency and accuracy of security operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is the threat detection flowchart of the present invention;

[0062] Figure 2 It is the behavior analysis flowchart of the present invention;

[0063] Figure 3 It is the flowchart of the behavior analysis sub-module of the present invention;

[0064] Figure 4 It is the structural diagram of the security agent module of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0065] In order to clearly and completely describe the objectives, technical solutions of the present invention, and make the advantages more clearly understood, the following further details the embodiments of the present invention with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are some embodiments of the present invention, rather than all embodiments, and are only used to explain the embodiments of the present invention, not to limit the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0066] Example 1, the present invention provides a technical solution: a fully automated closed-loop method for security operation driven by a security agent, comprising the following steps:

[0067] Collect network behavior data in real time from various network devices, security devices, and log systems, including network traffic, system logs, and user behavior data;

[0068] Use natural language processing technology to clean, denoise, and standardize the original data. Specifically: use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data; for missing values in the text data, use the GPT generation model in NLP to generate content similar to the missing text; use the spelling check tool, grammar check tool, and text cleaning tool in NLP to identify and correct outliers such as spelling mistakes, grammar mistakes, and format mistakes; use the Word2Vec word embedding technology in NLP to map words or phrases into a high-dimensional vector space.

[0069] It further includes the following steps: perform context analysis on the processed data, extract key information, including network traffic patterns, user behavior characteristics, system log anomalies, etc., and extract keywords from the text data using TF-IDF or keyword extraction algorithms; design a prompt template, and generate specific prompts according to the extracted keywords and the prompt template; input the prompts into the DeepSeek large model, and use the semantic understanding ability of DeepSeek to extract security-related features from the data; use a feature selection algorithm to screen out the most representative features, and DeepSeek can also evaluate the feature importance through interaction with machine learning models and dynamically adjust the feature selection strategy; input the screened features into the DeepSeek large model for threat detection, and output the threat detection results; for threats with high confidence, generate security warnings and pass the results to subsequent modules, and at the same time feedback the threat detection results to DeepSeek for optimizing the prompt generation algorithm and feature extraction strategy.

[0070] It further includes the following steps: converting threat data into a behavior graph model, where each device or user is represented as a node in the graph, and the interactions between them are represented as edges in the graph; inputting network behavior data into DeepSeek to generate prompt words, and DeepSeek generates the structure and initial features of the behavior graph model according to the prompt words; extracting node features, edge features, local features, and global features from the behavior graph model, inputting the behavior graph model into DeepSeek to generate prompt words, and DeepSeek extracts more representative features according to the prompt words; using a deep learning model to analyze the behavior features, inputting the behavior features into DeepSeek to generate prompt words, and DeepSeek outputs the behavior pattern recognition result according to the prompt words; feeding back the behavior analysis result to DeepSeek for optimizing the construction of the behavior graph model, feature extraction, and behavior pattern recognition strategy.

[0071] It further includes the following steps: matching corresponding response strategies according to the threat types and severities output by the behavior analysis module; automatically executing the matched response strategies to ensure a response to the threat in the shortest time; recording the process and results of the response execution for subsequent analysis and optimization.

[0072] It further includes the following steps: collecting feedback data on security events, including the accuracy of threat detection and the effectiveness of response execution; adjusting and optimizing the parameters of the threat detection model and behavior analysis model according to the feedback data to improve the accuracy and adaptability of the models; updating the response strategies according to the latest threat intelligence and feedback data to ensure that the security agent can handle the latest threats.

[0073] Embodiment 2, based on Embodiment 1, proposes a system for a fully automated closed-loop method for security operation driven by a security agent, including a data collection module, a threat detection module, a behavior analysis module, a response execution module, and a feedback optimization module, as Figure 4 shown.

[0074] 1) Data collection module

[0075] The data collection module is responsible for collecting network behavior data in real time from various network devices, security devices, and log systems, including network traffic, system logs, user behavior data, etc. The data collection module uses NLP technology to clean, denoise, and standardize the raw data to improve the data quality, and the methods are as follows:

[0076] a) Removing duplicate data: Using the Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0077] b) Handling missing values: For missing values in text data, using the GPT generation model in NLP to generate content similar to the missing text;

[0078] c) Handling outliers: Outliers may include spelling mistakes, grammar errors, formatting errors, etc. Spelling check tools, grammar check tools, and text cleaning tools in NLP can identify and correct these outliers;

[0079] d) Text vectorization: Use the Word2Vec word embedding technology in NLP to map words or phrases into a high-dimensional vector space, thus preserving their semantic information.

[0080] 2) Threat Detection Module

[0081] The threat detection module is one of the core decision-making layers of the security agent, responsible for identifying potential threats from the data in the data collection module. This module realizes the intelligent processing of the whole process from feature extraction to threat detection by combining traditional machine learning algorithms and the DeepSeek large model. Traditional machine learning algorithms (such as SVM, random forest, XGBoost, etc.) are used for preliminary feature selection and model training, while the DeepSeek large model further improves the accuracy of feature extraction and the intelligence level of threat detection through its powerful semantic understanding and reasoning ability.

[0082] The main purposes of introducing the DeepSeek large model are:

[0083] a) Improving the accuracy of feature extraction: By generating high-quality prompt words, DeepSeek can extract more representative features from complex network behavior data;

[0084] b) Enhancing the intelligence of threat detection: DeepSeek is not only used for feature extraction but also directly participates in threat detection tasks, using its powerful semantic understanding and reasoning ability to improve the accuracy and adaptability of detection;

[0085] c) Achieving continuous optimization: Through the feedback mechanism, DeepSeek can continuously optimize the prompt word generation algorithm and feature extraction strategy according to the threat detection results to ensure that the system can adapt to new threats.

[0086] By combining the DeepSeek large model with traditional machine learning algorithms, the threat detection module can efficiently and intelligently identify potential threats and generate security warnings, providing strong support for subsequent behavior analysis and response execution.

[0087] a) Data Context Analysis

[0088] Extract key information from the data in the data collection module, including network traffic patterns, user behavior characteristics, system log anomalies, etc.;

[0089] Extract keywords from text data using TF-IDF or keyword extraction algorithms (such as TextRank).

[0090] b) Prompt generation

[0091] Design a set of prompt templates for generating diverse prompts. For example:

[0092] "Analyze the abnormal behavior of {keyword}";

[0093] "Detect potential threats to {keyword}";

[0094] "Identify the attack patterns of {keyword}".

[0095] Generate specific prompts based on the extracted keywords and prompt templates.

[0096] c) The first interaction with DeepSeek: Feature extraction

[0097] Interaction timing: After generating the prompts, input the prompts into the DeepSeek large model;

[0098] Interaction content:

[0099] Input: The generated prompts (such as "Analyze the abnormal behavior of network traffic");

[0100] Output: DeepSeek extracts security-related features from the data according to the prompts (such as time series features of network traffic, traffic peaks, etc.);

[0101] Purpose: Utilize the semantic understanding ability of DeepSeek to extract higher-quality features.

[0102] d) Feature selection

[0103] Use feature selection algorithms (such as PCA, Lasso regression) to screen out the most representative features and reduce the computational complexity of the model;

[0104] DeepSeek can also evaluate the importance of each feature through interaction with machine learning models and dynamically adjust the feature selection strategy;

[0105] e) The second interaction with DeepSeek: Threat detection

[0106] Interaction timing: After feature selection is completed, input the filtered features into the DeepSeek large model for threat detection;

[0107] Interaction content:

[0108] Input: The filtered feature data;

[0109] Output: DeepSeek outputs threat detection results (such as normal, suspicious, malicious, etc.).

[0110] Purpose: Utilize the powerful semantic understanding and reasoning capabilities of DeepSeek to directly conduct threat detection, enhancing the accuracy and intelligence level of detection.

[0111] f) Feedback of threat detection results

[0112] For threats with high confidence, the module will generate security warnings and pass the results to the behavior analysis module for further analysis;

[0113] Meanwhile, the threat detection results are fed back to DeepSeek for optimizing the prompt word generation algorithm and feature extraction strategy.

[0114] 3) Behavior analysis module

[0115] The behavior analysis module is the high-level decision-making layer of the security agent, responsible for deeply analyzing the detected threats, identifying the attacker's behavior patterns, attack paths, and intentions. By introducing the DeepSeek large model, the module can more intelligently construct a behavior graph model, extract behavior features, and identify abnormal behavior patterns. DeepSeek is not only used for feature extraction but also helps optimize the behavior analysis strategy through its powerful semantic understanding ability, enhancing the accuracy and intelligence level of analysis.

[0116] a) Constructing the behavior graph model

[0117] Convert the threat data into a behavior graph model, where each device or user is represented as a node in the graph, and the interactions between them are represented as edges in the graph.

[0118] The first interaction with DeepSeek: Input the network behavior data into DeepSeek to generate prompt words (such as "constructing the behavior graph model"), and DeepSeek generates the structure and initial features of the behavior graph model according to the prompt words.

[0119] b) Extracting behavior features

[0120] Extract node features, edge features, local features, and global features from the behavior graph model for further analysis.

[0121] The second interaction with DeepSeek: Input the behavior graph model into DeepSeek to generate prompt words (such as "extracting node features"), and DeepSeek extracts more representative features according to the prompt words.

[0122] c) Behavior pattern recognition

[0123] Analyze behavioral characteristics using deep learning models (such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), etc.) to identify abnormal behavior patterns and potential threats.

[0124] The third interaction with DeepSeek: Input the behavioral characteristics into DeepSeek to generate prompt words (such as "Identify abnormal behavior patterns"), and DeepSeek outputs the behavioral pattern recognition results according to the prompt words.

[0125] d) Feedback of behavioral analysis results

[0126] Feed back the behavioral analysis results to DeepSeek for optimizing the construction of the behavior graph model, feature extraction, and behavioral pattern recognition strategies.

[0127] 4) Response execution module

[0128] The response execution module automatically executes predefined response strategies according to the output of the behavioral analysis module. Response strategies can include blocking malicious traffic, isolating infected devices, notifying security administrators, etc. The specific steps are as follows:

[0129] a) Strategy matching: Match corresponding response strategies according to the type and severity of the threat;

[0130] b) Automatic execution: Automatically execute the matched response strategies to ensure a response to the threat in the shortest possible time;

[0131] c) Log recording: Record the process and results of response execution for subsequent analysis and optimization.

[0132] 5) Feedback optimization module

[0133] The feedback optimization module continuously optimizes the performance of the security agent by continuously collecting and analyzing feedback data on security events. The specific steps are as follows:

[0134] a) Feedback data collection: Collect feedback data on security events, including the accuracy of threat detection, the effectiveness of response execution, etc.;

[0135] b) Model optimization: Adjust and optimize the parameters of the threat detection model and behavioral analysis model according to the feedback data to improve the accuracy and adaptability of the model;

[0136] c) Strategy update: Update the response strategies according to the latest threat intelligence and feedback data to ensure that the security agent can handle the latest threats.

[0137] Although embodiments of the present invention have been shown and described, those of ordinary skill in the art will appreciate that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for full-process automated closed-loop security operation driven by a security agent, characterized in that: It includes the following steps: Collect network behavior data in real time from various network devices, security devices, and log systems, including network traffic, system logs, and user behavior data; Use natural language processing techniques to clean, denoise, and standardize the original data. Specifically: Use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data; For missing values in the text data, use the GPT generation model in NLP to generate content similar to the missing text; Use spelling check tools, grammar check tools, and text cleaning tools in NLP to identify and correct outliers such as spelling mistakes, grammar mistakes, and format errors; Use the Word2Vec word embedding technique in NLP to map words or phrases into a high-dimensional vector space.

2. The safety operation full-process automation closed-loop method driven by a safety agent according to claim 1, wherein: It also includes the following steps: Conduct context analysis on the processed data, extract key information, including network traffic patterns, user behavior characteristics, system log anomalies, etc., and use the TF-IDF or keyword extraction algorithm to extract keywords from the text data; Design a prompt template and generate specific prompts based on the extracted keywords and the prompt template; Input the prompts into the DeepSeek large model and use the semantic understanding ability of DeepSeek to extract security-related features from the data; Use a feature selection algorithm to screen out the most representative features. DeepSeek can also evaluate the importance of features through interaction with machine learning models and dynamically adjust the feature selection strategy; Input the screened features into the DeepSeek large model for threat detection and output the threat detection results; For threats with high confidence, generate security warnings and pass the results to subsequent modules. At the same time, feedback the threat detection results to DeepSeek for optimizing the prompt generation algorithm and feature extraction strategy.

3. A method for full-process automated closed-loop security operation driven by a security intelligent agent according to claim 2, characterized in that: It also includes the following steps: Convert the threat data into a behavior graph model. Each device or user is represented as a node in the graph, and their interactions are represented as edges in the graph. Input the network behavior data into DeepSeek to generate prompts, and DeepSeek generates the structure and initial features of the behavior graph model according to the prompts; Extract node features, edge features, local features, and global features from the behavior graph model. Input the behavior graph model into DeepSeek to generate prompts, and DeepSeek extracts more representative features according to the prompts; Use a deep learning model to analyze the behavior features. Input the behavior features into DeepSeek to generate prompts, and DeepSeek outputs the behavior pattern recognition results according to the prompts; Feed back the behavior analysis results to DeepSeek for optimizing the behavior graph model construction, feature extraction, and behavior pattern recognition strategies.

4. A fully automated closed-loop method for security operation driven by a security agent according to claim 3, characterized in that: It also includes the following steps: According to the threat types and severity levels output by the behavior analysis module, match corresponding response strategies; Automatically execute the matched response strategies to ensure a response to threats in the shortest time; Record the process and results of the response execution for subsequent analysis and optimization.

5. A fully automated closed-loop method for security operation driven by a security agent according to claim 4, characterized in that: It also includes the following steps: Collect feedback data on security incidents, including the accuracy of threat detection and the effectiveness of response execution; Adjust and optimize the parameters of the threat detection model and behavior analysis model based on the feedback data to improve the accuracy and adaptability of the models; Update the response strategy according to the latest threat intelligence and feedback data to ensure that the security agent can handle the latest threats.

6. A system for the method of fully automated closed-loop security operation driven by a security agent according to claim 5, characterized in that: Include a data collection module for: Real-time collect network behavior data from various network devices, security devices, and log systems, including network traffic, system logs, and user behavior data; Use natural language processing techniques to clean, denoise, and standardize the raw data, specifically: Use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data; For missing values in the text data, use the GPT generation model in NLP to generate content similar to the missing text; Use spelling check tools, grammar check tools, and text cleaning tools in NLP to identify and correct outliers such as spelling mistakes, grammar mistakes, and format errors; Use the Word2Vec word embedding technique in NLP to map words or phrases into a high-dimensional vector space.

7. A system according to claim 6, characterized in that: Include a threat detection module for: Conduct context analysis on the processed data to extract key information, including network traffic patterns, user behavior characteristics, and system log anomalies, and use the TF-IDF or keyword extraction algorithm to extract keywords from the text data; Design a prompt template and generate specific prompts based on the extracted keywords and the prompt template; Input the prompts into the DeepSeek large model and use the semantic understanding ability of DeepSeek to extract security-related features from the data; Use a feature selection algorithm to screen out the most representative features. DeepSeek can also evaluate the importance of features through interaction with machine learning models and dynamically adjust the feature selection strategy; Input the screened features into the DeepSeek large model for threat detection and output the threat detection results; For threats with high confidence, generate security warnings and pass the results to subsequent modules. At the same time, feedback the threat detection results to DeepSeek for optimizing the prompt generation algorithm and feature extraction strategy.

8. A system according to claim 6, characterized in that: Include a behavior analysis module for: Convert the threat data into a behavior graph model, where each device or user is represented as a node in the graph, and their interactions are represented as edges in the graph. Input the network behavior data into DeepSeek to generate prompts, and DeepSeek generates the structure and initial features of the behavior graph model according to the prompts; Extract node features, edge features, local features, and global features from the behavior graph model. Input the behavior graph model into DeepSeek to generate prompts, and DeepSeek extracts more representative features according to the prompts; Use a deep learning model to analyze the behavior features. Input the behavior features into DeepSeek to generate prompts, and DeepSeek outputs the behavior pattern recognition results according to the prompts; Feedback the behavior analysis results to DeepSeek for optimizing the behavior graph model construction, feature extraction, and behavior pattern recognition strategies.

9. A system according to claim 6, characterized in that: It includes a response execution module for: Based on the threat types and severities output by the behavior analysis module, matching corresponding response strategies; Automatically executing the matched response strategies to ensure a response to threats within the shortest time; Recording the process and results of response execution for subsequent analysis and optimization.

10. A system according to claim 6, characterized in that: It includes a feedback optimization module for: Collecting feedback data on security incidents, including the accuracy of threat detection and the effectiveness of response execution; According to the feedback data, adjusting and optimizing the parameters of the threat detection model and the behavior analysis model to improve the accuracy and adaptability of the models; Updating the response strategies based on the latest threat intelligence and feedback data to ensure that the security agent can cope with the latest threats.

Images