Cooperative scheduling method based on security agent

Abstract

The invention discloses a collaborative scheduling method based on a security agent, and relates to the technical field of network security design. The specific operation of the security agent collaborative scheduling method comprises the steps of system deployment and initialization, security operation task execution process, agent self-learning and capability evolution implementation, cross-domain security agent collaborative adaptation implementation and security operation visualization and traceability implementation. Connection paths between the security agent and business data, a private knowledge base, a security tool and multiple models are broken through, the problem that all elements in a traditional mode lack efficient communication and collaboration is solved, and by means of agent routing dynamic scheduling, A2A protocol interaction, MCP protocol tool calling, RAG business interface calling and multi-model combination, the security of the security agent is improved. Integration and intellectualization of the safety operation process are achieved, the continuity and the response speed of the operation process are improved, safety operation is more efficient and collaborative, and complex and variable safety requirements are met.

Description

Technical Field

[0001] The present invention relates to the field of network security design technology, and in particular to a collaborative scheduling method based on security intelligent agents. Background Art

[0002] In the field of network security and data security operations, traditional security operation models have many drawbacks. On the one hand, there is a lack of efficient connectivity and collaboration between security agents, business data, private knowledge bases, security tools and multiple models, resulting in decentralized security operation processes and delayed responses. On the other hand, there is a lack of unified specifications for security tool calls, and business interface calls are easily affected by the number of tools and model capabilities, resulting in hallucination problems. In addition, the capabilities of different agents are not supported by accurately adapted models, making it difficult to meet the complex and changing security operation needs. An innovative collaborative scheduling method is urgently needed to break through the bottleneck. To this end, we propose a collaborative scheduling method based on security agents. Summary of the Invention

[0003] The purpose of the present invention is to provide a collaborative scheduling method based on security agents.

[0004] To achieve the above-mentioned objectives, the present invention provides the following technical solutions: a method based on collaborative scheduling of security intelligent agents, the specific operations of the collaborative scheduling method of security intelligent agents include system deployment and initialization, security operation task execution process, agent self-learning and capability evolution implementation, cross-domain security intelligent agent collaborative adaptation implementation and security operation visualization and traceability implementation, the agent self-learning and capability evolution implementation includes data collection, reinforcement learning training, capability evaluation and optimization triggering, the cross-domain security intelligent agent collaborative adaptation implementation includes cross-domain scenario analysis and strategy adjustment, and cross-domain knowledge mapping and conversion, the security operation visualization and traceability implementation includes visualization platform construction and data display, and traceability system construction and application.

[0005] As a further solution of the present invention: the system deployment and initialization include agent and server deployment, protocol and rule configuration, and model adaptation initialization. The agent and server deployment is to deploy Orchestrator Agent, Data Agent, Tool Agent, File Agent, Detect Agent, Default Agent and Audit Agent agent services in the security operation server group, and at the same time deploy MCP Server, business interface knowledge base service and multi-model service. The multi-model service includes a general model, an inference model and a vertical domain model, configure the network connection parameters of each service, and interconnect the networks between agents and between agents and services. The protocol and rule configuration is to configure A2A protocol communication parameters in OrchestratorAgent and each functional Agent, and set the interactive message format, communication port and identity authentication method. At the same time, configure MCP protocol parameters in Tool Agent and Data Agent, including MCP Server address, tool call interface specification and parameter verification rules, initialize the business interface knowledge base, and enter the initial tool description based on the MCP protocol and business data interface information.

[0006] As a further solution of the present invention: the model adaptation initialization is based on the capability requirements of each Agent, adapting a general model with semantic understanding capabilities to the Orchestrator Agent, adapting a vertical domain model that excels in threat detection to the Detect Agent, including a dedicated model for network security threat detection, and adapting an inference model for business data processing to the Data Agent. Using the model call interface test, each Agent is stably connected to the corresponding model and called normally.

[0007] As a further solution of the present invention: the security operation task execution process includes user problem access and semantic interpretation, dynamic scheduling and interaction of intelligent agents, security tool call and data acquisition, and result aggregation and presentation. The user problem access and semantic interpretation is when the user submits a problem using the security operation platform, the Orchestrator Agent receives the problem request, and uses the adapted general model to perform semantic understanding, parse the specific content of the user's needs and the type of security operation tasks involved. The dynamic scheduling and interaction of intelligent agents is that the Orchestrator Agent uses the A2A protocol to dynamically select the required Agent based on the semantic understanding results, and sends the task parameters to the corresponding Agent.

[0008] As a further solution of the present invention, the security tool call and data acquisition process involves the Tool Agent and DataAgent calling security tools according to their respective MCP Servers during task execution. When the Data Agent acquires business data, based on the RAG concept, it retrieves the adapter tool description from the business interface knowledge base, generates the MCP protocol content and request parameters with the help of a large model, and sends them to the MCP Server to call the corresponding business data interface to obtain data. When the Tool Agent needs to block a malicious IP address, it uses the MCP Server to call the blocking tool to perform a disposal operation and return the execution result. The result aggregation and presentation process involves each Agent returning the result to the Orchestrator Agent after completing the task. The Orchestrator Agent aggregates and integrates the execution results of each Agent, summarizes and reviews them using the model, and presents clear results to the user, allowing the user to view the detailed task execution process and data.

[0009] As a further solution of the present invention: the data collection is that each agent automatically collects task input and output data, user feedback and tool call log information after task execution, and stores them in a self-learning data warehouse. The reinforcement learning training is to regularly start the reinforcement learning training process, extract data from the self-learning data warehouse, construct training samples, take the accuracy and efficiency of agent task execution as optimization goals, use the deep Q network algorithm to train the agent decision model, and adjust the intelligent agent task processing logic.

[0010] As a further solution of the present invention: the capability assessment and optimization trigger is based on the capability assessment model, using multi-dimensional indicators to quantitatively score the agent's capabilities. If the score is lower than the set threshold, the model re-adaptation and knowledge supplement process are executed according to the assessment result.

[0011] As a further solution of the present invention: the cross-domain scenario analysis and strategy adjustment is a cross-domain collaborative adaptation module that monitors the switching of security operation scenarios in real time, analyzes the security requirements of different scenarios, and automatically adjusts the intelligent agent collaborative scheduling strategy, tool call priority and model adaptation rules based on the scenario requirements. The cross-domain knowledge mapping and conversion is when the intelligent agent performs tasks across domains. The cross-domain security knowledge mapping library converts the general security knowledge carried by the intelligent agent into target domain adaptation knowledge based on the differences in the source domain and target domain knowledge systems, and injects the converted knowledge into the intelligent agent according to the API interface, so that the intelligent agent can accurately understand the task and call the tool in the target domain.

[0012] As a further solution of the present invention: the construction and data display of the visualization platform is to use front-end visualization technology to build a security operation visualization platform, establish data connection with the Orchestrator Agent and various services, obtain real-time intelligent collaborative scheduling process data, task execution status and threat analysis results, and display them in a graphical interface. Operations personnel use the Dashboard to monitor the overall security operation and quickly locate key tasks and abnormal situations. The traceability system is constructed and applied to generate a unique traceability ID for each security operation task. During the task execution process, the traceability system records the basis for intelligent scheduling decisions, tool call parameters, model usage and data interaction content according to the log collection module. When the problem needs to be traced back, the traceability ID is entered and the full process log is retrieved according to the traceability query interface to assist operations personnel in analyzing the cause of the problem and optimize the security operation strategy based on the traceability data.

[0013] By adopting the above technical solution, compared with the prior art, the beneficial effects of the present invention are:

[0014] 1. This invention builds a multi-agent collaboration system to connect security agents with business data, private knowledge bases, security tools, and multiple models, solving the problem of lack of efficient connectivity and collaboration among various elements in the traditional model. By leveraging dynamic routing scheduling of agents, A2A protocol interaction, MCP protocol tool calls, RAG business interface calls, and multi-model combinations, it achieves the integration and intelligence of security operation processes, improves the consistency and response speed of operation processes, makes security operations more efficient and collaborative, and adapts to complex and changing security needs.

[0015] 2. This invention uses the self-learning and capability evolution mechanism of intelligent agents. Each agent automatically collects task data and conducts reinforcement learning training. Combined with the dynamic optimization of the capability assessment model, the intelligent agent can continuously learn and iterate. When responding to new threats, it can autonomously evolve its detection and response capabilities. This breaks through the limitations of the traditional model of fixed intelligent agent capabilities and difficulty in adapting to new scenarios, ensuring that security operations capabilities continue to improve as threats evolve.

[0016] 3. The present invention uses a cross-domain security intelligent collaborative adaptation module and a knowledge mapping library to dynamically adjust collaborative strategies and knowledge adaptation based on the differences in different industries and network domain scenarios, thereby solving the problems of demand mismatch and difficult knowledge adaptation in cross-domain security operations, allowing intelligent agents to operate accurately in different scenarios such as finance and industrial control, broadening the scope of application of security operations and enhancing security protection effectiveness in multiple scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of the collaborative scheduling method in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0019] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0020] Please see the attached Figure 1 The present invention provides a collaborative scheduling method based on security intelligent agents. The specific operations of the collaborative scheduling method for security intelligent agents include system deployment and initialization, security operation task execution process, intelligent agent self-learning and capability evolution implementation, cross-domain security intelligent agent collaborative adaptation implementation, and security operation visualization and traceability implementation. The intelligent agent self-learning and capability evolution implementation includes data collection, reinforcement learning training, capability evaluation and optimization triggering. The cross-domain security intelligent agent collaborative adaptation implementation includes cross-domain scenario analysis and strategy adjustment, as well as cross-domain knowledge mapping and conversion. The security operation visualization and traceability implementation includes visualization platform construction and data display, as well as traceability system construction and application.

[0021] In one embodiment of the present invention: system deployment and initialization include agent and server deployment, protocol and rule configuration, and model adaptation initialization. Agent and server deployment is to deploy Orchestrator Agent, Data Agent, Tool Agent, File Agent, Detect Agent, DefaultAgent and Audit Agent agent services in the security operation server group respectively, and to deploy MCP Server, business interface knowledge base service and multi-model service at the same time. Multi-model service includes general model, reasoning model and vertical domain model, configure network connection parameters of each service, and interconnect the network between agents and between agents and services. Protocol and rule configuration is to configure A2A protocol communication parameters in Orchestrator Agent and each functional Agent, and set the interactive message format, communication port and identity authentication method. At the same time, configure MCP protocol parameters in Tool Agent and Data Agent, including MCP Server address, tool call interface specification and parameter verification rules, initialize the business interface knowledge base, and enter the initial tool description based on MCP protocol and business data interface information.

[0022] In one embodiment of the present invention: model adaptation initialization is based on the capability requirements of each Agent, adapting a general model with semantic understanding capabilities to the Orchestrator Agent, adapting a vertical domain model that excels in threat detection to the Detect Agent, including a dedicated model for network security threat detection, and adapting an inference model for business data processing to the Data Agent. Using the model call interface test, each Agent is stably connected to the corresponding model and can be called normally.

[0023] In one embodiment of the present invention: the security operation task execution process includes user problem access and semantic interpretation, dynamic scheduling and interaction of intelligent agents, security tool call and data acquisition, and result aggregation and presentation. User problem access and semantic interpretation is when the user submits a problem using the security operation platform, the Orchestrator Agent receives the problem request, and uses the adapted general model to perform semantic understanding, analyze the specific content of the user's needs and the type of security operation tasks involved. The dynamic scheduling and interaction of intelligent agents is that the Orchestrator Agent uses the A2A protocol to dynamically select the required Agent based on the semantic understanding results, and sends the task parameters to the corresponding Agent.

[0024] In one embodiment of the present invention, security tool invocation and data acquisition involve Tool Agents and Data Agents invoking security tools based on their respective MCP Servers during task execution. When the Data Agent acquires business data, it retrieves the adapter tool description from the business interface knowledge base based on the RAG concept, generates the MCP protocol content and request parameters with the help of a large model, and sends them to the MCP Server to invoke the corresponding business data interface to acquire data. When the Tool Agent needs to block a malicious IP address, it uses the MCP Server to call the blocking tool to perform a disposal operation and return the execution result. Result aggregation and presentation involve each Agent completing a task and returning the result to the Orchestrator Agent. The Orchestrator Agent aggregates and integrates the execution results of each Agent, summarizes and reviews them using the model, and presents clear results to the user, allowing the user to view the detailed task execution process and data.

[0025] In one embodiment of the present invention, data collection involves automatically collecting task input and output data, user feedback, and tool call log information after each agent executes a task, and storing the data in a self-learning data warehouse. Reinforcement learning training involves regularly initiating a reinforcement learning training process, extracting data from the self-learning data warehouse, and constructing training samples. With the accuracy and efficiency of agent task execution as optimization goals, a deep Q-network algorithm is used to train the agent decision model and adjust the agent's task processing logic.

[0026] In one embodiment of the present invention, capability assessment and optimization triggering is based on the capability assessment model, using multi-dimensional indicators to quantitatively score the agent's capabilities. If the score is lower than the set threshold, the model re-adaptation and knowledge supplementation process are executed according to the assessment results.

[0027] In one embodiment of the present invention: cross-domain scenario analysis and strategy adjustment is a cross-domain collaborative adaptation module that monitors the switching of security operation scenarios in real time, analyzes the security requirements of different scenarios, and automatically adjusts the intelligent agent collaborative scheduling strategy, tool call priority and model adaptation rules based on the scenario requirements. Cross-domain knowledge mapping and conversion is when the intelligent agent performs tasks across domains. The cross-domain security knowledge mapping library converts the general security knowledge carried by the intelligent agent into target domain adaptation knowledge based on the differences in the knowledge systems of the source domain and the target domain, and injects the converted knowledge into the intelligent agent according to the API interface, so that the intelligent agent can accurately understand the task and call the tool in the target domain.

[0028] In one embodiment of the present invention: the construction of a visualization platform and data display is to use front-end visualization technology to build a security operation visualization platform, establish data connections with the Orchestrator Agent and various services, obtain real-time intelligent collaborative scheduling process data, task execution status and threat analysis results, and display them in a graphical interface. Operations personnel use the Dashboard to monitor the overall security operation and quickly locate key tasks and abnormal situations. The traceability system is constructed and applied to generate a unique traceability ID for each security operation task. During the task execution process, the traceability system records the basis for intelligent scheduling decisions, tool call parameters, model usage and data interaction content according to the log collection module. When the problem needs to be traced back, the traceability ID is entered and the full process log is retrieved according to the traceability query interface to assist operations personnel in analyzing the cause of the problem and optimizing the security operation strategy based on the traceability data.

[0029] In one embodiment of the present invention, during the dynamic scheduling and interaction of intelligent agents, if a complex task requires collaboration among multiple agents, the Data Agent first queries the business data, and then the Tool Agent combines the data to handle threats. The Orchestrator Agent schedules each agent in turn, and the agents exchange intermediate task results in real time through the A2A protocol.

[0030] In one embodiment of the present invention: During the data collection process, the Detect Agent records the characteristic data, detection results and subsequent manual review feedback of each attack detection. During the reinforcement learning training, the model is re-adapted by selecting a better model replacement from the model library, and the knowledge is supplemented by pulling the corresponding security knowledge from the private knowledge library and updating the intelligence from the external threat intelligence platform.

[0031] The Orchestrator Agent, as the core hub of agent scheduling, is responsible for receiving the system's overall scheduling tasks and instructions. It then decomposes and assigns complex tasks to appropriate functional agents based on the status, capabilities, and task priorities of each agent.

[0032] The Data Agent intelligent body focuses on data-related work and is responsible for data collection, cleaning, storage and management;

[0033] The Tool Agent is responsible for calling and managing tools and interacting with various tools.

[0034] The File Agent is responsible for file management, including uploading, downloading, storing, retrieving, and transmitting files.

[0035] The Detect Agent focuses on system monitoring and detection, and monitors the operating status of the agent, server, and the entire collaborative scheduling system in real time.

[0036] The Default Agent agent is the default processing agent of the system and is used to handle tasks or abnormal situations that are not explicitly designated to be handled by other specific agents.

[0037] The Audit Agent is responsible for the audit and supervision of the system, and conducts a comprehensive audit of the agent's operational behavior, task execution process, and data processing flow;

[0038] The MCP Server intelligent agent serves as the core server of the MCP protocol in the system, providing MCP protocol-based communication and service support for Tool Agent, Data Agent, etc.

[0039] Implementation Cases

[0040] 1. Hardware and service deployment:

[0041] In the security operations center of a financial enterprise, three Dell PowerEdge R750 servers (configured with two Intel Xeon Platinum 8369B 2.7GHz CPUs, 256GB of memory, and 4TB of NVMe hard drives) were deployed. Two eight-card L40 GPU servers were also deployed. A 10G switch was used to build a local area network, and the servers were deployed separately.

[0042] Intelligent agent services: Orchestrator Agent (main scheduling), Data Agent (data processing), Tool Agent (tool execution), Detect Agent (threat detection), Audit Agent (audit verification);

[0043] Support services: MCP Server (tool call middleware), business interface knowledge base (built on Elasticsearch), multi-model services, including the general large model Qwen-3-70B, the inference model DeepSeek-R1-7B, the vertical domain model 360 Security Large Model (40B), and the threat detection model;

[0044] Network configuration: Open the communication port between agents through the firewall and configure NAT rules to achieve secure communication between agents and external threat intelligence platforms;

[0045] Protocol and rule configuration:

[0046] A2A protocol (agent interaction):

[0047] Message format: JSON, including agent_id (sender ID), target_id (receiver ID), task_type (task type), and content (task content);

[0048] MCP protocol (tool call):

[0049] Configure the MCP Server address http: / / 192.168.1.200:8080 in the Tool Agent and define the tool call parameter verification rules;

[0050] Initialize the knowledge base: Enter descriptions of 50+ tools, including "Threat Intelligence Query Tool" and "Firewall Blocking Tool";

[0051] Model adaptation:

[0052] Orchestrator Agent: Adapts the Qwen-3-70B model for semantic parsing of user questions, with a parsing accuracy of 95%;

[0053] Detect Agent: Utilizes the 360 Security Big Model to train against common phishing attacks and data leakage features in the financial industry.

[0054] Data Agent: Uses the DeepSeek-R1-7B inference model to perform anomaly correlation analysis on business data, with processing speed 40% faster than traditional SQL queries;

[0055] 2. Security Operation Task Execution Process:

[0056] User question access and semantic analysis:

[0057] Scenario: An operator submits a task through the platform: "Check whether the IP address 185.153.198.78 that has frequently accessed the trading system recently is malicious, and block the suspicious IP address."

[0058] Orchestrator Agent processes:

[0059] Use the Qwen-3-70B model to analyze the problem and identify key information:

[0060] Main tasks: Threat monitoring (IP: 185.153.198.78) + disposal (banning suspicious IP);

[0061] Implicit requirement: Need to query the historical access log of the IP (call Data Agent);

[0062] Generate a task chain: Data Agent query log → Detect Agent threat detection → Tool Agent execution ban;

[0063] Dynamic scheduling and interaction of intelligent agents:

[0064] Step 1: Data Agent query log:

[0065] The Orchestrator Agent sends a task to the Data Agent through the A2A protocol: "Query the transaction system access log for IP 185.153.198.78 between October 1 and October 7, 2024."

[0066] The Data Agent calls the MCP Server and uses the Business Log Query Tool to obtain log data, which contains 120 access records and 80 attempts to access sensitive interfaces. The results are then returned to the Orchestrator Agent.

[0067] Step 2: Detect Agent Threat Detection:

[0068] The Orchestrator Agent forwards the log data to the Detect Agent, triggering 360 Security Big Model analysis:

[0069] The IP address was found to be associated with known phishing infrastructure, and the access behavior was consistent with brute force attack patterns (success rate <5%, attempt frequency >10 attempts / minute);

[0070] The Detect Agent returns the result: "IP 185.153.198.78 is malicious, risk level: high";

[0071] Step 3: Tool Agent executes the ban:

[0072] The Orchestrator Agent sends a blocking command to the Tool Agent: "Block IP 185.153.198.78 for 24 hours";

[0073] The Tool Agent calls the "Firewall Blocking Tool" and sends a command to the Fortinet firewall through the MCP protocol, which returns "Operation successful, rule ID: FW-20241008-001";

[0074] Results summary and presentation:

[0075] The Orchestrator Agent pushes the detection report (including IP risk details, log analysis, and disposal records) to the operations personnel in the form of visual charts and generates a closed-loop task record on the platform. The report content includes:

[0076] C2 domain associated with the malicious IP: phish-finance[.]com;

[0077] Attack type: credential theft attack;

[0078] Disposal time: 2024-10-08 14:30:00;

[0079] 3. Self-Learning and Ability Evolution of Intelligent Agents

[0080] Data Collection:

[0081] After the task is completed, the Detect Agent automatically collects:

[0082] Input data: IP to be detected, log data, model input parameters;

[0083] Output data: detection results, threat characteristics (such as C2 domain name, attack mode);

[0084] Feedback data: Operation personnel confirm the labeling information of "accurate detection";

[0085] The above data is stored in the self-learning data warehouse (a distributed storage system built based on Hive);

[0086] Reinforcement Learning Training:

[0087] Automatically trigger the training process every week:

[0088] Sample construction: Extract 1,000 historical detection records from the data warehouse, including 50 new attack samples, and label them as "normal" or "malicious";

[0089] Model training: Using the deep reinforcement learning framework Stable Baseline 3, we iteratively trained the Detect Agent's decision model, optimizing detection accuracy (target > 99%) and response time (target < 3 seconds).

[0090] Effectiveness verification: In a test environment, the trained model's detection rate for new phishing attacks increased from 85% to 92%.

[0091] Capacity Assessment and Optimization:

[0092] Detect Agent is scored monthly using the evaluation model:

[0093] Indicators: 99% mission success rate, 0.5% false alarm rate, 2.8 seconds average response time, and a comprehensive score of 95 out of 100.

[0094] Optimization trigger: If the false alarm rate is greater than 1%, the new version of the 360 Security Big Model will be automatically loaded from the model library, and the latest phishing domain name list will be synchronized from the external intelligence platform;

[0095] 4. Cross-domain collaborative adaptation (office network → industrial network scenario):

[0096] Scenario switching and strategy adjustment:

[0097] When the agent switches from the office network to the industrial control network:

[0098] Cross-domain module detection: The industrial protocol analysis tool Tofino identified that Modbus protocol traffic accounted for more than 90%, determining that this was an industrial network scenario.

[0099] Strategy adjustments:

[0100] Prioritize the scheduling of Industrial Protocol Agent (supporting Modbus protocol parsing);

[0101] Replacement model: Use the industrial network-specific vertical domain model to detect abnormal communication of PLC devices with an accuracy rate of 96%;

[0102] Tool priority: Call the industrial firewall tool Claroty instead of the general firewall;

[0103] Knowledge Mapping and Transformation:

[0104] Source domain knowledge: "Abnormal port scanning" in the office network corresponds to TCP / UDP port anomalies;

[0105] Target domain mapping: Converted to "Modbus function code exception" in the industrial network, including illegal 0x06 register write operation;

[0106] Implementation: Convert general detection rules into industrial protocol detection rules through a knowledge mapping library written based on a rule engine and inject them into the Detect Agent.

[0107] Visualization and traceability:

[0108] Visualization Platform:

[0109] Use Grafana to build a dashboard for real-time display:

[0110] Agent scheduling link: Orchestrator Agent→Data Agent→Detect Agent→ToolAgent task flow timeline;

[0111] Threat Trends: Malicious IP distribution and attack type percentages over the past seven days, with phishing attacks accounting for 45% and vulnerability exploits accounting for 30%;

[0112] Tool call statistics: MCP Server is called over 500 times per day, with a success rate of 99.2%;

[0113] Traceability system:

[0114] Task ID: SEC-20241008-007;

[0115] Traceability data:

[0116] Semantic parsing log: Qwen-3-70B model's recognition of the intent to "ban suspicious IP addresses";

[0117] Tool call log: parameters and response messages of the firewall tool called by the Tool Agent;

[0118] Model output log: Detect Agent identifies the feature matching details of malicious IP addresses;

[0119] Application scenario: When operators question a misjudgment of a ban, they can use the traceability system to locate that the detection model mistakenly identified normal industrial protocol communications as malicious, and adjust the model parameters in a timely manner.

[0120] Implementation effect:

[0121] Improved efficiency: Threat response time is reduced from 30 minutes for manual processing to within 5 minutes;

[0122] Improved accuracy: The false positive rate of malicious detection has been reduced from 3% to 0.8%, and the false negative rate has been reduced from 2% to 0.5%;

[0123] Cross-domain support: In industrial network scenarios, intelligent agents can automatically adapt without manual configuration, with a task execution accuracy of 94%;

[0124] Traceability: The storage period of the entire process log is ≥ 6 months, meeting the compliance requirements of Information Security Technology 2.0.

[0125] Through the complete system deployment, task execution, agent evolution, cross-domain adaptation and visual traceability of the above embodiments, the effectiveness and scalability of the secure agent-based collaborative scheduling method in a complex network environment have been verified.

[0126] Although the present invention is disclosed above with reference to preferred embodiments, this is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent variations, and modifications made to the above embodiments in accordance with the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection defined by the claims of the present invention.

Claims

1. A collaborative scheduling method based on secure agents, characterized by: The specific operations of the security intelligent agent collaborative scheduling method include system deployment and initialization, security operation task execution process, intelligent agent self-learning and capability evolution implementation, cross-domain security intelligent agent collaborative adaptation implementation, and security operation visualization and traceability implementation. The intelligent agent self-learning and capability evolution implementation includes data collection, reinforcement learning training, capability evaluation and optimization triggering. The cross-domain security intelligent agent collaborative adaptation implementation includes cross-domain scenario analysis and strategy adjustment, as well as cross-domain knowledge mapping and conversion. The security operation visualization and traceability implementation includes visualization platform construction and data display, as well as traceability system construction and application.

2. The method for collaborative scheduling based on secure agents according to claim 1, characterized in that: The system deployment and initialization include agent and server deployment, protocol and rule configuration, and model adaptation initialization. The agent and server deployment is to deploy Orchestrator Agent, Data Agent, ToolAgent, File Agent, Detect Agent, Default Agent and Audit Agent agent services in the security operation server group, and deploy MCP Server, business interface knowledge base service and multi-model service at the same time. Multi-model service includes general model, reasoning model and vertical domain model, configure each service network connection parameter, and interconnect the network between agents and between agents and services. The protocol and rule configuration is to configure A2A protocol communication parameters in Orchestrator Agent and each functional agent, and set the interactive message format, communication port and identity authentication method. At the same time, configure MCP protocol parameters in Tool Agent and Data Agent, including MCP Server address, tool call interface specification and parameter verification rules, initialize the business interface knowledge base, and enter the initial tool description and business data interface information based on the MCP protocol.

3. The method for collaborative scheduling based on secure agents according to claim 2, characterized in that: The model adaptation initialization is based on the capability requirements of each agent. It adapts the general model with semantic understanding capabilities to the Orchestrator Agent, adapts the vertical domain model that excels in threat detection to the Detect Agent, including a dedicated model for network security threat detection, and adapts the reasoning model for business data processing to the Data Agent. The model call interface test is used to stably connect each agent with the corresponding model and call it normally.

4. The method for collaborative scheduling based on secure agents according to claim 3, characterized in that: The security operation task execution process includes user problem access and semantic interpretation, dynamic scheduling and interaction of intelligent agents, security tool call and data acquisition, and result aggregation and presentation. The user problem access and semantic interpretation is when the user submits a problem using the security operation platform, the Orchestrator Agent receives the problem request and uses the adapted general model to perform semantic understanding, analyze the specific content of the user's needs and the type of security operation tasks involved. The dynamic scheduling and interaction of intelligent agents is that the Orchestrator Agent uses the A2A protocol to dynamically select the required agent based on the semantic understanding results and send the task parameters to the corresponding agent.

5. The method for collaborative scheduling based on secure agents according to claim 4, characterized in that: The security tool call and data acquisition process involves the Tool Agent and Data Agent calling security tools based on their respective MCP Servers during task execution. When the Data Agent obtains business data, it retrieves the adapter tool description from the business interface knowledge base based on the RAG concept, generates the MCP protocol content and request parameters with the help of a large model, and sends them to the MCP Server to call the corresponding business data interface to obtain data. When the Tool Agent needs to ban a malicious IP address, it uses the MCP Server to call the ban tool to perform the disposal operation and return the execution result. The result aggregation and presentation process involves each Agent returning the result to the Orchestrator Agent after completing the task. The Orchestrator Agent aggregates and integrates the execution results of each Agent, summarizes and reviews them using the model, and presents clear results to the user, allowing the user to view the detailed task execution process and data.

6. The method for collaborative scheduling based on secure agents according to claim 5, characterized in that: The data collection is that after each agent executes a task, it automatically collects task input and output data, user feedback, and tool call log information, and stores them in a self-learning data warehouse. The reinforcement learning training is to regularly start the reinforcement learning training process, extract data from the self-learning data warehouse, construct training samples, and use the deep Q network algorithm to train the agent decision model with the agent task execution accuracy and efficiency as the optimization goals, and adjust the intelligent agent task processing logic.

7. The method for collaborative scheduling based on secure agents according to claim 6, characterized in that: The capability assessment and optimization trigger is based on the capability assessment model, using multi-dimensional indicators to quantitatively score the agent's capabilities. If the score is lower than the set threshold, the model re-adaptation and knowledge supplementation process are executed according to the assessment results.

8. The method for collaborative scheduling based on secure agents according to claim 7, characterized in that: The cross-domain scenario analysis and strategy adjustment is a cross-domain collaborative adaptation module that monitors the switching of security operation scenarios in real time, analyzes the security requirements of different scenarios, and automatically adjusts the intelligent agent collaborative scheduling strategy, tool call priority and model adaptation rules based on the scenario requirements. The cross-domain knowledge mapping and conversion is when the intelligent agent performs tasks across domains. The cross-domain security knowledge mapping library converts the general security knowledge carried by the intelligent agent into target domain adaptation knowledge based on the differences in the knowledge systems of the source domain and the target domain, and injects the converted knowledge into the intelligent agent according to the API interface, so that the intelligent agent can accurately understand the task and call the tool in the target domain.

9. The method for collaborative scheduling based on secure agents according to claim 8, characterized in that: The construction of the visualization platform and data display is to use front-end visualization technology to build a security operation visualization platform, establish data connection with OrchestratorAgent and various services, obtain real-time intelligent collaborative scheduling process data, task execution status and threat analysis results, and display them in a graphical interface. Operations personnel use Dashboard to monitor the overall security operation and quickly locate key tasks and abnormal situations. The construction and application of the traceability system is to generate a unique traceability ID for each security operation task. During the task execution, the traceability system records the basis for intelligent scheduling decisions, tool call parameters, model usage and data interaction content according to the log collection module. When the problem needs to be traced back, enter the traceability ID and retrieve the full process log according to the traceability query interface to assist operations personnel in analyzing the cause of the problem and optimize the security operation strategy based on the traceability data.

Images