Multi-agent cooperative abnormal information processing method and device, storage medium and program product

Abstract

The embodiment of the invention provides a multi-agent cooperative anomaly detection information processing method and device, a storage medium and a program product. In the embodiment of the invention, multiple agents form an agent link; the method comprises the following steps: calling respective packaged large models through each agent to sequentially obtain multi-dimensional snapshot data of a user from a business database, and performing portrait analysis on the multi-dimensional snapshot of the user at least from user stability and equipment change trend, and carrying out feature analysis and anomaly detection on the obtained structured portrait data, generating an Nth anomaly detection strategy based on the obtained target anomaly feature information and the score thereof, and updating an anomaly strategy template library according to the Nth anomaly detection strategy so that an anomaly detection agent can carry out anomaly detection in the (N + 1) th anomaly information processing process. The multiple agents cooperate and form a closed-loop mechanism, so that the anomaly detection strategy is continuously self-optimized, and the detection accuracy is improved along with iteration, thereby reducing the false alarm rate and realizing accurate detection of the service security risk.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a multi-agent collaborative anomaly detection method, device, storage medium, and program product. Background Art

[0002] In the field of business security, risk identification is crucial for ensuring stable business operations. The accuracy of risk identification depends on the development of risk strategies. Traditional risk strategy development methods primarily rely on manual empirical rules or machine learning models, but these methods have numerous limitations and are unable to meet the demands of modern business security. Manual strategy development is time-consuming and lacks real-time performance, making it difficult to quickly respond to changes in business risks. While machine learning models improve risk identification efficiency, they lack interpretability, making it difficult to meet regulatory compliance requirements. Furthermore, they are highly data-dependent and have poor adaptability.

[0003] In recent years, multi-agent collaboration technology has been widely applied in various fields. By collaborating with multiple agents, complex tasks can be accomplished. However, different fields involve different technical issues and application scenarios, resulting in different approaches to collaborative work and the functions achieved. In the field of business security, multi-agent collaboration technology has begun to attract attention, but currently there is no effective solution, and there are still significant shortcomings in improving the accuracy of anomaly detection using policies. Summary of the Invention

[0004] The embodiments of the present application provide a multi-agent collaborative anomaly detection information processing method, device, storage medium and program product to improve the accuracy and efficiency of anomaly detection using strategies in the field of business security.

[0005] The embodiment of the present application provides a method for processing anomaly detection information in a collaborative manner with multiple agents, including: the multiple agents include a data retrieval agent, a user portrait agent, an anomaly detection agent and a strategy generation agent, and the strategy generation agent and the anomaly detection agent form a feedback closed-loop link; the method includes: receiving the Nth anomaly detection request, the Nth anomaly detection request includes the user's identification information; inputting the user's identification information into the data retrieval agent, calling the data retrieval big model to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, the multi-dimensional snapshot data at least including: a user behavior snapshot and a device data snapshot corresponding in time; inputting the user's multi-dimensional snapshot data into the user portrait agent, using the user portrait big model to take the average multi-dimensional snapshot data of the historical group as a reference, at least from the perspective of user stability and device change trend. The dimensional snapshot data is used for portrait analysis to obtain the structured portrait data corresponding to the user, which includes outlier behavior data and outlier device data; the structured portrait data corresponding to the user is input into the anomaly detection agent, and the anomaly detection big model is used to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain anomaly feature information and its score; the anomaly strategy template library is a template library updated according to the N-1th anomaly detection strategy generated by the strategy generation agent during the N-1th anomaly information processing process; the anomaly feature information and its score are input into the strategy generation agent, and the strategy generation big model is used to generate the Nth anomaly detection strategy, and the anomaly strategy template library is updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

[0006] An embodiment of the present application also provides an electronic device, comprising: a memory and a processor; the memory is used to store a computer program; the processor is coupled to the memory and is used to execute the computer program to implement each step in the above method.

[0007] An embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor implements each step of the above method.

[0008] In an embodiment of the present application, multiple agents form an agent link, and each agent calls its own encapsulated large model to obtain the user's multi-dimensional snapshot data from the business database in turn, perform portrait analysis on the user's multi-dimensional snapshot from the perspective of user stability and device change trends, perform feature analysis and anomaly detection on the structured portrait data obtained by analysis, and generate the Nth anomaly detection strategy based on the obtained target anomaly feature information and its score, so that the anomaly detection strategy template library can be updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection according to the anomaly strategy template library updated by the Nth anomaly detection strategy during the N+1th anomaly information processing process. In this way, multi-agent collaboration can be achieved and a closed-loop mechanism can be formed, abnormal data detection can be dynamically realized, and the anomaly detection strategy can be continuously self-optimized according to the anomaly detection results. The detection accuracy rate increases with iteration, thereby reducing the false alarm rate and achieving accurate detection of business security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0010] Figure 1 A flowchart of a multi-agent collaborative anomaly detection information processing method provided by an exemplary embodiment of the present application;

[0011] Figure 2a A flowchart of another multi-agent collaborative anomaly detection information processing method provided by another exemplary embodiment of the present application;

[0012] Figure 2b A flow chart of the internal execution process of a data retrieval agent provided by an exemplary embodiment of the present application;

[0013] Figure 2c A flowchart of the internal execution process of a user portrait agent provided by an exemplary embodiment of the present application;

[0014] Figure 2d A flowchart of the internal execution process of an anomaly detection agent provided by an exemplary embodiment of the present application;

[0015] Figure 2e A schematic diagram of a process flow of an internal execution process of a strategy generation agent provided by an exemplary embodiment of the present application;

[0016] Figure 2f A flow chart of the internal execution process of a strategy reporting agent provided by an exemplary embodiment of the present application;

[0017] Figure 2gA schematic diagram of a time sequence flow of multi-agent collaboration provided by an exemplary embodiment of the present application;

[0018] Figure 3 A schematic structural diagram of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0019] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0020] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0021] In addition, it should be noted that when the embodiments of the present application involve user interaction operations or triggering operations, the user interaction operations or triggering operations involved in the embodiments of the present application include but are not limited to: touch operations, gesture operations, voice operations, head movement operations, eye movement operations and other interactive operations in various ways; among which, touch operations include but are not limited to: click operations, double-click operations, long press operations, sliding operations, pinch operations or mouse hover operations, etc. Sliding operations include but are not limited to: straight sliding, curved sliding, etc.

[0022] Following the above background technology, in the field of business security, there are still obvious technical problems in improving the accuracy of anomaly detection using strategies. In the embodiment of the present application, multiple agents form an agent link, and each agent calls its own encapsulated large model to obtain the user's multi-dimensional snapshot data from the business database in turn, perform portrait analysis on the user's multi-dimensional snapshot based on user stability and device change trends, perform feature analysis and anomaly detection on the structured portrait data obtained by analysis, and generate the Nth anomaly detection strategy based on the obtained target anomaly feature information and its score, so that the anomaly detection strategy can be updated according to the Nth anomaly detection strategy. The anomaly detection strategy template library is used for the anomaly detection agent to perform anomaly detection according to the anomaly detection strategy updated by the Nth anomaly detection strategy during the N+1th anomaly information processing process. In this way, multi-agent collaboration can be achieved and the strategy generation agent and the anomaly detection agent form a feedback closed-loop link mechanism, which can achieve multi-agent collaboration and form a closed-loop mechanism, dynamically realize abnormal data detection, and realize continuous self-optimization of the anomaly detection strategy based on the anomaly detection results. The detection accuracy is improved with iteration, thereby reducing the false alarm rate and achieving accurate detection of business security risks.

[0023] The following describes in detail a solution provided by an embodiment of the present application in conjunction with the accompanying drawings.

[0024] Figure 1 A flowchart of a multi-agent collaborative anomaly detection information processing method provided in an embodiment of the present application. Figure 2a This is the process intention of a multi-agent collaborative anomaly detection information processing method provided in the embodiment of the present application. Figure 2a As shown in , the multi-agent includes a data retrieval agent, a user profile agent, an anomaly detection agent, and a strategy generation agent, and the strategy generation agent and the anomaly detection agent can form a feedback closed loop link. Figure 1 As shown in FIG, the multi-agent collaborative anomaly detection information processing method includes:

[0025] 101. Receive an Nth anomaly detection request, where the Nth anomaly detection request includes user identification information;

[0026] 102. Input the user's identification information into the data retrieval agent, call the data retrieval model to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, the multi-dimensional snapshot data at least including: a user behavior snapshot and a device data snapshot corresponding in time;

[0027] 103. Input the user's multi-dimensional snapshot data into the user portrait agent, call the user portrait model, and use the average multi-dimensional snapshot data of the historical group as a reference to perform a portrait analysis on the user's multi-dimensional snapshot data from at least the perspective of user stability and device change trends to obtain structured portrait data corresponding to the user. The structured portrait data includes outlier behavior data and outlier device data.

[0028] 104. Input the structured profile data corresponding to the user into the anomaly detection agent, and call the anomaly detection large model to perform feature analysis and anomaly detection on the structured profile data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain target anomaly feature information and its score; the anomaly strategy template library is the template library updated according to the N-1th anomaly detection strategy generated by the strategy generation agent during the N-1th anomaly feature information processing process;

[0029] 105. Input the target anomaly feature information and its score into the strategy generation agent, call the strategy generation model to generate the Nth anomaly detection strategy, and update the anomaly strategy template library based on the Nth anomaly detection strategy so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

[0030] To facilitate understanding, we first introduce the agent, large model, Model Context Protocol (MCP) and their relationship in detail.

[0031] An agent is a software entity that can autonomously perceive its environment, make decisions, and execute actions. A large model is encapsulated within the agent as a callable module (software library, container, or microservice). The agent's scheduler uniformly loads, manages input / output, and manages context. In other words, agents are typically driven by a large model, such as a large language model (LLM), which provides capabilities such as task decomposition, tool invocation, memory management, and multi-round reasoning. In scenarios such as business security, automated operations and maintenance, and content generation, agents can independently complete complex tasks or collaborate with other agents to form multi-agent systems. In other words, the large model can be considered the agent's "brain," responsible for understanding tasks, making decisions, and invoking instructions; the agent is the "body" and "nervous system," encapsulating the large model and providing it with memory, tool interfaces, and communication channels with the outside world. In this application, this relationship frees the large model from the limitations of isolated reasoning. Through the agent's scheduling, the MCP protocol invoking local tools, and real-time data acquisition, it can complete complex and dynamic business security policy generation tasks, achieving a closed loop from "thinking" to "implementing."

[0032] The MCP protocol is an open standard designed to unify how large models interact with external data sources, tools, and services. Its core features include: contextual data injection, which injects external resources like files, databases, and API responses into model prompts or working memory; function routing and invocation, which allows large models to dynamically call registered tools (such as searchCustomerData); and prompt orchestration, which modularizes and assembles prompts in real time to reduce token consumption and improve output quality. MCP utilizes a client-server architecture. For example, hosts (such as chat applications) connect to various MCP servers (such as Google Drive and databases) through the MCP client, using JSON-RPC 2.0 for communication.

[0033] Furthermore, the large model's calls to target tools adhere to the unified interface specifications defined by the Model Context Protocol (MCP). Specifically, the large model only needs to generate tool call instructions based on the MCP specification. These instructions contain at least: (i) a tool identifier; and (ii) a parameter set that conforms to the MCP schema. The MCP Client instance integrated within the agent converts these instructions into standard messages conforming to the JSON-RPC 2.0 format and sends them to the MCP Server via the MCP protocol channel. The MCP Server, acting as a protocol conversion layer, maps and forwards these standard messages to the corresponding tool implementation. If the tool is implemented as a local function, the MCP Server directly calls the function and passes in the parameters. If the tool is implemented as a RESTful interface, the MCP Server constructs and sends an HTTP request. If the tool is implemented as a database query, the MCP Server executes the corresponding SQL statement. After the tool executes, the MCP Server encapsulates the results in the return format specified by the MCP protocol and transmits them back to the MCP Client via the same channel, allowing the large model to continue reasoning. As a result, the large model only needs to address the single abstract interface defined by the MCP protocol, without having to worry about the specific implementation of the tool or the underlying communication protocol. The interfaces mentioned above are not traditional business interfaces such as REST, gRPC, or SQL. Instead, they refer to the executable tools that large models call based on the MCP protocol. MCP Server, as the protocol adaptation layer, translates the unified call instructions defined by the MCP protocol into the corresponding tool's execution instructions, including but not limited to REST requests, SQL queries, or local function calls. Large language models only need to generate call instructions according to the MCP protocol specification without having to worry about the tool's specific implementation or underlying communication protocol.

[0034] It should be noted that the large model involved in each embodiment of the present application refers to a model whose model parameters meet the set parameter quantity requirements. The parameter quantity requirements are not specifically limited and may have different definitions in different scenarios or different fields. For example, in some scenarios or fields, a large model refers to a model with a parameter scale of tens of billions, hundreds of billions, or even trillions, but the definition of the model parameter quantity is only an example and does not limit the technical solution of this application. The large model can be an AI model, such as an AI large language model with strong language understanding and generation capabilities.

[0035] The combination of agents and the MCP protocol forms an "agent + toolchain" collaborative model, which can achieve the following technical effects: standardized tool calls, where agents call external tools (such as database queries and API services) based on the MCP unified interface, eliminating the need to hard-code tool logic within the agent, thus decoupling tools from models; real-time context synchronization, where the MCP server continuously maintains and updates data sources, allowing agents to obtain the latest contextual information (such as real-time transaction records) in real time and dynamically optimize decisions based on this; multi-agent collaboration, where multiple agents achieve data interoperability and task collaboration by sharing the unified resources exposed by the MCP server (such as a unified user profile library). For example, in risk control scenarios, data retrieval agents and anomaly detection agents share a database connected to the same MCP server to conduct joint analysis. In short, agents provide autonomous decision-making and task execution capabilities, while the MCP protocol provides standardized tool and data connectivity capabilities. The combination of the two enables AI systems to have a complete closed loop of "perception-decision-action-feedback", significantly improving the level of automation and intelligence in business scenarios.

[0036] When the large model in an agent calls a tool via the MCP protocol to complete a task, the task execution process typically occurs within the agent's external environment. Specifically, this process is accomplished through the following layers: (a) Instruction Generation Layer: The large model generates an MCP call instruction within the agent, containing the tool's identifier and parameters; (b) Protocol Encapsulation Layer: The MCP Client, integrated into the agent, serializes the instruction into a JSON-RPC message conforming to the MCP protocol format; (c) Protocol Conversion Layer: The MCP Server receives the message, maps it, and forwards it to the corresponding external tool execution environment, which includes but is not limited to a local software module, database interface, or API service; (d) Tool Execution Layer: The external tool completes the task based on the received parameters and returns the execution result to the MCP Server in the format specified by the MCP protocol; (e) Result Return Layer: The MCP Server returns the result to the large model via the MCP Client for further reasoning or decision-making. As a result, the large model can call any external tool by simply using the single abstract interface defined by the MCP protocol, without having to understand the tool's specific implementation details. This decouples the tool from the model, improving the system's scalability and flexibility.

[0037] It should be noted that in the following embodiments of this application, when each intelligent agent calls the tool through the large model, the above-mentioned implementation method can be used for calling, and it will not be repeated in the following embodiments.

[0038] In this embodiment, the execution subject of the above-mentioned multi-agent collaborative anomaly detection information processing method is not limited, and the execution subject can be a local computing platform (also known as a local server) and / or a third-party platform (also known as a third-party server). Among them, the local computing platform refers to the hardware, virtual machine or private cloud resources directly owned or fully controlled by the system operator, which is used to process the business data belonging to the operator. A third-party computing platform refers to an independent entity that is not owned by the operator and is authorized to provide computing services. Its hardware, virtual resources and underlying software are independently operated and maintained by the third party, and only access the operator's business data or services through a controlled interface, such as a cloud service provider, a cooperative enterprise or a commissioned data center.

[0039] It should be noted that the collaborative multi-agents in this embodiment include data retrieval agents, user portrait agents, anomaly detection agents, and policy generation agents that can be deployed on the same execution entity or on different execution entities, that is, the data retrieval agent, user portrait agent, anomaly detection agent, and policy generation agent can all be deployed on the local computing platform or on a third-party computing platform, or some can be deployed on the local computing node and the other part on the third-party computing platform. When the collaborative multi-agents are deployed on different execution entities, the different execution entities can share the processing results of each agent through an encrypted communication link. This embodiment does not limit this, and it depends on specific needs.

[0040] In an embodiment of the present application, an anomaly detection request can be sent to an execution subject, and the anomaly detection request includes the identification information of the user. The user refers to the person who needs to perform an anomaly detection for this anomaly detection request. The execution subject can then receive the Nth anomaly detection request, where N is a positive integer greater than or equal to 1. This embodiment does not limit the execution subject that sends the anomaly detection request. For example, it can be an anomaly detection request sent by an operation and maintenance personnel through the anomaly detection request interface, or it can be an execution subject that performs anomaly detection. Furthermore, if it is necessary to perform an anomaly detection on at least one aspect of the device operation data related to the user, the anomaly detection request can also include at least one aspect of the device identification information, such as the identification information of a certain hardware of the device or the identification information of a certain software. Furthermore, if it is necessary to perform an anomaly detection on the business data of at least one business related to the user, the anomaly detection request can also include the business identification information of at least one business related to the user, and so on.

[0041] In an embodiment of the present application, the user's identification information can be input into a data retrieval agent, and the data retrieval model can be called to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information. The multi-dimensional snapshot data at least includes: a user behavior snapshot and a device data snapshot that correspond in time. Among them, the business database can be a database of the business to which the multi-agent collaborative anomaly detection information processing method is applied, or the anomaly detection request also carries a business identifier, and the multi-dimensional snapshot data is obtained from the corresponding business database based on the business identifier. The user behavior snapshot can store user behavior data that has been aggregated and structured, and the device data snapshot contains aggregated and structured device operation data. The two types of snapshots have a corresponding relationship in the time dimension and constitute an associated data system, that is, there is a clear mapping association between user behavior data and corresponding device operation data. In other words, the user operation behavior represented by the user behavior data drives the device operation, and thereby generates corresponding device operation data.

[0042] In an optional embodiment, when the data retrieval agent calls the data retrieval big model to retrieve the multi-dimensional snapshot data of the user from the business database based on the user's identification information, the data retrieval big model can directly obtain at least the user behavior data and the device operation data from the business database, and respectively aggregate and structure the user behavior data and the device operation data to obtain a multi-dimensional data snapshot containing at least the user behavior snapshot and the device operation snapshot; or, the big model can also obtain a tool with corresponding functions based on the MCP protocol to obtain at least the user behavior data and the device operation data from the business database, and respectively aggregate and structure the user behavior data and the device operation data to obtain a multi-dimensional data snapshot containing at least the user behavior snapshot and the device operation snapshot; or, some operations are directly performed by the big model, while some operations can also be performed by the big model using a tool with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it can be determined based on specific needs or whether the big model can directly perform the corresponding operation. For the specific implementation method of calling the data retrieval big model to retrieve the multi-dimensional snapshot data of the user from the business database based on the user's identification information, please refer to the relevant description of the following embodiment, which will not be repeated here.

[0043] Furthermore, if anomaly detection is required for snapshots of other dimensions besides user behavior snapshots and device operation snapshots, snapshots of other dimensions can also be obtained according to the above method, and the snapshots of each dimension are also corresponding in time, forming a mappable associated data system.

[0044] The technical solutions provided by the above-mentioned embodiments related to data retrieval agents, first, can simultaneously obtain time-aligned user behavior snapshots and device operation snapshots through a single retrieval, forming a mappable associated data system, which can avoid the delays and errors caused by subsequent cross-source splicing and facilitate data comparison; secondly, large models can directly complete aggregation and structuring, and can also call external tools on demand through the MCP protocol to achieve a hybrid mode of model self-processing and tool-assisted processing, which can reduce dependence on a single computing power or authority; in addition, no matter what execution path is adopted, a multi-dimensional data snapshot in a unified format is ultimately output, providing standardized input for downstream user portrait agents and anomaly detection agents, which can improve the consistency and scalability of the overall anomaly detection link.

[0045] In an embodiment of the present application, after the data retrieval agent obtains the multi-dimensional snapshot data, the user's multi-dimensional snapshot data can be input into the user portrait agent, and the user portrait model is called to use the average multi-dimensional snapshot data of the historical group as a reference, and the user's multi-dimensional snapshot data is subjected to a portrait analysis at least from the perspective of user stability and device change trends to obtain the structured portrait data corresponding to the user, and the structured portrait data includes outlier behavior data and outlier device data. Among them, the historical group refers to other historical users included in the business database. The average multi-dimensional data snapshot refers to the average value of the snapshots of other historical users in each dimension. Outlier behavior data refers to a set of user behavior metrics that are judged to be significantly deviated from the group distribution after the above-mentioned stability analysis. The data is output in a structured form for subsequent anomaly detection strategy generation, for example, the standard score (Z-score) of the difference between the behavior value and the group mean is greater than a preset threshold, or the distribution entropy of the behavior sequence is higher than the upper quartile of the group, etc. Outlier device data refers to a collection of records where device metric values ​​exceed the group tolerance range after device change trend analysis. This data can also be output in a structured form to provide device dimension feature basis for abnormal strategies. For example, the number of device replacements or geographic location jump distance exceeds the group upper limit, or the device fingerprint change rate exceeds the preset percentage.

[0046] Specifically, the user portrait agent calls the user portrait big model to use the average multi-dimensional snapshot data of the historical group as a reference, and performs a portrait analysis on the user's multi-dimensional snapshot data from at least the perspectives of user stability and device change trends. This can be based on at least the average user behavior snapshot data of the historical group to perform a portrait analysis on the user behavior snapshot from the perspective of user stability, and based on the average device snapshot data of the historical group to perform a portrait analysis on the device data snapshot from the perspective of device change trends. Among them, using the average user behavior snapshot data of the historical group as a reference to perform a portrait analysis on the user behavior snapshot from the perspective of user stability can be achieved by using the user portrait big model to statistically compare the target user's behavior snapshots (such as login frequency, number of transactions, active time distribution, etc.) within a continuous time window with the mean / standard deviation of the historical group within the same time window, calculate stability indicators (such as coefficient of variation, entropy value or sliding standard deviation), and when the degree of fluctuation of the user behavior sequence is significantly higher than the group threshold, it is marked as a stability anomaly to form a stability portrait label. Using the average device snapshot data of the historical group as a reference, the device data snapshot is profiled based on the device change trend. This can be done by performing a time series analysis on the user device snapshot sequence (device unique identifier, model, geographic location, system version, sensor reading, etc.), extracting trend features (such as device replacement frequency, geographic location drift distance, hardware fingerprint change rate), and by comparing with the group baseline trend, identifying the magnitude of changes beyond the normal range to generate a device change trend portrait.

[0047] In addition, when the user portrait agent calls the user portrait big model to use the average multi-dimensional snapshot data of the historical group as a reference to perform a portrait analysis on the user's multi-dimensional snapshot data at least from the perspective of user stability and device change trend, the user portrait big model can directly use at least the average user behavior snapshot data of the historical group as a reference to perform a portrait analysis on the user behavior snapshot from the perspective of user stability, and use the average device snapshot data of the historical group as a reference to perform a portrait analysis on the device data snapshot from the perspective of device change trend; or, the big model can also obtain a tool with corresponding functions based on the MCP protocol to use at least the average user behavior snapshot data of the historical group as a reference to perform a portrait analysis on the user behavior snapshot from the perspective of user stability, and use the average device snapshot data of the historical group as a reference to perform a portrait analysis on the device data snapshot from the perspective of device change trend; or, some operations are directly performed by the big model, and some operations can also be performed by the big model using tools with corresponding functions obtained based on the MCP protocol. This embodiment does not limit this, and it depends on specific needs or whether the big model can directly perform the corresponding operation. The user portrait intelligent agent calls the user portrait model with the average multi-dimensional snapshot data of the historical group as a reference, and performs portrait analysis on the user's multi-dimensional snapshot data at least from the perspective of user stability and device change trends. For more specific implementation methods, please refer to the relevant description of the following embodiments, which will not be repeated here.

[0048] The technical solutions provided by the above embodiments related to user portrait agents, first, use the historical group mean (or historical group mean ± threshold) as a dynamic benchmark to convert user stability and device change trends into measurable outlier indicators (Z-score, change rate, etc.), eliminating the subjectivity of artificial thresholds; secondly, whether the large model is self-operated or external tools are called through the MCP protocol, the final output is the same structured portrait data containing outlier behavior data and outlier device data, which is directly used as the input of the downstream anomaly detection agent to avoid secondary format conversion; in addition, it supports large model self-operation, tool calling, and hybrid execution The three modes can be flexibly switched according to data sensitivity or real-time requirements, ensuring that sensitive data does not leave the domain (that is, in order to avoid leakage of user original data, another large model can be used to directly complete the portrait analysis, and the data is always located on the local server and is not handed over to external tools). Tool instances can also be horizontally expanded in high-concurrency scenarios (that is, when the number of portrait analysis requests is large, time-consuming tasks such as analyzing the changing trends of computing devices can be disassembled and handed over to multiple identical tools for parallel processing (horizontal expansion) to share the pressure), thereby improving the overall portrait throughput and real-time performance (that is, combining parallel processing and elastic calls to increase the rate of the entire portrait analysis process).

[0049] In an embodiment of the present application, after the user portrait agent obtains the structured portrait data corresponding to the user, the structured portrait data corresponding to the user can be input into the anomaly detection agent, and the anomaly detection large model is called to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain the target anomaly feature information and its score; wherein, the anomaly strategy template library is a template library updated according to the N-1th anomaly detection strategy generated by the strategy generation agent during the N-1th abnormal feature information processing process. Among them, the abnormal feature information contains abnormal features and their corresponding numerical values. For example, the abnormal feature is the login frequency of user behavior, and the corresponding numerical value is 100 logins in 30 days. The score of the abnormal feature information can be a confidence score, which is used to characterize the degree of abnormality of the abnormal feature information.

[0050] Specifically, when the anomaly detection agent calls the anomaly detection big model to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library, the anomaly detection big model can directly perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library; or, the anomaly detection big model can also obtain a tool with corresponding functions based on the MCP protocol to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library; or, some operations are directly performed by the anomaly detection big model, and some operations can also be performed by the big model by obtaining a tool with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it depends on specific needs or whether the big model can directly perform the corresponding operation. For a more specific implementation method of calling the anomaly detection big model to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library, please refer to the relevant description of the following embodiment, which will not be repeated here.

[0051] The technical solutions provided by the above-mentioned embodiments related to the anomaly detection agent are as follows: first, the anomaly policy template library is updated in real time by the policy generation agent in the N-1th round of closed loop, and the latest policy is used in the Nth round of detection, so that the anomaly rules are dynamically iterated with the business confrontation to ensure the timeliness of detection; secondly, the large model uses structured portrait data as input and outputs the target anomaly feature information and score at one time, which can avoid the traditional threshold manual adjustment and improve the quantitative accuracy; in addition, it supports three modes: model self-calculation, MCP protocol calling external tools, and hybrid execution. It can not only perform local closed-loop processing in sensitive scenarios, but also horizontally expand external tool instances in high concurrency, taking into account data security and system throughput.

[0052] In an embodiment of the present application, after the anomaly detection agent obtains the target anomaly feature information and its score, the target anomaly feature information and its score can be input into the strategy generation agent, the strategy generation model can be called to generate the Nth anomaly detection strategy, and the anomaly strategy template library can be updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

[0053] Specifically, when the strategy generation agent calls the strategy generation big model to generate the Nth anomaly detection strategy and updates the anomaly strategy template library according to the Nth anomaly detection strategy, the strategy generation big model can directly generate the Nth anomaly detection strategy and update the anomaly strategy template library according to the Nth anomaly detection strategy; or, the strategy generation big model can also obtain a tool with corresponding functions based on the MCP protocol to generate the Nth anomaly detection strategy and update the anomaly strategy template library according to the Nth anomaly detection strategy; or, some operations are directly performed by the anomaly detection big model, and some operations can also be performed by the big model by obtaining a tool with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it depends on specific needs or whether the big model can directly perform the corresponding operation. For a more specific implementation method of the strategy generation big model generating the Nth anomaly detection strategy and updating the anomaly strategy template library according to the Nth anomaly detection strategy, please refer to the relevant description of the following embodiment, which will not be repeated here.

[0054] The technical solutions provided by the above-mentioned embodiments related to the policy generation intelligent agent, first, utilize the target anomaly features and their scores generated in the Nth round, the policy generation large model immediately outputs the Nth anomaly detection strategy, and synchronously refreshes the anomaly policy template library, so that the next round (N+1) of detection directly applies the latest rules, shortening the policy iteration cycle; supports three implementation methods: large model self-generation, MCP protocol calling external policy construction tools, and hybrid execution, which can not only generate local closed-loop in high-confidentiality scenarios, but also horizontally expand policy generation tools in high-concurrency scenarios, taking into account both security and performance; in addition, the template library continuously absorbs the newly generated strategies in each round to form a reusable anomaly detection knowledge base, reducing subsequent cold start costs, and improving overall detection coverage and accuracy.

[0055] The technical solutions provided by the above embodiments of the present application are that multiple agents form an agent link, and each agent calls its own encapsulated large model to obtain the user's multi-dimensional snapshot data from the business database in turn, perform portrait analysis on the user's multi-dimensional snapshot based on user stability and device change trends, perform feature analysis and anomaly detection on the structured portrait data obtained by analysis, and generate the Nth anomaly detection strategy based on the obtained target anomaly feature information and its score, so that the anomaly detection strategy template library can be updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection according to the anomaly strategy template library updated by the Nth anomaly detection strategy during the N+1th anomaly information processing process. In this way, multi-agent collaboration can be achieved and the strategy generation agent and the anomaly detection agent form a feedback closed-loop link mechanism, multi-agent collaboration can be achieved and a closed-loop mechanism can be formed, abnormal data detection can be dynamically realized, and the anomaly detection strategy can be continuously self-optimized according to the anomaly detection results. The detection accuracy rate increases with iteration, thereby reducing the false alarm rate and achieving accurate detection of business security risks.

[0056] In this embodiment, in order to ensure the security of the database, a corresponding business data retrieval tool based on the MCP protocol can be developed for the database and exposed to the outside world, so as to realize the provision of a business data retrieval tool based on the MCP protocol to the outside world. In addition, in order to enable the data big model to perform the corresponding operation more accurately, the data retrieval big model corresponds to a first prompt word, and the first prompt word contains the first task description information. This embodiment does not limit the input method of the first prompt word. For example, the first prompt word can be pre-generated and bound to the data retrieval big model. When the data retrieval agent calls the data retrieval big model based on the received user identification information, the first prompt word bound to the data retrieval big model can be automatically input into the data retrieval big model to guide the big model to perform the corresponding operation. The prompt words corresponding to the big model called by each agent in the following embodiments can also adopt this input method, which will not be repeated in the following embodiments. For another example, a comprehensive prompt word can be generated in advance based on the prompt words corresponding to the large models invoked by each agent. This comprehensive prompt word includes each prompt word, each of which has its own identifier, such as the identifier information of the corresponding large model. When the user's identifier information is input into the data retrieval agent, the comprehensive prompt word is input into the data retrieval agent along with the user's identifier information. Whenever any of the collaborative multi-agents receives the information and starts to activate, it obtains the prompt word it needs from the comprehensive prompt word. For another example, a comprehensive prompt word can be generated in advance based on the prompt words corresponding to the large models invoked by each agent. This comprehensive prompt word includes each prompt word, each of which has its own identifier information, such as the identifier information of the corresponding large model. When the user's identifier information is input into the data retrieval agent, the comprehensive prompt word is input into the data retrieval agent along with the user's identifier information. The data retrieval agent decomposes the comprehensive prompt word based on the multiple identifiers contained in the comprehensive prompt word to obtain the prompt words corresponding to each large model, and then inputs each decomposed prompt word into the subsequent agent. In addition, the task description information contained in the prompt word corresponding to each agent may also include one or more subtasks. The corresponding large model can also determine whether each subtask can be directly completed by its own capabilities. If it can be completed directly, the large model can complete it directly. If it cannot be completed directly, the large model can call a tool with corresponding functions through the MCP protocol to complete it. However, the above is only an example and does not constitute a limitation on the technical solution of this application.

[0057] Based on this, in this embodiment, Figure 2bAs shown, the user's identification information is input into the data retrieval agent, and the data retrieval model is called to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, including: inputting the user's identification information and the first prompt word into the data retrieval agent, calling the data retrieval model to decompose the task based on the first task description information, obtaining multiple first subtasks, and judging whether each first subtask can be directly completed by the data retrieval model's own capabilities. The multiple first subtasks include data retrieval from the business database, aggregation analysis of the retrieved data, and structured processing of the aggregation analysis results. When judging whether each first subtask can be directly completed by the data retrieval model's own capabilities, each subtask can be judged at one time, or before executing each subtask, such as after executing the previous subtask and before executing the next subtask, the next subtask can be judged; further, the data retrieval model judges whether it can directly complete the data retrieval from the business database through its own capabilities. According to the retrieval, and if the data retrieval big model cannot directly perform data retrieval from the business database, the data retrieval big model calls the business data retrieval tool based on the MCP protocol, so as to use the retrieval tool to retrieve the user's multi-dimensional business data from the business database based on the user's identification information. Conversely, the data retrieval big model can directly retrieve the user's multi-dimensional business data from the business database; further, after obtaining the user's multi-dimensional business data, the data retrieval big model determines whether it can directly complete the aggregation analysis of the multi-dimensional business data through its own capabilities, and if the data retrieval big model cannot directly perform aggregation analysis on the multi-dimensional business data, the data retrieval big model calls the aggregation analysis tool based on the MCP protocol, so as to use the aggregation analysis tool to perform aggregation analysis on the multi-dimensional business data to obtain the corresponding aggregation analysis results for the user; if the data retrieval big model can directly perform structured processing on the aggregation analysis results, the aggregation analysis results are input into the data retrieval big model to perform structured processing on the aggregation analysis results to obtain the user's multi-dimensional snapshot data. Therefore, the macro retrieval task is broken down into multiple subtasks and the execution entities are assigned to eliminate single-point bottlenecks and improve process controllability; after the large model self-checks, the tool expansion capability is seamlessly called through the MCP protocol to ensure that the data does not go out of the domain and supports high-concurrency expansion, shortening the data preparation delay; the subtask results are uniformly output as multi-dimensional snapshot data, providing standardized input for downstream anomaly detection and reducing conversion overhead.

[0058] In some optional embodiments, using an aggregation analysis tool to perform aggregation analysis on multi-dimensional business data to obtain an aggregation analysis result corresponding to the user includes: using the aggregation tool, based on aggregation rules, determining various time windows involved in the user's multi-dimensional business data, wherein the aggregation rule is a guiding strategy for guiding the aggregation tool to perform aggregation analysis on the multi-dimensional business data to obtain an aggregation analysis result, and the aggregation rule includes at least a time window rule. The time window information can be, for example, a fixed window rule (dividing time slices by fixed length, such as "the last 7 days", "the last 30 days", "0-6 o'clock, 6-12 o'clock, 12- The rules include: four equal-length periods (18:00, 18-24:00, and 24:00), calculating the number of logins and the total transaction amount in each period; sliding window rules (using a "24-hour sliding, 1-hour step" window, counting the "cumulative number of transactions in the past 24 hours" for each hour slice to capture short-term fluctuations); session window rules (using "continuous no operation for more than 30 minutes" as the end mark of a session, aggregating all behaviors within the session (clicks, payments, chat words) into a single session feature); and business cycle window rules (dividing by "natural week, natural month, and holidays", counting the difference in user activity during holidays and non-holidays); further The aggregation rules also include: based on the various time windows involved in the user, multi-dimensional business data is aggregated and classified in multiple dimensions to obtain multi-dimensional aggregated classification data, that is, each dimension of data is aggregated with the corresponding time window as the granularity; for the aggregated classification data of any dimension, vectorization processing is performed to obtain multiple feature information vectors of each dimension. The multiple feature information vectors can be numerical statistical / time series feature vectors, that is, high-dimensional floating-point splicing composed of statistics (mean, variance, percentile, etc.), time series features (sliding difference, trend slope) and discrete category One-Hot / Embedding Vectors, which can directly characterize the quantitative pattern of user behavior or device operation; perform pairwise similarity calculations on multiple feature information vectors of any dimension to obtain multiple first similarity calculation results of each dimension; based on multiple first similarity calculation results of any dimension, retain one feature information vector in the feature information vector pair whose similarity is greater than the first similarity threshold to obtain the first candidate abnormal feature information vector of each dimension; perform format conversion processing on the first candidate abnormal feature information vector of each dimension to obtain the first candidate abnormal feature information, and use the first candidate abnormal feature information as the aggregate analysis result corresponding to the user. In this way, multi-dimensional raw data is aggregated at one time in units of time windows, significantly reducing the data volume and subsequent calculation complexity; using the similarity threshold to remove redundancy, only retaining the most discriminative candidate abnormal feature information vector, and improving the signal-to-noise ratio of the abnormal signal; converting the vectorized numerical results into structured fields, which are directly called by the downstream anomaly detection and policy generation modules, avoiding secondary analysis, shortening the abnormality identification link delay and enhancing auditability.

[0059] In some optional embodiments, based on each time window involved by the user, multi-dimensional business data is aggregated and classified in multiple dimensions to obtain multi-dimensional aggregated classification data, including: dividing the user behavior timeline into several continuous or overlapping time windows according to aggregation rules (fixed window, sliding window, session window or business cycle window, etc.); each window is uniquely identified by a start timestamp and an end timestamp; within each time window, the original business data is mapped in three dimensions of "user-behavior-device", such as user dimensions including but not limited to: user_id, portrait label, behavior dimensions including but not limited to: event type (login, payment, chat), number of times, amount, duration, device dimensions including but not limited to: device_id, model, geographic location, transmission Sensor values; window-level aggregation functions are performed on the mapped triple data to obtain a window-dimension-indicator matrix. Examples include count categories such as login_cnt and pay_cnt, sum categories such as pay_amt_sum and msg_len_sum, statistics categories such as mean, max, and std, and sequence categories such as GPS track lists and battery charge sequences. Based on business tags or thresholds, the aggregated indicator matrix is ​​labeled with categories such as "high activity," "remote login," or "device drift," forming "window-category" key-value pairs. This "window-category-indicator" triple structure is then used as multi-dimensional aggregated classification data for subsequent vectorization and similarity calculation. Through three steps: time window segmentation, dimension mapping, and aggregation classification, the raw, sparse, and heterogeneous multi-dimensional business data is converted into window-level, categorized, and structured aggregate features. This not only compresses the data volume but also preserves the time series, behavior, and device association information required for anomaly identification. This provides high signal-to-noise ratio, low latency, and easily scalable input for subsequent vectorization, similarity calculation, and anomaly strategy generation.

[0060] In some optional embodiments, vectorization processing is performed on the aggregated classification data of any dimension to obtain multiple feature information vectors of each dimension, including: data alignment, expanding the aggregated classification data of each dimension into a numerical sequence in a fixed window order; feature construction, including but not limited to: statistical features (mean, variance, maximum value, minimum value, percentile), frequency domain features (FFT main frequency energy), time series features (sliding difference, trend slope, autoregressive coefficient), category embedding (One-Hot or Embedding for discrete category labels); splicing the above features into a k-dimensional floating-point vector V_d = [f1, f2, ..., f_k] in a fixed order; using Z-score or Min-Max normalization to eliminate dimensional differences, so that each dimension obtains m window vectors {V_d1, V_d 2,…}, i.e., multiple feature information vectors. As a result, the vectorized vectors can retain key anomaly information, enabling subsequent similarity calculations to accurately identify outlier patterns. Vector batch processing supports parallel computing, shortening the overall latency from aggregation to anomaly strategy output.

[0061] In this embodiment, to ensure database security, a corresponding MCP-based portrait data retrieval tool can be developed for the database and exposed to the public, enabling external provision of this tool. Furthermore, to enable the data model to more accurately execute corresponding operations, the data retrieval model is provided with a second prompt word, which contains the second task description information. The implementation of the second prompt word can be found in the description of the first prompt word and will not be repeated here.

[0062] Based on this, in this embodiment, Figure 2cAs shown, the user's multi-dimensional snapshot data is input into the user portrait agent, and the user portrait big model is used to refer to the average multi-dimensional snapshot data of the historical group, and the user's multi-dimensional snapshot data is subjected to portrait analysis at least from the perspective of user stability and device change trend to obtain structured portrait data corresponding to the user, including: inputting the user's multi-dimensional snapshot data and the second prompt word into the user portrait agent, calling the user portrait big model to decompose the task based on the second task description information, obtaining multiple second subtasks, and judging whether each second subtask can be directly completed by the user portrait big model's own capabilities. The multiple second subtasks include data retrieval from the portrait database and portrait analysis of the retrieved data. The judgment method of the multiple second subtasks can refer to the relevant description of the judgment method of the multiple first subtasks, which will not be repeated here; further, the user portrait big model judges whether it can directly complete the data retrieval from the portrait database through its own capabilities, and if the user portrait big model cannot directly retrieve data from the portrait database, the user portrait big model calls the portrait data retrieval tool based on the MCP protocol to use the portrait data retrieval tool to retrieve the user from the portrait database based on the user's identification information. Basic portrait data refers to information directly associated with the user's identity or attributes, including but not limited to age, gender, registration duration, account type, etc. In this embodiment, the basic portrait data is used to compare with the historical group mean to identify abnormalities in the user's behavior or device level; further, after obtaining the user's basic portrait data, the user portrait big model determines whether it can directly complete the portrait analysis of the basic portrait data through its own capabilities, and if the user portrait big model cannot directly perform portrait analysis based on the user's basic portrait data, the user portrait big model calls the portrait analysis tool based on the MCP protocol, and uses the portrait analysis tool to use the average multi-dimensional snapshot data of the historical group as a reference to perform portrait analysis on the user's multi-dimensional snapshot data from at least user stability and device change trends to obtain the user's structured portrait data; wherein, user stability refers to the degree of deviation between the user's behavior snapshot (such as the number, frequency, duration, etc. of logging into the instant messaging application) and the corresponding snapshot mean of the same attribute users in the historical group within a continuous time window, and when the deviation does not exceed the preset threshold, the user behavior data is determined to be stable; otherwise, when the deviation exceeds the preset threshold, the user behavior data is determined to be unstable. The device change trend refers to the direction and magnitude of the evolution of the user device snapshot sequence (such as the frequency of device identification changes, geographic location drift, system version change rate, etc.) over time. When the evolution magnitude is lower than the baseline change magnitude of the historical group of devices with the same attributes, it is marked as a normal device change trend. Conversely, when the evolution magnitude is significantly higher than the baseline change magnitude of the historical group of devices with the same attributes, it is marked as an abnormal device change trend.Therefore, the profiling task is split into independent "data retrieval" and "analysis" submodules, reducing single-point risks and improving controllability. After the large model self-checks, if it can connect directly to the database or analyze, it is processed locally. Otherwise, a dedicated tool is called through the MCP protocol, achieving seamless switching between local and external expansion, ensuring data security and supporting high concurrency. The analysis tool uses historical snapshots of the group as a benchmark to quantify behavioral and device changes, outputting structured "outlier" labels, and reducing human error. Ultimately, the structured data is output in a unified manner and directly used by downstream testing, avoiding conversion delays and shortening the detection process.

[0063] In some optional embodiments, with the average multi-dimensional snapshot data of the historical group as a reference, the multi-dimensional snapshot data of the user is subjected to a portrait analysis at least from the perspective of user stability and device change trend to obtain the structured portrait data of the user, including: combining and segmenting all historical users in the portrait database according to the basic portrait fields (age, gender, registration time, account type, etc.), and for each segment, calculating the average behavior snapshot (average number of logins, average transaction amount, etc.) and average device snapshot (average frequency of device replacement, average geographic location drift, etc.) of the segmented users in the same time window to form a "segmentation-benchmark table"; finding the user's basic portrait field in the "segmentation-benchmark table" For the corresponding segment, take out the mean and standard deviation of the segment as the comparison benchmark; compare the user's behavior snapshot in the continuous time window with the segment benchmark, such as calculating the Z-score of each indicator = (user value - mean value of the score) / standard deviation of the score, or take the maximum |Z-score| or weighted comprehensive score as the stability score; if the stability score is greater than the preset threshold, the user behavior is marked as unstable, otherwise, the user behavior is marked as stable; compare the user's device snapshot in the same window with the segment benchmark, such as calculating the device replacement frequency difference ΔD and the geographic location drift difference ΔL; if ΔD or ΔL is greater than the preset threshold, the device change trend is marked as abnormal, otherwise, the device change trend is marked as normal. Furthermore, the above tags and corresponding quantitative values ​​can also be encapsulated into a standard JSON format as a structured result. For example, the JSON format might be {"user_id":"U123","behavior_stable":false,"device_trend_abnormal":true,"stability_score":2.8,"trend_delta":3.1}. This JSON format represents the user's structured profile data, which can be directly fed into the anomaly detection agent. This approach uses historical groups with the same attributes as a dynamic benchmark, utilizing Z-scores and difference thresholds to quantify behavioral stability and device change trends, eliminating errors in thresholds based on human experience and improving anomaly identification accuracy. The profile analysis tool internally completes the entire process of segmentation, comparison, and labeling, eliminating the need for additional network calls. For large data volumes, the segmented calculation results can be cached and reused, allowing subsequent users to complete profiles in seconds, significantly improving throughput. The unified JSON structure directly interfaces with downstream anomaly detection agents, avoiding secondary parsing and format conversion, reducing latency in the overall anomaly detection chain, and meeting audit traceability requirements.

[0064] In this embodiment, in order to enable the large model to perform the corresponding operation more accurately, the anomaly detection large model corresponds to a third prompt word, which includes the third task description information. The relevant implementation of the third prompt word can refer to the relevant description of the first prompt word, and will not be repeated here.

[0065] Based on this, in this embodiment, Figure 2dAs shown, the structured portrait data corresponding to the user is input into the anomaly detection agent, and the anomaly detection large model is called to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain the target anomaly feature information and its score, including: inputting the structured portrait data corresponding to the user and the third prompt word into the anomaly detection agent, calling the anomaly inspection large model to perform task decomposition based on the third task description information to obtain multiple third subtasks, and judging whether each third subtask can be directly completed by the anomaly detection large model's own capabilities. The multiple third subtasks include feature analysis and anomaly detection on the structured portrait data corresponding to the user. The judgment method of the multiple third subtasks can refer to the relevant judgment method of the multiple first subtasks. The description is omitted here; further, the anomaly detection model determines whether it can directly perform feature analysis on the structured portrait data corresponding to the user through its own capabilities, and if the anomaly detection model cannot directly perform feature analysis on the structured portrait data corresponding to the user, the anomaly detection model calls the feature analysis tool based on the MCP protocol to use the feature analysis tool to perform feature analysis on the structured portrait data corresponding to the user to obtain feature analysis results; if the anomaly detection model cannot directly perform anomaly detection on the feature analysis results, the anomaly detection model calls the anomaly detection tool based on the MCP protocol to use the anomaly detection tool to perform anomaly detection on the feature analysis results based on the anomaly detection strategy in the anomaly strategy template library to obtain target anomaly feature information and its score. Feature analysis refers to performing numerical operations or statistical tests on structured portrait data to extract quantitative features that can characterize the user's abnormal tendency, such as calculating the behavioral stability Z-score, device drift distance, correlation between features, quantile deviation, etc., and outputting them as feature vectors or feature-threshold pairs. Feature analysis results are structured feature sets obtained after the aforementioned operations that can be directly used for anomaly detection. For example, they take the form of a list of {feature_name, feature_value, threshold, weight} or an equivalent JSON / table structure. Anomaly detection uses feature analysis results to classify or score users according to the rules in the anomaly strategy template library (such as threshold comparison, isolation forest, and deviation scoring). The final output is the target anomaly feature information and its score, for example, {"risk_tag":"High Activity Anomaly","score":0.92}.As a result, the anomaly policy template library is updated in real time based on the results of the previous round of policies. This round of detection uses the latest rules, shortening the policy iteration cycle and improving the timeliness of combating new risks. The anomaly detection large model first self-checks whether it can independently complete feature analysis / detection. If it is insufficient, it calls dedicated tools through the MCP protocol to achieve seamless switching between local reasoning and external computing power, ensuring that sensitive data does not leave the domain and can cope with high concurrency by horizontally expanding tool instances, thereby improving overall throughput. Regardless of whether it is executed directly by the large model or completed by the tool, the target anomaly feature information and score in a unified format are output directly for use by the policy generation agent, avoiding secondary analysis, reducing the detection link latency, and meeting subsequent audit and visualization requirements.

[0066] In some optional embodiments, a feature analysis tool is used to perform feature analysis on the structured portrait data corresponding to the user to obtain feature analysis results, including: receiving the structured portrait data output by the anomaly detection agent (including quantitative values ​​of user behavior stability and device change trends); mapping the portrait data to a predefined feature space, such as the Z-score, coefficient of variation, and percentile deviation value of the behavior dimension, the device replacement frequency, geographic drift distance, and version change rate of the device dimension, and the behavior-device correlation coefficient of the cross dimension; calculating the above indicators one by one to obtain floating-point values; if the indicators are discrete, one-hot or embedding processing is performed to form a unified dimensional vector; linearly normalizing the feature vector according to the corresponding weight table in the anomaly policy template library to obtain a weighted feature value; packaging the feature name, weighted feature value, threshold, and weight into JSON format, which is the feature analysis result and can be directly fed back to the anomaly detection tool for the next step of anomaly scoring. Among them, the JSON format can be as follows:

[0067] {"feature":"behavior_zscore","value":2.8,"threshold":2.0,"weight":0.4},

[0068] {"feature":"device_delta_loc","value":15.2,"threshold":10.0,"weight":0.6

[0069] }

[0070] In some optional embodiments, an anomaly detection tool is used to perform anomaly detection on the feature analysis results based on the anomaly detection strategy in the anomaly strategy template library to obtain target anomaly feature information and its score, including: when the anomaly detection tool is started, the currently effective anomaly detection strategy set is read from the anomaly strategy template library; each anomaly detection strategy contains at least three elements: a feature name list (feature_list), a judgment operator (operator: >, <, =, in_range, etc.), a threshold or rule parameter (threshold, weight, score_formula); the feature analysis result (JSON list) obtained in the previous step is mapped to a key-value pair according to the feature name to ensure that it is consistent with the fe in the strategy. ature_list corresponds one to another; for each strategy, the following operations are performed in sequence: all required feature values ​​of the strategy are extracted, the operator and threshold are substituted for Boolean judgment to obtain a correct or incorrect result (true / false), and if the conditions are met, the individual score is calculated according to the strategy's built-in formula: score_i = weight_i × (|value-threshold| / threshold) or a discrete scoring table; the scores of all hit strategies are accumulated (or weighted averaged) to obtain a comprehensive anomaly score S in the range of 0-1; the hit strategy name, key feature value, and score S are encapsulated into a structured output. The structured output is the target anomaly feature information and its score, which can be directly returned to the strategy generation agent for the next round of rule updates. The structured input format can be as follows:

[0071]

[0072]

[0073] In this embodiment, in order to make the strategy generation model more accurately perform the corresponding operation, the strategy generation model corresponds to a fourth prompt word, which includes the fourth task description information. The relevant implementation of the fourth prompt word can be found in the relevant description of the fourth prompt word, which will not be repeated here.

[0074] Based on this, in this embodiment, Figure 2eAs shown, the target abnormal feature information and its score are input into the strategy generation agent, the strategy generation model is called to generate the Nth abnormality detection strategy, and the abnormality strategy template library is updated according to the Nth abnormality detection strategy, including: inputting the target abnormality feature information and the fourth prompt word into the strategy generation agent, calling the strategy generation model to decompose the task based on the fourth task description information to obtain multiple fourth tasks, and judging whether each fourth subtask can be directly completed by the strategy generation model itself. The multiple fourth subtasks include generating anomaly detection strategies and updating the abnormality strategy template library. The judgment method of the multiple fourth subtasks can refer to the judgment method of the multiple fourth subtasks. The relevant description of the formula will not be repeated here; further, the policy generation model determines whether it can directly generate the Nth anomaly detection strategy through its own capabilities, and if the policy generation model cannot directly generate the Nth anomaly detection strategy, then the policy generation model calls the policy generation tool based on the MCP protocol, so as to use the policy generation tool to generate the Nth anomaly detection strategy based on the target anomaly feature information and its score; if the policy generation model cannot directly update the anomaly policy template library, then the policy generation model calls the anomaly policy template library update tool based on the MCP protocol, so as to use the anomaly policy template library to update the anomaly policy template library based on the Nth anomaly detection strategy. Therefore, through the three-level elastic architecture of the policy generation model, the MCP protocol, and the dedicated tool, the instant generation, non-downtime update and high concurrency expansion of the anomaly detection strategy can be achieved, which not only ensures the real-time iteration of the strategy, but also avoids the computing power or authority bottleneck of the model itself, forming a closed-loop adaptive risk control system.

[0075] In some optional embodiments, using a strategy generation tool to generate an Nth anomaly detection strategy includes: obtaining historical anomaly detection strategies from an anomaly strategy template library updated according to the N-1th anomaly detection strategy, each historical anomaly detection strategy containing at least one anomaly feature information; determining whether each target anomaly feature information is compatible with at least one historical anomaly feature information contained in each historical anomaly detection strategy; if compatible, generating the Nth anomaly detection strategy based on the compatible target anomaly feature information and each historical anomaly feature information in the corresponding historical anomaly detection strategy, wherein the Nth anomaly detection strategy is a comprehensive feature detection strategy; if incompatible, generating the Nth anomaly detection strategy based on the incompatible target anomaly feature information, wherein the Nth anomaly detection strategy is a single feature detection strategy. Thus, a compatibility / mutual exclusivity judgment is first performed with the historical strategies to avoid duplicate storage of synonymous or overlapping features and reduce strategy expansion; if compatible, the strategies are merged into a comprehensive feature detection strategy; if incompatible, the strategies are retained as a single feature detection strategy to ensure a minimum valid set of rules; and instantly determining the Nth round strategy form based on the N-1th round template library, achieving zero manual labor and zero downtime for strategy iteration.

[0076] Optionally, determining whether each target abnormality feature information is compatible with at least one historical abnormality feature information contained in each historical abnormality detection strategy includes: determining whether each target abnormality feature information contains time information; if not, determining whether each target abnormality feature information is compatible with at least one historical abnormality feature information contained in each historical abnormality detection strategy based on the logical semantics of each target abnormality feature information and at least one historical abnormality feature information contained in each historical abnormality detection strategy; if contained, determining whether the time information of each target abnormality feature information and at least one historical abnormality feature information contained in each historical abnormality detection strategy is mutually exclusive; if so, determining that each target abnormality feature information is incompatible with at least one historical abnormality feature information contained in each historical abnormality detection strategy; if not, determining whether each target abnormality feature information is compatible with at least one historical abnormality feature information contained in each historical abnormality detection strategy based on the logical semantics of each target abnormality feature information and at least one historical abnormality feature information contained in each historical abnormality detection strategy.

[0077] For example, abnormal feature information is mutually exclusive at the semantic level, that is, the features have the same meaning but different granularity, such as "age group" and "age", which have semantic overlap, so you only need to choose one. Example: User behaviors "number of logins in the past 10 days" and "number of logins in the past 20 days" have different ranges but the same calculation logic, which may be redundant. Check for mutual exclusivity of values: Binary features such as "whether it is a new user" and "whether it is an old user" cannot be 1 at the same time in the sample. For another example, abnormal feature information is homologous and synonymous, that is, features derived from the same field or table in different ways, and there is a high degree of overlap. Example: "weekday posts" and "weekend posts" derived from operation timestamps are mutually exclusive.

[0078] Further optionally, as Figure 2fAs shown, the multi-agent also includes: a strategy reporting agent, which is used to generate a detection report. The content of the report is used to explain the reasons for the abnormalities in user-related data. For example, the content of the detection report can be "The user's recent behavior has risk factors such as frequent device changes, abnormal operation time, and large IP geographical span. The strategy is generated based on the above characteristics, and it is recommended to be included in the audit list." Specifically, the Nth anomaly detection strategy can be input into the strategy reporting agent, which encapsulates a strategy report generation model. The strategy report generation model corresponds to the fifth prompt word, and the fifth prompt word contains the fifth task description information; the strategy reporting agent calls the strategy report generation model to decompose the task based on the fifth task description information, obtains multiple fifth subtasks, and judges whether each fifth subtask can be directly completed through the strategy report generation model's own capabilities. The multiple fifth subtasks include generating anomaly detection strategy reasoning links, performing natural language understanding processing on the reasoning links, and structuring the natural language processing results. Among them, the reasoning link refers to the complete logical chain from the anomaly detection strategy output by the strategy generation stage to the final anomaly judgment, which includes: the original anomaly feature information that triggers the strategy and its score, the comparison relationship between each feature and the threshold, the internal combination rules of the strategy (and / or / weighting), and the resulting anomaly level or action instruction. The action instruction can be in the form of JSON / tree structure for subsequent interpretation. Furthermore, if the strategy report generation model can directly generate the reasoning link of the anomaly detection strategy, the strategy report generation model generates the reasoning link of each anomaly detection strategy in the Nth anomaly detection strategy based on the Nth anomaly detection strategy; if the strategy report generation model can directly perform self-language understanding processing on the reasoning link, the strategy report generation model performs natural language processing based on the reasoning link of each anomaly detection strategy to obtain the natural language processing results corresponding to the reasoning link of each anomaly detection strategy; if the strategy report generation model can directly perform structured processing on the natural language processing results, the strategy report generation model performs structured processing based on the natural language processing results to obtain the explanatory report corresponding to each anomaly detection strategy. Therefore, the strategy report agent automatically converts the Nth anomaly detection strategy into an easy-to-read, auditable explanation report through a combination of reasoning links, natural language, and structured reports to meet the readability requirements of regulators and business personnel; the strategy report generation model first self-checks its capabilities, and if it is insufficient, it calls special tools through the MCP protocol to complete link generation, natural language polishing or format conversion, achieving seamless switching between local reasoning and external expansion, and ensuring report output efficiency in high-concurrency scenarios; the report content and strategy are iterated synchronously, and once the strategy is updated, the latest explanation can be generated in seconds, reducing the cost of manual writing and review, and improving the real-time and compliance of the overall risk control closed loop.

[0079] In an optional embodiment, performing natural language understanding processing on the reasoning link refers to the process of converting the above-mentioned structured logical chain into human-readable natural language text, including: translating feature-threshold comparison into semantic sentences, such as "the number of user logins in the past 7 days exceeds the mean of the same age group by 2.3 standard deviations"; translating logical combinations into causal descriptions, such as "...and the device has been replaced 3 times, so it is judged to be high risk."

[0080] In an optional embodiment, structuring the natural language processing results refers to reorganizing the above natural language text into standardized, machine-readable structured data, for example, splitting it into fields: {rule_id, natural language description, abnormal feature list, trigger threshold, risk level}, and generating JSON, XML, CSV and other formats that can be inserted into the audit system or report for easy storage, retrieval and display.

[0081] In the above embodiments of the present application, Figure 2g As shown, agents with different roles execute steps 1, 2, 3, 4, 5, and 6 in sequence. The output of each agent is then input to the next agent to continue working. When the generated strategies have the same or similar cases, the first step is fed back to continue the entire process.

[0082] To facilitate understanding of the above technical solution, a complete example is provided below for illustration.

[0083] First, the user enters the user's identification information, such as user_id="user_123".

[0084] Furthermore, the data retrieval agent extracts user behavior data, such as login / device / payment data from the last 30 days; if the number of times within 30 days is relatively high, there is a risk.

[0085] Furthermore, the user portrait agent identifies device data, such as 3 changes + cross-region logins and late-night operation preferences.

[0086] Furthermore, the anomaly detection agent identifies high-risk anomaly feature information.

[0087] Furthermore, the strategy generation agent generates anomaly detection strategies based on reasoning based on high-risk anomaly feature information.

[0088] Specifically, the strategy generation agent is responsible for automatically converting the anomaly feature information output by the anomaly detection agent into structured rules. Its core principles include the following four parts:

[0089] First, policy template matching (zero-sample reuse stage)

[0090] A policy template library is maintained locally, which stores successfully deployed policy templates. The format can be {"feature expression": "device switching frequency >= 3 and cross-provincial IP", "action": "add manual review"}. If the current abnormal feature information directly hits a template (features, thresholds, and logic are completely consistent), the template is reused immediately and all subsequent steps are skipped. Existing policies will no longer be generated again.

[0091] Second, KMeans behavioral attribution clustering (starting point when there is no template)

[0092] When the template library fails to find a match, the strategy generation agent first feeds the abnormal feature information into a local KMeans function for clustering. Specifically, the input is the abnormal feature vector (e.g., "nighttime active = 1, cross-provincial IP = 1, device switching frequency = 5"), and the output is a number of clusters, with similar behaviors within each cluster and significant differences between clusters. After clustering, a "behavior attribution matrix" is constructed—the rows and columns are the cluster ID and feature dimension, respectively, and the value is the average strength of the feature within the cluster. The matrix compresses the chaotic abnormal feature information into a few interpretable typical behavior patterns.

[0093] Third, Beam Search rule combination (multi-path exploration)

[0094] Starting from the center of each cluster, the agent initiates Beam Search: State: A strategy under construction (feature set + threshold); Action: Add / delete / modify a feature or threshold to the current strategy; Evaluation function: Strategy confidence = f(feature significance, historical hit rate, business weight). Only the top-K high-scoring paths are retained in each round until the preset depth is reached or the confidence converges. Result: Multiple candidate strategies are obtained, each with a confidence score (e.g., 0.92), forming strategies with different confidence levels.

[0095] Fourth, conflict detection and redundancy removal (final quality inspection)

[0096] All candidate strategies undergo a final quality check, which includes: a) conflict detection: If two rules simultaneously hit the same users but generate opposite actions, the one with the lower confidence score is discarded; b) redundancy removal: If rule A completely contains rule B and both have the same action, only rule A is retained; c) complexity penalty: Rules that are too long or have too many thresholds are downgraded to prevent overfitting. In summary, the strategy generation agent first queries an existing template library. If no match is found, it aggregates the anomaly feature information into typical behavior patterns. Beam Search is then used to attempt to generate a new anomaly detection strategy in the pattern space. Finally, quality inspection is performed to eliminate conflicts and redundancies, outputting the optimal structured anomaly detection strategy that can be directly deployed.

[0097] For example:

[0098]

[0099] Furthermore, the policy reporting agent generates an explanation report. For example, the explanation report states: "The user's recent behavior exhibits risk factors such as frequent device changes, unusual operation times, and a wide geographical spread of IP addresses. The policy was generated based on these characteristics and is recommended for inclusion in the audit list."

[0100] Figure 3 This is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. Figure 3 As shown, the electronic device includes: a memory 30a and a processor 30b; the memory 30a is used to store computer programs; the processor 30b is coupled to the memory 30a and is used to execute the computer programs to implement the steps in the above method.

[0101] The detailed implementation and beneficial effects of each module in the embodiments of the present application have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0102] Further, if Figure 3 As shown, the electronic device also includes: a communication component 30c, a display 30d, a power component 30e, an audio component 30f and other components. Figure 3 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 3 In addition, Figure 3 The components in the dotted box are optional components, not mandatory components, and the specific components may depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone or an IOT device, or a server device such as a conventional server, a cloud server or a server array. If the electronic device of this embodiment is implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, etc., it may include Figure 3 If the electronic device of this embodiment is implemented as a conventional server, cloud server or server array and other server-side devices, it may not include Figure 3 Components within the dotted box.

[0103] The above-mentioned memory can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0104] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 6G / LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra wide band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0105] The above-mentioned display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor can not only sense the boundary of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0106] The power supply assembly provides power to various components of the device in which the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0107] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0108] Accordingly, an exemplary embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps in the above method.

[0109] Accordingly, exemplary embodiments of the present application further provide a computer program product, which includes a computer program / instruction. When the computer program / instruction is executed by a processor, the processor is enabled to perform the steps in the above method.

[0110] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to magnetic disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) that contain computer-usable program code.

[0111] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0112] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0114] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0115] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0116] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be used to store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media such as modulated data signals and carrier waves.

[0117] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0118] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A multi-agent collaborative anomaly detection information processing method, characterized in that: The multi-agent includes a data retrieval agent, a user profile agent, an anomaly detection agent, and a strategy generation agent, and the strategy generation agent and the anomaly detection agent form a feedback closed loop link; the method includes: Receiving an Nth anomaly detection request, where the Nth anomaly detection request includes identification information of the user; Inputting the user's identification information into the data retrieval agent, calling the data retrieval model to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, the multi-dimensional snapshot data at least including: a user behavior snapshot and a device data snapshot corresponding in time; Inputting the multi-dimensional snapshot data of the user into the user portrait agent, calling the user portrait macro model to use the average multi-dimensional snapshot data of the historical group as a reference, and performing a portrait analysis on the multi-dimensional snapshot data of the user from at least the perspectives of user stability and device change trends to obtain structured portrait data corresponding to the user, wherein the structured portrait data includes outlier behavior data and outlier device data; The structured portrait data corresponding to the user is input into the anomaly detection agent, and the anomaly detection large model is called to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain target anomaly feature information and its score; the anomaly strategy template library is a template library updated according to the N-1th anomaly detection strategy generated by the strategy generation agent during the N-1th anomaly feature information processing process; The target anomaly feature information and its score are input into the strategy generation agent, the strategy generation model is called to generate the Nth anomaly detection strategy, and the anomaly strategy template library is updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

2. The method according to claim 1, characterized in that The business database provides a business data retrieval tool based on the MCP protocol. The data retrieval macro model corresponds to a first prompt word, and the first prompt word includes first task description information. The user's identification information is input into the data retrieval agent, and the data retrieval macro model is called to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, including: Inputting the user's identification information and the first prompt word into a data retrieval agent, invoking a data retrieval macromodel to decompose the task based on the first task description information to obtain a plurality of first subtasks, and determining whether each first subtask can be directly completed by the data retrieval macromodel itself, wherein the plurality of first subtasks include retrieving data from the business database, performing aggregate analysis on the retrieved data, and performing structured processing on the aggregate analysis results; If the data retrieval model cannot directly retrieve data from the business database, the data retrieval model calls the business data retrieval tool based on the MCP protocol, so as to use the retrieval tool to retrieve the multi-dimensional business data of the user from the business database based on the identification information of the user; If the data retrieval model cannot directly perform aggregate analysis on the multi-dimensional business data, the data retrieval model calls the aggregate analysis tool based on the MCP protocol to use the aggregate analysis tool to perform aggregate analysis on the multi-dimensional business data to obtain the aggregate analysis results corresponding to the user.

3. The method according to claim 2, characterized in that The aggregation analysis tool is used to perform aggregation analysis on the multi-dimensional business data to obtain the aggregation analysis results corresponding to the user, including: Using the aggregation tool, based on aggregation rules, determine each time window involved in the multi-dimensional business data of the user; Based on each time window involved in the user, performing multi-dimensional aggregation and classification on the multi-dimensional business data to obtain the multi-dimensional aggregated classification data; For the aggregated classification data of any dimension, vectorization processing is performed to obtain multiple feature information vectors of each dimension; Perform pairwise similarity calculations on multiple feature information vectors in any dimension to obtain multiple first similarity calculation results in each dimension; Based on multiple first similarity calculation results in any dimension, retain one feature information vector in a feature information vector pair whose similarity is greater than a first similarity threshold, to obtain a first candidate abnormal feature information vector in each dimension; The first candidate abnormal feature information vectors of the respective dimensions are format-converted to obtain first candidate abnormal feature information, and the first candidate abnormal feature information is used as the aggregate analysis result corresponding to the user.

4. The method according to claim 1, wherein The portrait database provides an MCP-based portrait data retrieval tool. The data retrieval macro model corresponds to a second prompt word, which includes second task description information. The multi-dimensional snapshot data of the user is input into the user portrait agent. The user portrait macro model is used to analyze the multi-dimensional snapshot data of the user based on the average multi-dimensional snapshot data of the historical group, at least from the perspective of user stability and device change trends, to obtain structured portrait data corresponding to the user, including: Inputting the multi-dimensional snapshot data of the user and the second prompt word into the user portrait agent, calling the user portrait macro model to decompose the task based on the second task description information to obtain multiple second subtasks, and determining whether each second subtask can be directly completed by the user portrait macro model itself, wherein the multiple second subtasks include data retrieval from the portrait database and portrait analysis of the retrieved data; If the user portrait model cannot directly retrieve data from the portrait database, the user portrait model calls the portrait data retrieval tool based on the MCP protocol to use the portrait data retrieval tool to retrieve the user's basic portrait data from the portrait database based on the user's identification information; If the user portrait model cannot directly perform portrait analysis based on the basic portrait data of the user, the user portrait model calls the portrait analysis tool based on the MCP protocol, and uses the portrait analysis tool to refer to the average multi-dimensional snapshot data of the historical group, and performs portrait analysis on the user's multi-dimensional snapshot data at least from the perspective of user stability and device change trends to obtain the user's structured portrait data.

5. The method according to claim 1, wherein The anomaly detection large model corresponds to a third prompt word, and the third prompt word includes third task description information; the structured portrait data corresponding to the user is input into the anomaly detection agent, and the anomaly detection large model is called to perform feature analysis and anomaly detection on the structured portrait data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library to obtain target anomaly feature information and its score, including: Inputting the structured portrait data corresponding to the user and the third prompt word into the anomaly detection agent, calling the anomaly detection large model to perform task decomposition based on the third task description information to obtain multiple third subtasks, and determining whether each third subtask can be directly completed by the anomaly detection large model itself, wherein the multiple third subtasks include feature analysis and anomaly detection of the structured portrait data corresponding to the user; If the anomaly detection large model cannot directly perform feature analysis on the structured portrait data corresponding to the user, the anomaly detection large model calls a feature analysis tool based on the MCP protocol to perform feature analysis on the structured portrait data corresponding to the user using the feature analysis tool to obtain a feature analysis result; If the anomaly detection large model cannot directly perform anomaly detection on the feature analysis results, the anomaly detection large model calls the anomaly detection tool based on the MCP protocol, so as to utilize the anomaly detection tool to perform anomaly detection on the feature analysis results based on the anomaly detection strategy in the anomaly strategy template library, and obtain the target anomaly feature information and its score.

6. The method according to claim 1, characterized in that The strategy generation model corresponds to a fourth prompt word, and the fourth prompt word includes fourth task description information; the target anomaly feature information and its score are input into the strategy generation agent, the strategy generation model is called to generate an Nth anomaly detection strategy, and the anomaly strategy template library is updated according to the Nth anomaly detection strategy, including: Inputting the target anomaly feature information and the fourth prompt word into the strategy generation agent, calling the strategy generation macromodel to perform task decomposition based on the fourth task description information to obtain multiple fourth subtasks, and determining whether each fourth subtask can be directly completed by the strategy generation macromodel itself, wherein the multiple fourth subtasks include generating anomaly detection strategies and updating the anomaly strategy template library; If the strategy generation model cannot directly generate the Nth anomaly detection strategy, the strategy generation model calls the strategy generation tool based on the MCP protocol to use the strategy generation tool to generate the Nth anomaly detection strategy according to the target anomaly feature information and its score; If the policy generation model cannot directly update the abnormal policy template library, the policy generation model calls the abnormal policy template library update tool based on the MCP protocol to use the abnormal policy template library to update the abnormal policy template library according to the Nth abnormality detection strategy.

7. The method according to claim 6, characterized in that The strategy generation tool is used to generate an N-th anomaly detection strategy, including: Obtain the historical anomaly detection strategies in the anomaly strategy template library updated according to the N-1th anomaly detection strategy, where each historical anomaly detection strategy contains at least one anomaly feature information; Determining whether each target anomaly feature information is compatible with at least one historical anomaly feature information included in each historical anomaly detection strategy; If they are compatible, then an N-th anomaly detection strategy is generated based on the compatible target anomaly feature information and each historical anomaly feature information in the corresponding historical anomaly detection strategy, where the N-th anomaly detection strategy is a comprehensive feature detection strategy; If they are incompatible, an N-th anomaly detection strategy is generated based on the incompatible target anomaly feature information, where the N-th anomaly detection strategy is a single feature detection strategy.

8. The method according to claim 7, characterized in that Determining whether each target anomaly feature information is compatible with at least one historical anomaly feature information included in each historical anomaly detection strategy includes: Determine whether each target abnormal feature information contains time information; If not, determining whether each target anomaly feature information is compatible with the at least one historical anomaly feature information included in each historical anomaly detection strategy based on the logical semantics of each target anomaly feature information and the at least one historical anomaly feature information included in each historical anomaly detection strategy; If included, determine whether the time information of each target abnormality feature information and at least one historical abnormality feature information included in each historical abnormality detection strategy is mutually exclusive; if so, determine whether each target abnormality feature information is incompatible with at least one historical abnormality feature information included in each historical abnormality detection strategy; if not, based on the logical semantics of each target abnormality feature information and at least one historical abnormality feature information included in each historical abnormality detection strategy, determine whether each target abnormality feature information is compatible with at least one historical abnormality feature information included in each historical abnormality detection strategy.

9. The method according to any one of claims 1 to 8, characterized in that Also includes: The Nth anomaly detection strategy is input into the strategy reporting agent, the strategy reporting agent encapsulating a strategy report generation model, the strategy report generation model corresponding to a fifth prompt word, and the fifth prompt word including fifth task description information; the strategy reporting agent calls the strategy report generation model to perform task decomposition based on the fifth task description information to obtain multiple fifth subtasks, and determines whether each fifth subtask can be directly completed by the strategy report generation model itself. The multiple fifth subtasks include generating an inference link of the anomaly detection strategy, performing natural language understanding processing on the inference link, and performing structured processing on the natural language processing results; If the strategy report generation model can directly generate the reasoning link of the anomaly detection strategy, then the strategy report generation model generates the reasoning link of each anomaly detection strategy in the Nth anomaly detection strategy based on the Nth anomaly detection strategy; If the strategy report generation model can directly perform self-language understanding processing on the reasoning link, the strategy report generation model performs natural language processing based on the reasoning link of each anomaly detection strategy to obtain the natural language processing results corresponding to the reasoning link of each anomaly detection strategy; If the strategy report generation model can directly perform structured processing on the natural language processing results, the strategy report generation model performs structured processing based on the natural language processing results to obtain explanation reports corresponding to the various anomaly detection strategies.

10. An electronic device, characterized in that: include: memory and processor; The memory is used to store a computer program; the processor is coupled to the memory and is used to execute the computer program to implement the steps in any one of the methods of claims 1-9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is caused to implement the steps in any one of the methods of claims 1 to 9.

12. A computer program product, characterized in that The computer program product comprises a computer program / instruction, which, when executed by a processor, enables the processor to implement the steps of any one of the methods of claims 1 to 9.

Images