Multi-agent cooperative abnormal information processing method and device, storage medium and program product

Abstract

This application provides a method, device, storage medium, and program product for multi-agent collaborative anomaly detection information processing. In this embodiment, multiple agents form an agent chain. Each agent sequentially retrieves multi-dimensional snapshot data of users from a business database by calling its own encapsulated large model. It then performs profiling analysis on the multi-dimensional snapshots, considering at least user stability and device change trends. The obtained structured profiling data undergoes feature analysis and anomaly detection. Based on the obtained target anomaly feature information and its score, an Nth anomaly detection strategy is generated. The anomaly strategy template library is updated according to the Nth anomaly detection strategy, allowing the anomaly detection agent to perform anomaly detection in the N+1th anomaly information processing process. This multi-agent collaboration and closed-loop mechanism enables continuous self-optimization of the anomaly detection strategy, improving detection accuracy with iteration, thereby reducing false alarm rates and achieving accurate detection of business security risks.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to an anomaly detection method, device, storage medium and program product for multi-agent collaboration. Background Technology

[0002] In the field of business security, risk identification is a crucial step in ensuring stable business operations. The accuracy of risk identification depends on the formulation of risk strategies. Traditional methods for developing risk strategies mainly rely on manual experience rules or machine learning models, but these methods have many limitations and are difficult to meet the needs of modern business security. Manual strategy development is time-consuming and lacks real-time performance, making it difficult to quickly respond to changes in business risks; while machine learning models improve the efficiency of risk identification, they lack interpretability, struggle to meet regulatory compliance requirements, and are highly dependent on data with poor adaptability.

[0003] In recent years, multi-agent collaboration technology has been widely applied in various fields, enabling the completion of complex tasks through the coordinated work of multiple agents. However, the technical problems and application scenarios differ across fields, resulting in variations in the methods of multi-agent collaboration and the functions achieved. While multi-agent collaboration technology has begun to gain attention in the field of business security, a satisfactory solution is currently lacking, and significant shortcomings remain in improving the accuracy of anomaly detection using strategies. Summary of the Invention

[0004] This application provides a method, device, storage medium, and program product for processing anomaly detection information through multi-agent collaboration, in order to improve the accuracy and efficiency of anomaly detection using strategies in the field of business security.

[0005] This application provides a multi-agent collaborative anomaly detection information processing method, comprising: the multi-agent includes a data retrieval agent, a user profiling agent, an anomaly detection agent, and a policy generation agent, wherein the policy generation agent and the anomaly detection agent form a feedback closed-loop link; the method includes: receiving an Nth anomaly detection request, the Nth anomaly detection request containing user identification information; inputting the user identification information into the data retrieval agent, calling a large data retrieval model to retrieve multi-dimensional snapshot data of the user from a business database based on the user identification information, the multi-dimensional snapshot data including at least: user behavior snapshots and device data snapshots corresponding to the time; inputting the user's multi-dimensional snapshot data into the user profiling agent, using a large user profiling model with reference to the average multi-dimensional snapshot data of historical groups, at least from the perspectives of user stability and device change trends to analyze the user's multi-dimensional snapshot data. Dimensional snapshot data is used for profiling to obtain structured user profile data, which includes outlier behavior data and outlier device data. This structured user profile data is then input into an anomaly detection agent. An anomaly detection model, based on anomaly detection strategies in an anomaly strategy template library, performs feature analysis and anomaly detection on the user's structured profile data to obtain anomaly feature information and its score. The anomaly strategy template library is updated based on the anomaly detection strategy generated by the strategy generation agent during the (N-1)th anomaly information processing process. The anomaly feature information and its score are then input into the strategy generation agent, which uses the strategy generation model to generate the Nth anomaly detection strategy and updates the anomaly strategy template library accordingly, so that the anomaly detection agent can perform anomaly detection during the (N+1)th anomaly information processing process.

[0006] This application also provides an electronic device, including: a memory and a processor; the memory for storing a computer program; and the processor, coupled to the memory, for executing the computer program to implement the steps in the above method.

[0007] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps in the above-described method.

[0008] In this embodiment, multiple agents form an agent chain. Each agent invokes its encapsulated large model to sequentially obtain multi-dimensional snapshot data of users from the business database, performs profiling analysis on the multi-dimensional snapshots based on user stability and device change trends, performs feature analysis and anomaly detection on the obtained structured profiling data, and generates an Nth anomaly detection strategy based on the obtained target anomaly feature information and its score. This allows the anomaly strategy template library to be updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection in the (N+1)th anomaly information processing process based on the updated anomaly strategy template library. This enables multi-agent collaboration and a closed-loop mechanism, dynamically realizing anomaly data detection, and continuously self-optimizing the anomaly detection strategy based on the anomaly detection results. The detection accuracy improves with iteration, thereby reducing the false alarm rate and achieving accurate detection of business security risks. Attached Figure Description

[0009] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating an anomaly detection information processing method for multi-agent collaboration provided as an exemplary embodiment of this application; Figure 2a A flowchart illustrating another multi-agent collaborative anomaly detection information processing method provided as another exemplary embodiment of this application; Figure 2b A flowchart illustrating the internal execution process of a data retrieval agent provided for an exemplary embodiment of this application; Figure 2c A flowchart illustrating the internal execution process of a user profiling agent provided as an exemplary embodiment of this application; Figure 2d A flowchart illustrating the internal execution process of an anomaly detection agent provided in an exemplary embodiment of this application; Figure 2e A flowchart illustrating the internal execution process of a strategy generation agent provided in an exemplary embodiment of this application; Figure 2f A flowchart illustrating the internal execution process of a policy reporting agent provided for an exemplary embodiment of this application; Figure 2g A schematic diagram of the timing process of multi-agent collaboration provided for an exemplary embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0011] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0012] Additionally, it should be noted that when user interaction operations or triggering operations are involved in the embodiments of this application, these operations include, but are not limited to, various interaction methods such as touch operations, gesture operations, voice operations, head movement operations, and eye movement operations. Touch operations include, but are not limited to, click operations, double-click operations, long-press operations, swipe operations, pinch operations, or mouse hover operations. Swipe operations include, but are not limited to, straight-line swipes and curved-line swipes.

[0013] Following the aforementioned background technology, in the field of business security, there are still significant technical shortcomings in improving the accuracy of anomaly detection using strategies. In this embodiment, multiple agents form an agent chain. Each agent calls its own encapsulated large model to sequentially obtain multi-dimensional snapshot data of users from the business database, perform profile analysis on the multi-dimensional snapshots based on user stability and device change trends, perform feature analysis and anomaly detection on the obtained structured profile data, and generate the Nth anomaly detection strategy based on the obtained target anomaly feature information and its score. This allows the anomaly strategy template library to be updated according to the Nth anomaly detection strategy, so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process based on the updated anomaly strategy template library. Therefore, a multi-agent collaboration mechanism can be achieved, with the strategy generation agent and the anomaly detection agent forming a feedback closed-loop chain mechanism. This enables multi-agent collaboration and a closed-loop mechanism, dynamically realizing anomaly data detection, and continuously self-optimizing the anomaly detection strategy based on the anomaly detection results. The detection accuracy improves with iteration, thereby reducing the false alarm rate and achieving accurate detection of business security risks.

[0014] The following describes in detail a solution provided by an embodiment of this application, with reference to the accompanying drawings.

[0015] Figure 1 This is a flowchart illustrating a multi-agent collaborative anomaly detection information processing method provided in an embodiment of this application. Figure 2a This document outlines the flowchart of a multi-agent collaborative anomaly detection information processing method provided in an embodiment of this application. Figure 2a As shown, the multi-agent system includes a data retrieval agent, a user profiling agent, an anomaly detection agent, and a policy generation agent, and the policy generation agent and the anomaly detection agent can form a feedback closed-loop link. For example... Figure 1 As shown, the anomaly detection information processing method for multi-agent collaboration includes: 101. Receive the Nth anomaly detection request, which contains the user's identification information; 102. Input the user's identification information into the data retrieval intelligent agent, and call the data retrieval big model to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information. The multi-dimensional snapshot data includes at least: user behavior snapshots and device data snapshots corresponding to the time. 103. Input the user's multi-dimensional snapshot data into the user profile intelligent agent, call the user profile big model and use the average multi-dimensional snapshot data of the historical group as a reference to perform profile analysis on the user's multi-dimensional snapshot data from at least the perspectives of user stability and device change trends, so as to obtain the user's corresponding structured profile data. The structured profile data includes outlier behavior data and outlier device data. 104. Input the structured profile data corresponding to the user into the anomaly detection agent, call the anomaly detection big model to perform feature analysis and anomaly detection on the structured profile data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library, so as to obtain the target anomaly feature information and its score; the anomaly strategy template library is the template library updated by the anomaly detection strategy generated by the strategy generation agent in the N-1th anomaly feature information processing process. 105. Input the target anomaly feature information and its score into the policy generation agent, call the policy generation big model to generate the Nth anomaly detection policy, and update the anomaly policy template library according to the Nth anomaly detection policy so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

[0016] To facilitate understanding, we will first provide a detailed introduction to agents, large models, model context protocols (MCP), and the relationships between them.

[0017] An intelligent agent is a software entity capable of autonomously perceiving its environment, making decisions, and executing actions. A large model is encapsulated within the intelligent agent as a callable module (software library, container, or microservice), with its input / output and context uniformly loaded and managed by the agent's scheduler. In other words, intelligent agents are typically driven by a large model, such as a Large Language Model (LLM), possessing capabilities such as task decomposition, tool invocation, memory management, and multi-turn reasoning. In scenarios such as business security, automated operations and maintenance, and content generation, intelligent agents can independently complete complex tasks or collaborate with other intelligent agents to form multi-agent systems. In other words, the large model can be considered the "brain" of the intelligent agent, responsible for understanding tasks, generating decisions, and invoking instructions; the intelligent agent is the "body" and "nervous system," encapsulating the large model and providing it with memory, tool interfaces, and interaction channels with the outside world. In this application, this relationship allows the large model to overcome the limitations of isolated reasoning, completing complex and dynamic business security policy generation tasks through intelligent agent scheduling, MCP protocol invocation of local tools, and real-time data acquisition, achieving a closed loop from "thinking" to "implementation."

[0018] The MCP protocol is an open standard protocol designed to unify the interaction methods between large models and external data sources, tools, and services. Its core functions include: context data injection, injecting external resources such as files, databases, and API responses into the model's prompt words or working memory; function routing and invocation, allowing large models to dynamically call registration tools (such as searchCustomerData); and prompt word orchestration, modularizing and assembling prompt words in real time to reduce token consumption and improve output quality. MCP adopts a client-server architecture, where hosts (such as chat applications) connect to various MCP servers (such as Google Drive and databases) through MCP clients, using JSON-RPC 2.0 for communication.

[0019] Furthermore, the large model's invocation of the target tool follows the unified interface specification defined by the Model Context Protocol (MCP). Specifically, the large model only needs to generate tool invocation instructions according to the MCP specification, which at least include: (i) a tool identifier; and (ii) a parameter set conforming to the MCP schema. These instructions are converted into standard messages conforming to the JSON-RPC 2.0 format by the MCP Client instance integrated within the intelligent body and sent to the MCP Server via the MCP protocol channel. The MCP Server, acting as a protocol conversion layer, maps and forwards the received standard messages to the corresponding tool implementation: if the tool is implemented as a local function, the MCP Server directly calls the function and passes in the parameters; if the tool is implemented as a RESTful interface, the MCP Server constructs and sends an HTTP request; if the tool is implemented as a database query, the MCP Server executes the corresponding SQL statement. After the tool completes execution, its result is encapsulated by the MCP Server into a return format specified by the MCP protocol and sent back to the MCP Client via the same channel, allowing the large model to continue subsequent inference. Therefore, the large model only needs to target the single abstract interface defined by the MCP protocol, without needing to concern itself with the specific implementation of the tool or the underlying communication protocol. The interface mentioned above is not a traditional REST / gRPC / SQL business interface, but rather the executable tool itself invoked by the large model according to the MCP protocol. The MCP Server, acting as a protocol adaptation layer, translates the unified invocation instructions defined by the MCP protocol into execution instructions for the corresponding tool, including but not limited to REST requests, SQL queries, or local function calls. The large language model only needs to generate invocation instructions in accordance with the MCP protocol specification, without needing to concern itself with the specific implementation of the tool or the underlying communication protocol.

[0020] It should be noted that the large models involved in the embodiments of this application refer to models whose parameters meet the set parameter quantity requirements. The parameter quantity requirements are not specifically limited and can have different definitions in different scenarios or fields. For example, in some scenarios or fields, a large model refers to a model with a parameter scale reaching tens of billions, hundreds of billions, or even trillions. However, this definition of the model parameter quantity is merely an example and does not constitute a limitation on the technical solution of this application. A large model can be an AI model, such as an AI large language model with powerful language understanding and generation capabilities.

[0021] The combination of intelligent agents and the MCP protocol forms a collaborative model of "intelligent agent + toolchain," achieving the following technical effects: standardized tool invocation, where intelligent agents call external tools (such as database queries and API services) based on the unified MCP interface, eliminating the need for hard-coding tool logic within the intelligent agent and decoupling tools from the model; real-time context synchronization, where the MCP server continuously maintains and updates the data source, allowing intelligent agents to obtain the latest context information (such as real-time transaction records) in real time and dynamically optimize decisions accordingly; and multi-agent collaboration, where multiple intelligent agents achieve data interoperability and task collaboration by sharing unified resources exposed by the MCP server (such as a unified user profile database). For example, in risk control scenarios, the data retrieval intelligent agent and the anomaly detection intelligent agent share the same database connected to the same MCP server to complete joint analysis. In summary, intelligent agents provide autonomous decision-making and task execution capabilities, while the MCP protocol provides standardized tools and data connectivity capabilities. The combination of these two enables AI systems to possess a complete closed loop of "perception-decision-action-feedback," significantly improving the automation and intelligence level of business scenarios.

[0022] When a large model within an agent invokes a tool to complete a task via the MCP protocol, the execution of each task typically takes place in the agent's external environment. Specifically, this is accomplished sequentially through the following layers: (a) Instruction Generation Layer: The large model generates an MCP invocation instruction containing the tool identifier and parameters within the agent; (b) Protocol Encapsulation Layer: The MCP Client integrated into the agent serializes this instruction into a JSON-RPC message conforming to the MCP protocol format; (c) Protocol Conversion Layer: The MCP Server receives the message, maps it, and forwards it to the corresponding external tool execution environment, which includes, but is not limited to, local software modules, database interfaces, or API services; (d) Tool Execution Layer: The external tool completes the specific task based on the received parameters and returns the execution result to the MCP Server in the format specified by the MCP protocol; (e) Result Feedback Layer: The MCP Server sends the result back to the large model via the MCP Client for further reasoning or decision-making. Therefore, the large model only needs to call any external tool by facing a single abstract interface defined by the MCP protocol, without needing to know the specific implementation details of the tool, thus achieving decoupling between the tool and the model and improving the scalability and flexibility of the system.

[0023] It should be noted that in the following embodiments of this application, when each intelligent agent calls the tool through the large model, the above implementation method can be used for the call, and will not be repeated in the following embodiments.

[0024] In this embodiment, the executing entity of the above-mentioned multi-agent collaborative anomaly detection information processing method is not limited. The executing entity can be a local computing platform (also known as a local server) and / or a third-party platform (also known as a third-party server). A local computing platform refers to hardware, virtual machines, or private cloud resources directly owned or fully controlled by the system operator, used to process business data belonging to that operator. A third-party computing platform refers to an independent entity not owned by the operator but authorized to provide computing services. Its hardware, virtual resources, and underlying software are independently operated and maintained by the third party, and it only accesses the operator's business data or services through controlled interfaces, such as cloud service providers, partner companies, or entrusted data centers.

[0025] It should be noted that the collaborative multi-agent system in this embodiment, including the data retrieval agent, user profiling agent, anomaly detection agent, and policy generation agent, can be deployed on the same execution entity or on different execution entities. That is, the data retrieval agent, user profiling agent, anomaly detection agent, and policy generation agent can all be deployed on a local computing platform, all on a third-party computing platform, or some can be deployed on local computing nodes and others on a third-party computing platform. When the collaborative multi-agent system is deployed on different execution entities, the different execution entities can share the processing results of each agent through encrypted communication links. This embodiment does not impose any limitations on this; it depends on the specific requirements.

[0026] In this embodiment, an anomaly detection request can be sent to the execution entity. The anomaly detection request includes the user's identification information. The user refers to the person for whom the anomaly detection request requires an error. The execution entity can receive this Nth anomaly detection request, where N is a positive integer greater than or equal to 1. This embodiment does not limit the execution entity sending the anomaly detection request; for example, it could be an anomaly detection request sent by maintenance personnel through an anomaly detection request interface, or it could be the execution entity performing the anomaly detection. Furthermore, if anomaly detection is required for at least one aspect of device operation data related to the user, the anomaly detection request can also include at least one aspect of device identification information, such as the identification information of a certain hardware component or software component of the device. Furthermore, if anomaly detection is required for the business data of at least one service related to the user, the anomaly detection request can also include the business identification information of at least one service related to the user, and so on.

[0027] In this embodiment, user identification information can be input into a data retrieval agent. A large-scale data retrieval model is then invoked to retrieve multi-dimensional snapshot data of the user from a business database based on the user's identification information. This multi-dimensional snapshot data includes at least two time-corresponding snapshots: user behavior snapshots and device data snapshots. The business database can be the database of the business to which the multi-agent collaborative anomaly detection information processing method is applied, or the anomaly detection request may also carry a business identifier, based on which multi-dimensional snapshot data is retrieved from the corresponding business database. User behavior snapshots store aggregated and structured user behavior data, while device data snapshots contain aggregated and structured device operation data. These two types of snapshots have a temporal correspondence, forming a related data system; that is, there is a clear mapping relationship between user behavior data and the corresponding device operation data. In other words, user behavior data, representing user actions, drives device operation, thereby generating corresponding device operation data.

[0028] In one optional embodiment, when the data retrieval agent invokes the data retrieval big model to retrieve multi-dimensional snapshot data of the user from the business database based on the user's identification information, the data retrieval big model can directly obtain at least user behavior data and device operation data from the business database, and aggregate and structure the user behavior data and device operation data respectively to obtain a multi-dimensional data snapshot that at least includes user behavior snapshots and device operation snapshots; alternatively, the big model can also obtain tools with corresponding functions based on the MCP protocol to obtain at least user behavior data and device operation data from the business database, and aggregate and structure the user behavior data and device operation data respectively to obtain a multi-dimensional data snapshot that at least includes user behavior snapshots and device operation snapshots; or, some operations can be directly executed by the big model, while others can be executed by the big model using tools with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it depends on the specific needs or whether the big model can directly execute the corresponding operations. For specific implementation methods of invoking the data retrieval big model to retrieve multi-dimensional snapshot data of the user from the business database based on the user's identification information, please refer to the relevant descriptions in the following embodiments, which will not be repeated here.

[0029] Furthermore, if it is necessary to perform anomaly detection on snapshots of other dimensions besides user behavior snapshots and device operation snapshots, snapshots of other dimensions can be obtained in the manner described above. Moreover, the snapshots of each dimension are also corresponding in time, forming a mappable and related data system.

[0030] The technical solutions provided by the above-mentioned embodiments related to data retrieval intelligent agents firstly acquire time-aligned user behavior snapshots and device operation snapshots simultaneously in a single retrieval, forming a mappable associated data system. This avoids delays and errors caused by subsequent cross-source stitching and facilitates data comparison. Secondly, large models can directly complete aggregation and structuring, or external tools can be called on demand through the MCP protocol to achieve a hybrid mode of model self-processing and tool-assisted processing, reducing dependence on single computing power or permissions. In addition, regardless of the execution path used, a unified format of multi-dimensional data snapshots is ultimately output, providing standardized input for downstream user profiling intelligent agents and anomaly detection intelligent agents, which can improve the consistency and scalability of the overall anomaly detection chain.

[0031] In this embodiment, after the data retrieval agent obtains multi-dimensional snapshot data, the user's multi-dimensional snapshot data can be input into the user profiling agent. The user profiling model is then invoked, using the average multi-dimensional snapshot data of the historical group as a reference. At least from the perspectives of user stability and device change trends, the user's multi-dimensional snapshot data is analyzed to obtain the user's corresponding structured profile data. This structured profile data includes outlier behavior data and outlier device data. The historical group refers to other historical users included in the business database. The average multi-dimensional snapshot data refers to the average of the snapshots of other historical users in each dimension. Outlier behavior data refers to the set of user behavior metrics that, after the aforementioned stability analysis, are determined to significantly deviate from the group distribution. This data is output in a structured form for subsequent anomaly detection strategy generation. For example, the Z-score (the difference between the behavior value and the group mean) is greater than a preset threshold, or the distribution entropy of the behavior sequence is higher than the upper quartile of the group. Outlier device data refers to the set of records where device metrics exceed the group's tolerance range after device change trend analysis. This data can also be output in a structured form to provide device-dimensional characteristics for anomaly strategies. For example, the number of device replacements or the distance of geographical location jumps may exceed the group's upper limit, or the device fingerprint change rate may be higher than a preset percentage.

[0032] Specifically, the user profiling agent invokes a large-scale user profiling model, referencing the average multi-dimensional snapshot data of historical groups, to perform profiling analysis on the multi-dimensional snapshot data of users, at least from the perspectives of user stability and device change trends. This can involve using the average user behavior snapshot data of historical groups as a reference to perform profiling analysis on user behavior snapshots from the perspective of user stability, and using the average device snapshot data of historical groups as a reference to perform profiling analysis on device data snapshots from the perspective of device change trends. Specifically, using the average user behavior snapshot data of historical groups as a reference to perform profiling analysis on user behavior snapshots from the perspective of user stability can be achieved by using the large-scale user profiling model to statistically compare the target user's behavior snapshots (such as login frequency, transaction count, and distribution of active periods) within a continuous time window with the average / standard deviation of historical groups within the same time window, calculating stability indicators (such as coefficient of variation, entropy, or moving standard deviation). When the fluctuation of a user behavior sequence is significantly higher than a group threshold, it is marked as an anomaly in stability, forming a stability profile label. Using historical average device snapshot data as a reference, the device data snapshot is profiled based on the device change trend. This can be done by performing time series analysis on user device snapshot sequences (device unique identifier, model, geographical location, system version, sensor readings, etc.) to extract trend features (such as device replacement frequency, geographical location drift distance, hardware fingerprint change rate). By comparing with the group's baseline trend, the magnitude of changes exceeding the normal range is identified, and a device change trend profile is generated.

[0033] Furthermore, when the user profiling agent invokes the large user profiling model to perform profiling analysis on the multi-dimensional snapshot data of users, at least from the perspectives of user stability and device change trends, the large user profiling model can directly perform profiling analysis on user behavior snapshots from the perspective of user stability, and on device snapshots from the perspective of device change trends, using the average user behavior snapshot data of the historical group as a reference. Alternatively, the large model can also obtain tools with corresponding functions based on the MCP protocol to perform profiling analysis on user behavior snapshots from the perspective of user stability, and on device snapshots from the perspective of device change trends, using the average user behavior snapshot data of the historical group as a reference. Or, some operations can be performed directly by the large model, while others can be performed by the large model using tools with corresponding functions obtained based on the MCP protocol. This embodiment does not limit this; it depends on specific needs or whether the large model can directly perform the corresponding operations. For the user profiling intelligent agent, the user profiling big model is called with reference to the average multi-dimensional snapshot data of the historical group. At least from the perspective of user stability and device change trends, the multi-dimensional snapshot data of the user is used to perform profiling analysis. For more specific implementation methods, please refer to the relevant descriptions in the following embodiments, which will not be elaborated here.

[0034] The technical solutions provided by the above-mentioned embodiments related to user profiling intelligent agents firstly use the historical group mean (or historical group mean ± threshold) as a dynamic benchmark to transform user stability and device change trends into measurable outlier indicators (Z-score, rate of change, etc.), eliminating the subjectivity of manual thresholds; secondly, regardless of whether the large model self-operates or is processed by MCP... The protocol calls external tools, ultimately outputting isomorphic structured profile data containing outlier behavior and device data, which is directly used as input to downstream anomaly detection agents, avoiding secondary format conversion. Furthermore, it supports three modes: large model self-computation, tool invocation, and hybrid execution. These modes can be flexibly switched according to data sensitivity or real-time requirements, ensuring sensitive data remains within the domain (i.e., to prevent leakage of original user data, a large model can directly complete the profile analysis, with the data always residing on the local server and not handed over to external tools). It also allows for horizontal scaling of tool instances in high-concurrency scenarios (i.e., when the number of profile analysis requests is large, time-consuming tasks such as analyzing device change trends can be broken down and processed in parallel by multiple identical tools (horizontal scaling) to distribute the load), improving overall profile throughput and real-time performance (i.e., the combination of parallel processing and elastic invocation increases the speed of the entire profile analysis process).

[0035] In this embodiment, after the user profiling agent obtains the structured profile data corresponding to the user, it can input the structured profile data to the anomaly detection agent. The anomaly detection model then uses an anomaly detection strategy from the anomaly strategy template library to perform feature analysis and anomaly detection on the structured profile data, obtaining target anomaly feature information and its score. The anomaly strategy template library is the updated template library generated by the strategy generation agent during the (N-1)th anomaly feature information processing, based on the (N-1)th anomaly detection strategy update. The anomaly feature information includes anomaly features and their corresponding values; for example, an anomaly feature might be the login frequency of user behavior, with a corresponding value of 100 logins in 30 days. The score for the anomaly feature information can be a confidence score, which characterizes the degree of anomalousness of the anomaly feature information.

[0036] Specifically, when the anomaly detection agent invokes the anomaly detection big model to perform feature analysis and anomaly detection on the user's structured profile data based on the anomaly detection strategies in the anomaly strategy template library, the anomaly detection big model can directly perform feature analysis and anomaly detection on the user's structured profile data based on the anomaly detection strategies in the anomaly strategy template library; alternatively, the anomaly detection big model can also obtain tools with corresponding functions based on the MCP protocol to perform feature analysis and anomaly detection on the user's structured profile data based on the anomaly detection strategies in the anomaly strategy template library; or, some operations can be directly executed by the anomaly detection big model, while others can be executed by the big model obtaining tools with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it depends on the specific needs or whether the big model can directly execute the corresponding operations. For more specific implementation methods of invoking the anomaly detection big model to perform feature analysis and anomaly detection on the user's structured profile data based on the anomaly detection strategies in the anomaly strategy template library, please refer to the relevant descriptions in the following embodiments, which will not be repeated here.

[0037] The technical solutions provided by the above-mentioned embodiments related to the anomaly detection intelligent agent include: First, the anomaly policy template library is updated in real time by the policy generation intelligent agent in the (N-1)th round of closed loop, and the latest policy is used in the Nth round of detection, so that the anomaly rules dynamically iterate with the business confrontation, ensuring the timeliness of detection; Second, the large model takes structured profile data as input and outputs the target anomaly feature information and score at one time, which can avoid the traditional manual parameter tuning of thresholds and improve the quantification accuracy; In addition, it supports three modes: model self-computation, MCP protocol to call external tools, and hybrid execution, which can not only process locally in sensitive scenarios, but also horizontally expand external tool instances under high concurrency, taking into account both data security and system throughput.

[0038] In this embodiment, after the anomaly detection agent obtains the target anomaly feature information and its score, it can input the target anomaly feature information and its score into the policy generation agent, call the policy generation big model to generate the Nth anomaly detection policy, and update the anomaly policy template library according to the Nth anomaly detection policy so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

[0039] Specifically, when the policy generation agent calls the policy generation big model to generate the Nth anomaly detection policy and updates the anomaly policy template library based on the Nth anomaly detection policy, the policy generation big model can directly generate the Nth anomaly detection policy and update the anomaly policy template library accordingly; alternatively, the policy generation big model can also obtain tools with corresponding functions based on the MCP protocol to generate the Nth anomaly detection policy and update the anomaly policy template library accordingly; or, some operations can be directly executed by the anomaly detection big model, while others can be executed by the big model obtaining tools with corresponding functions based on the MCP protocol. This embodiment does not limit this, and it depends on the specific needs or whether the big model can directly execute the corresponding operations. For a more specific implementation of the policy generation big model generating the Nth anomaly detection policy and updating the anomaly policy template library according to the Nth anomaly detection policy, please refer to the relevant description in the following embodiments, which will not be repeated here.

[0040] The technical solution provided by the above-mentioned embodiments related to the policy generation agent firstly utilizes the target anomaly features and their scores generated in the Nth round. The policy generation model then instantly outputs the Nth anomaly detection policy and simultaneously refreshes the anomaly policy template library, enabling the next round (N+1) of detection to directly apply the latest rules, thus shortening the policy iteration cycle. It supports three implementation methods: self-generation of the large model, calling external policy construction tools via the MCP protocol, and hybrid execution. This allows for local closed-loop generation in high-security scenarios and horizontal expansion of the policy generation tool in high-concurrency scenarios, balancing security and performance. Furthermore, the template library continuously absorbs newly generated policies from each round, forming a reusable anomaly detection knowledge base, reducing subsequent cold start costs, and improving overall detection coverage and accuracy.

[0041] The technical solutions provided in the above embodiments of this application involve multiple agents forming an agent chain. Each agent sequentially retrieves multi-dimensional snapshot data of users from the business database by calling its own encapsulated large model. This process involves: profiling the user's multi-dimensional snapshot data based on user stability and device change trends; performing feature analysis and anomaly detection on the obtained structured profile data; and generating an Nth anomaly detection strategy based on the obtained target anomaly feature information and its score. The anomaly strategy template library is then updated according to the Nth anomaly detection strategy, allowing the anomaly detection agent to perform anomaly detection in the (N+1)th anomaly information processing process based on the updated anomaly strategy template library. This enables multi-agent collaboration and a feedback closed-loop mechanism between the strategy generation agent and the anomaly detection agent. It allows for dynamic anomaly data detection and continuous self-optimization of the anomaly detection strategy based on the anomaly detection results. This continuous self-optimization improves the detection accuracy with each iteration, reducing false alarm rates and achieving accurate detection of business security risks.

[0042] In this embodiment, to ensure database security, a corresponding business data retrieval tool based on the MCP protocol can be developed for the database and exposed externally to provide such a tool. Furthermore, to enable the large data model to execute operations more accurately, the large data retrieval model has a corresponding first prompt word, which contains first task description information. This embodiment does not limit the input method of the first prompt word. For example, the first prompt word can be pre-generated and bound to the large data retrieval model. When the data retrieval agent calls the large data retrieval model based on the received user identification information, the first prompt word bound to the large data retrieval model can be automatically input into the model to guide it to perform the corresponding operation. The prompt words corresponding to the large models called by the agents in the following embodiments can also use this input method, which will not be elaborated further in the following embodiments. For example, a comprehensive prompt term can be pre-generated based on the prompt terms corresponding to the large models invoked by each agent. This comprehensive prompt term contains the individual prompt terms, each with its own identifier, such as the identifier information of its corresponding large model. When the user's identifier information is input to the data retrieval agent, the comprehensive prompt term along with the user's identifier information is also input. Whenever any agent in the collaborative multi-agent group receives information and starts its operation, it retrieves the prompt term it needs from the comprehensive prompt term. Alternatively, a comprehensive prompt term can be pre-generated based on the prompt terms corresponding to the large models invoked by each agent. This comprehensive prompt term contains the individual prompt terms, each with its own identifier information, such as the identifier information of its corresponding large model. When the user's identifier information is input to the data retrieval agent, the comprehensive prompt term along with the user's identifier information is also input. The data retrieval agent will then decompose the comprehensive prompt term based on the multiple identifiers contained within it, obtaining the prompt terms corresponding to each large model, and input these decomposed prompt terms to subsequent agents. Furthermore, the task description information contained in the prompts for each intelligent agent may also include one or more subtasks. The corresponding large model can also determine whether each subtask can be completed directly by its own capabilities. If it can be completed directly, the large model can complete it directly; if it cannot be completed directly, the large model can call tools with corresponding functions through the MCP protocol to complete it. However, the above is only an illustrative example and does not constitute a limitation on the technical solution of this application.

[0043] Based on this, in this embodiment, as Figure 2bAs shown, the user's identification information is input into the data retrieval agent, and the data retrieval big model is invoked to retrieve multi-dimensional snapshot data of the user from the business database based on the user's identification information. This includes: inputting the user's identification information and the first prompt word into the data retrieval agent, invoking the data retrieval big model to decompose the task based on the first task description information, obtaining multiple first sub-tasks, and determining whether each first sub-task can be directly completed by the data retrieval big model itself. The multiple first sub-tasks include data retrieval from the business database, aggregation analysis of the retrieved data, and structured processing of the aggregation analysis results. When determining whether each first sub-task can be directly completed by the data retrieval big model itself, the determination can be made for each sub-task at once, or the determination can be made for each sub-task before execution, such as determining the next sub-task after the previous sub-task has been executed and before the next sub-task is executed. Furthermore, the data retrieval big model determines whether it can directly complete the data retrieval from the business database using its own capabilities. According to the retrieval process, if the large data retrieval model cannot directly retrieve data from the business database, it will invoke the business data retrieval tool based on the MCP protocol. This tool will then retrieve the user's multi-dimensional business data from the business database using the user's identification information. Conversely, if the large data retrieval model can directly retrieve the user's multi-dimensional business data from the business database, it can retrieve the user's multi-dimensional business data directly. Furthermore, after obtaining the user's multi-dimensional business data, the large data retrieval model will determine whether it can directly perform aggregation analysis on the multi-dimensional business data. If it cannot directly perform aggregation analysis, it will invoke the aggregation analysis tool based on the MCP protocol to perform aggregation analysis on the multi-dimensional business data and obtain the user's corresponding aggregation analysis results. If the large data retrieval model can directly perform structured processing on the aggregation analysis results, the aggregation analysis results will be input into the large data retrieval model for structured processing, resulting in the user's multi-dimensional snapshot data. Therefore, the macro-retrieval task is broken down into multiple sub-tasks and assigned to different execution entities, eliminating single-point bottlenecks and improving process controllability; after the large model self-checks, it seamlessly calls the tool's extension capabilities through the MCP protocol, ensuring that the data does not leave the domain and supporting high-concurrency expansion, thus shortening the data preparation latency; the sub-task results are uniformly output as multi-dimensional snapshot data, providing standardized input for downstream anomaly detection and reducing conversion overhead.

[0044] In some optional embodiments, aggregation analysis tools are used to perform aggregation analysis on multi-dimensional business data to obtain aggregation analysis results corresponding to users. This includes: using aggregation analysis tools, based on aggregation rules, to determine the various time windows involved in the user's multi-dimensional business data. The aggregation rules are guiding strategies used to guide the aggregation analysis tools to perform aggregation analysis on multi-dimensional business data to obtain aggregation analysis results. The aggregation rules include at least time window rules. Time window information can be, for example, fixed window rules (dividing time slices by fixed length, such as "last 7 days", "last 30 days", and four equal-length time periods: "0-6 AM", "6-12 PM", "12-6 PM", and "6-11 AM", calculating the number of logins and the total transaction amount within each time period), or sliding window rules (using a "24-hour sliding window with a 1-hour step" to count the "cumulative number of transactions in the last 24 hours" for each 1-hour slice, capturing short-term fluctuations). The rules include: conversation window rules (using "continuous inactivity exceeding 30 minutes" as the conversation end marker, aggregating all behaviors within the conversation (clicks, payments, chat word count) into a single conversation feature); business cycle window rules (divided by "natural week, natural month, and holidays," statistically analyzing user activity differences between holidays and non-holidays); further, the aggregation rules also include: multi-dimensional aggregation and classification of multi-dimensional business data based on various time windows involved by users to obtain multi-dimensional aggregated classification data, i.e., aggregating data of each dimension at the corresponding time window granularity; for the aggregated classification data of any dimension, vectorization processing is performed to obtain multiple feature information vectors for each dimension. These multiple feature information vectors can be numerical statistical / time series feature vectors, i.e., composed of statistics (mean, variance, percentiles, etc.), time series features (moving difference, trend slope), and discrete category One-Hot / Embedding. The concatenated high-dimensional floating-point vector directly represents the quantitative pattern of user behavior or device operation. Pairwise similarity calculations are performed on multiple feature information vectors in any dimension to obtain multiple first similarity calculation results for each dimension. Based on these first similarity calculation results, one feature information vector from each pair with a similarity greater than the first similarity threshold is retained to obtain the first candidate anomaly feature information vector for each dimension. These first candidate anomaly feature information vectors are then format-converted to obtain the first candidate anomaly feature information, which is used as the aggregation analysis result corresponding to the user. Thus, multi-dimensional raw data is aggregated at once using a time window, significantly reducing data volume and subsequent computational complexity. Redundancy is removed using a similarity threshold, retaining only the most discriminative candidate anomaly feature information vector, improving the signal-to-noise ratio of anomaly signals. The vectorized numerical results are converted into structured fields, directly available for downstream anomaly detection and strategy generation modules, avoiding secondary parsing, shortening the anomaly identification link latency, and enhancing auditability.

[0045] In some optional embodiments, multi-dimensional business data is aggregated and classified in multiple dimensions based on the various time windows involved by the user to obtain multi-dimensional aggregated and classified data. This includes: dividing the user behavior timeline into several continuous or overlapping time windows according to aggregation rules (fixed window, sliding window, session window, or business cycle window, etc.); each window is uniquely identified by a start timestamp and an end timestamp; within each time window, the original business data is mapped according to the three dimensions of "user-behavior-device", such as user dimension including but not limited to: user_id, profile tags, behavior dimension including but not limited to: event type (login, payment, chat), number of times, amount, duration, device dimension including but not limited to: device_id, model, geographical location, sensor value; and performing window-level aggregation functions on the mapped triplet data to obtain a window-dimensional-indicator matrix, such as counting class including but not limited to: login_cnt, pay_cnt, summation class including but not limited to: pay_amt_sum, msg_len_sum, statistical class including but not limited to: mean, max, std, and sequence class including but not limited to: GPS. The system generates trajectory lists and battery power sequences. Based on business tags or thresholds, the aggregated indicator matrix is ​​labeled with category tags, such as "high activity," "login from different locations," or "device drift," forming "window-category" key-value pairs. This "window-category-indicator" ternary structure serves as multi-dimensional aggregated classification data for subsequent vectorization and similarity calculations. Through three steps—time window segmentation, dimension mapping, and aggregation classification—the raw, sparse, and heterogeneous multi-dimensional business data is transformed into window-level, categorical, and structured aggregated features. This process compresses the data volume while retaining the time-series, behavior, and device correlation information required for anomaly detection, providing a high signal-to-noise ratio, low latency, and easily scalable input for subsequent vectorization, similarity calculations, and anomaly strategy generation.

[0046] In some optional embodiments, the aggregated classification data for any dimension is vectorized to obtain multiple feature information vectors for each dimension, including: data alignment, expanding the aggregated classification data for each dimension into a numerical sequence in a fixed window order; feature construction, including but not limited to: statistical features (mean, variance, maximum, minimum, percentile), frequency domain features (FFT main frequency energy), time series features (moving difference, trend slope, autoregressive coefficient), and category embedding (one-hot or embedding of discrete category labels); the above features are concatenated in a fixed order into a k-dimensional floating-point vector V_d = [f1,f2,…,f_k]; Z-score or Min-Max normalization is used to eliminate dimensional differences, so that each dimension obtains m window vectors {V_d¹, V_d², …}, i.e., multiple feature information vectors. Thus, the vectorized vectors can retain key anomaly information, enabling subsequent similarity calculations to accurately identify outlier patterns; vector batch processing supports parallel computing, which can shorten the overall latency from aggregation to anomaly strategy output.

[0047] In this embodiment, to ensure database security, a corresponding profile data retrieval tool based on the MCP protocol can be developed for the database and exposed externally to provide a profile data retrieval tool based on the MCP protocol. Furthermore, to enable the large data model to execute the corresponding operations more accurately, the large data retrieval model has a second prompt word, which contains a second task description. The implementation details of the second prompt word can be found in the description of the first prompt word, and will not be repeated here.

[0048] Based on this, in this embodiment, as Figure 2cAs shown, multi-dimensional snapshot data of users is input into the user profile intelligent agent. Using the user profile big model and referencing the average multi-dimensional snapshot data of historical groups, the system performs profile analysis on the multi-dimensional snapshot data of users, at least considering user stability and device change trends, to obtain the corresponding structured profile data. This includes: inputting the user's multi-dimensional snapshot data and second prompt words into the user profile intelligent agent; calling the user profile big model to decompose the task based on the second task description information to obtain multiple second sub-tasks; and determining whether each second sub-task can be directly completed by the user profile big model itself. These multiple second sub-tasks include data retrieval from the profile database and profile analysis of the retrieved data. The determination method for multiple second sub-tasks is similar to the description of the determination method for multiple first sub-tasks, and will not be repeated here. Further, the user profile big model determines whether it can directly retrieve data from the profile database. If the user profile big model cannot directly retrieve data from the profile database, it calls a profile data retrieval tool based on the MCP protocol to retrieve user information from the profile database using the profile data retrieval tool. The basic profile data refers to information directly related to a user's identity or attributes, including but not limited to age, gender, registration duration, and account type. In this embodiment, the basic profile data is used to compare with the historical group average to identify anomalies in user behavior or at the device level. Further, after obtaining the user's basic profile data, the user profile big model determines whether it can directly perform profile analysis on the basic profile data using its own capabilities. If the user profile big model cannot directly perform profile analysis based on the user's basic profile data, then the user profile big model calls a profile analysis tool based on the MCP protocol. Using the profile analysis tool, with the average multi-dimensional snapshot data of the historical group as a reference, it performs profile analysis on the user's multi-dimensional snapshot data from at least the perspectives of user stability and device change trends to obtain the user's structured profile data. Among them, user stability refers to the degree of deviation between a user's behavior snapshot (e.g., the number, frequency, and duration of logging into instant messaging applications) and the average snapshot of users with the same attributes in the historical group within a continuous time window. When the deviation does not exceed a preset threshold, the user's behavior data is determined to be stable; otherwise, when the deviation exceeds the preset threshold, the user's behavior data is determined to be unstable. Device change trend refers to the direction and magnitude of the evolution of user device snapshot sequences (such as device identifier change frequency, geographical location drift, system version change rate, etc.) over time. When the magnitude of this evolution is lower than the baseline change magnitude of devices with the same attributes in the historical group, it is marked as a normal device change trend. Conversely, when the magnitude of this evolution is significantly higher than the baseline change magnitude of devices with the same attributes in the historical group, it is marked as an abnormal device change trend.Therefore, the profiling task is broken down into independent "data retrieval" and "analysis" sub-modules to reduce single-point risks and improve controllability. After the large model self-checks, if it can directly connect to the database or perform analysis, it is processed locally; otherwise, it calls dedicated tools through the MCP protocol to achieve seamless switching between local and external expansion, ensuring data security and supporting high concurrency. The analysis tool uses historical snapshots of the group as a benchmark to quantify behavior and device changes, outputting structured "outlier" tags to reduce human error. Finally, structured data is output uniformly and directly used by downstream detection, avoiding conversion delays and shortening the detection chain.

[0049] In some optional embodiments, using the average multi-dimensional snapshot data of historical groups as a reference, user profile analysis is performed on the multi-dimensional snapshot data of users from at least the perspectives of user stability and device change trends to obtain structured user profile data. This includes: segmenting all historical users in the profile database according to basic profile fields (age, gender, registration duration, account type, etc.); for each segment, calculating the average behavioral snapshot (average number of logins, average transaction amount, etc.) and average device snapshot (average device replacement frequency, average geographical location drift, etc.) of users in that segment within the same time window to form a "segment-benchmark table"; and finding the user's basic profile fields in the "segment-benchmark table". For each segment, the average and standard deviation of that segment are used as the benchmark. User behavior snapshots within a continuous time window are compared to the segment benchmark, such as calculating the Z-score for each indicator as (user value - mean score) / standard deviation, or taking the maximum |Z-score| or weighted composite score as the stability score. If the stability score is greater than a preset threshold, the user behavior is marked as unstable; otherwise, it is marked as stable. Device snapshots of the user within the same window are compared to the segment benchmark, such as calculating the difference in device replacement frequency ΔD and the difference in geographical location drift ΔL. If ΔD or ΔL is greater than a preset threshold, the device change trend is marked as abnormal; otherwise, it is marked as normal. Furthermore, the above markers and corresponding quantitative values ​​can be encapsulated into a standard JSON format as a structured result. The JSON format can be, for example, {"user_id":"U123","behavior_stable":false,"device_trend_abnormal":true,"stability_score":2.8, "trend_delta":3.1}, and this JSON format constitutes the user's structured profile data, which can be directly supplied to the anomaly detection agent. Therefore, by using historical groups with similar attributes as a dynamic benchmark, the stability of behavior and the trend of device changes are quantified using Z-score and difference thresholds, eliminating errors from human experience thresholds and improving the accuracy of anomaly identification. The profile analysis tool internally completes the entire process of segmentation, comparison, and labeling without additional network calls. If the data volume is large, the segmentation calculation results can be cached and reused, allowing subsequent user profiles to be completed in seconds, significantly improving throughput. The unified JSON structure directly connects to the downstream anomaly detection agent, avoiding secondary parsing and format conversion, shortening the overall anomaly detection chain latency, and meeting the requirements for audit traceability.

[0050] In this embodiment, to enable the large model to perform the corresponding operations more accurately, the anomaly detection large model has a third prompt word, which contains third task description information. The implementation details of the third prompt word can be found in the description of the first prompt word, and will not be repeated here.

[0051] Based on this, in this embodiment, as Figure 2dAs shown, the structured profile data corresponding to the user is input into the anomaly detection agent. The anomaly detection big model is invoked to perform feature analysis and anomaly detection on the structured profile data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library, so as to obtain the target anomaly feature information and its score. This includes: inputting the structured profile data corresponding to the user and the third prompt word into the anomaly detection agent, invoking the anomaly detection big model to decompose the task based on the third task description information, obtaining multiple third sub-tasks, and determining whether each third sub-task can be directly completed by the anomaly detection big model itself. The multiple third sub-tasks include feature analysis and anomaly detection on the structured profile data corresponding to the user. The judgment method for multiple third sub-tasks can refer to the relevant judgment method for multiple first sub-tasks. The description is omitted here. Further, the anomaly detection model determines whether it can directly perform feature analysis on the user's structured profile data. If the model cannot directly perform feature analysis, it calls a feature analysis tool based on the MCP protocol to analyze the user's structured profile data and obtain the feature analysis results. If the model cannot directly detect anomalies from the feature analysis results, it calls an anomaly detection tool based on the MCP protocol to use anomaly detection strategies from the anomaly strategy template library to detect anomalies from the feature analysis results and obtain the target anomaly feature information and its score. Feature analysis refers to performing numerical operations or statistical tests on the structured profile data to extract quantitative features that characterize the user's abnormal tendencies, such as calculating behavioral stability Z-score, device drift distance, feature correlation, quantile deviation, etc., outputting a feature vector or feature-threshold pairs. Feature analysis results refer to the structured feature set obtained after the above operations, which can be directly used for anomaly detection. For example, it can be a list of {feature_name, feature_value, threshold, weight} or an equivalent JSON / table structure. Anomaly detection is based on feature analysis results. Users are classified or scored according to rules in the anomaly strategy template library (such as threshold comparison, isolated forest, deviation scoring). The final output is the target anomaly feature information and its score, for example, {"risk_tag":"high activity anomaly","score":0.92}.Therefore, the anomaly strategy template library is updated in real time based on the results of the previous round of strategies. The latest rules are used in the current round of detection, shortening the strategy iteration cycle and improving the timeliness of combating new risks. The large anomaly detection model first checks whether it can independently complete feature analysis / detection. If it cannot, it calls a dedicated tool through the MCP protocol to achieve seamless switching between local inference and external computing power. This ensures that sensitive data does not leave the domain and can cope with high concurrency by horizontally expanding tool instances, thereby improving overall throughput. Whether executed directly by the large model or completed by the tool, it outputs target anomaly feature information and scores in a unified format, which can be directly used by the strategy generation agent to avoid secondary parsing, reduce detection link latency, and meet subsequent auditing and visualization needs.

[0052] In some optional embodiments, feature analysis tools are used to perform feature analysis on the structured profile data corresponding to the user, obtaining feature analysis results, including: receiving structured profile data (including user behavior stability and device change trend quantification values) output by the anomaly detection agent; mapping the profile data to a predefined feature space, such as Z-score, coefficient of variation, and percentile deviation for the behavior dimension, device replacement frequency, geographical drift distance, and version change rate for the device dimension, and behavior-device correlation coefficient for the cross dimension; calculating the above indicators one by one to obtain floating-point values; if the indicators are discrete, performing One-Hot or Embedding processing to form a unified dimension vector; linearly normalizing the feature vector according to the corresponding weight table in the anomaly policy template library to obtain weighted feature values; packaging the feature name, weighted feature value, threshold, and weight into JSON format, which is the feature analysis result and can be directly fed back to the anomaly detection tool for further anomaly scoring. The JSON format can be as follows: {"feature":"behavior_zscore","value":2.8,"threshold":2.0,"weight":0.4}, {"feature":"device_delta_loc","value":15.2,"threshold":10.0,"weight":0.6 } In some optional embodiments, an anomaly detection tool is used to perform anomaly detection on the feature analysis results based on anomaly detection strategies in the anomaly strategy template library, obtaining target anomaly feature information and its score. This includes: when the anomaly detection tool starts, it reads the set of currently effective anomaly detection strategies from the anomaly strategy template library; each anomaly detection strategy contains at least three elements: a list of feature names (feature_list), a judgment operator (operator: >, <, =, in_range, etc.), and a threshold or rule parameter (threshold, weight, score_formula); the feature analysis results (JSON list) obtained in the previous step are mapped to key-value pairs according to feature names, ensuring a one-to-one correspondence with the feature_list in the strategy; for each strategy, the following operations are performed sequentially: extract all feature values ​​required by the strategy, substitute them into the operator and threshold to perform a Boolean judgment to obtain a correct or incorrect result (true / false), and if the condition is met, calculate the individual score according to the strategy's built-in formula: score_i = weight_i × (|value – threshold| / threshold) or a discrete scoring table; sum (or weighted average) the scores of all hit strategies to obtain 0–1. The comprehensive anomaly score S for the interval is calculated. The hit policy name, key feature values, and score S are encapsulated into a structured output. This structured output contains the target anomaly feature information and its score, and can be directly returned to the policy generation agent for the next round of rule updates. The structured input format can be as follows: { "user_id": "U123", "target_anomaly_features": ["behavior_zscore", "device_delta_loc"], "score": 0.87, "risk_level": "high" } In this embodiment, to enable the policy generation model to execute the corresponding operations more accurately, the policy generation model has a fourth prompt word, which contains fourth task description information. For details on the implementation of the fourth prompt word, please refer to the relevant description of the fourth prompt word; it will not be repeated here.

[0053] Based on this, in this embodiment, as Figure 2eAs shown, the target anomaly feature information and its score are input into the policy generation agent. The policy generation big model is invoked to generate the Nth anomaly detection policy, and the anomaly policy template library is updated according to the Nth anomaly detection policy. This includes: inputting the target anomaly feature information and the fourth prompt word into the policy generation agent; invoking the policy generation big model to decompose the task based on the fourth task description information to obtain multiple fourth tasks; and determining whether each fourth sub-task can be directly completed by the policy generation big model itself. The multiple fourth sub-tasks include generating anomaly detection policies and updating the anomaly policy template library. The determination method for multiple fourth sub-tasks can be found in the determination method for multiple fourth sub-tasks. The relevant descriptions of the formula are not repeated here. Further, the strategy generation model determines whether it can directly generate the Nth anomaly detection strategy using its own capabilities. If the strategy generation model cannot directly generate the Nth anomaly detection strategy, it calls the strategy generation tool based on the MCP protocol to generate the Nth anomaly detection strategy according to the target anomaly feature information and its score. If the strategy generation model cannot directly update the anomaly strategy template library, it calls the anomaly strategy template library update tool based on the MCP protocol to update the anomaly strategy template library according to the Nth anomaly detection strategy. Thus, through the three-tiered elastic architecture of the strategy generation model, the MCP protocol, and dedicated tools, real-time generation, downtime-free updates, and high-concurrency expansion of anomaly detection strategies can be achieved. This ensures the real-time nature of strategy iteration while avoiding bottlenecks in the model's own computing power or permissions, forming a closed-loop adaptive risk control system.

[0054] In some optional embodiments, the anomaly detection strategy for the Nth iteration is generated using a strategy generation tool. This includes: obtaining historical anomaly detection strategies from the anomaly strategy template library updated based on the (N-1)th iteration, where each historical anomaly detection strategy contains at least one anomaly feature; determining whether each target anomaly feature is compatible with at least one historical anomaly feature contained in each historical anomaly detection strategy; if compatible, generating the Nth iteration anomaly detection strategy based on the compatible target anomaly feature and the historical anomaly feature in the corresponding historical anomaly detection strategy, whereby the Nth iteration anomaly detection strategy is a comprehensive feature detection strategy; if incompatible, generating the Nth iteration anomaly detection strategy based on the incompatible target anomaly feature, whereby the Nth iteration anomaly detection strategy is a single feature detection strategy. Thus, by first performing a compatibility / mutual exclusion judgment with historical strategies, synonymous or overlapping features are avoided from being repeatedly added to the library, reducing strategy bloat; if compatible, they are merged into a comprehensive feature detection strategy; if incompatible, they are retained as a single feature detection strategy, ensuring a minimum effective set of rules; and the Nth iteration strategy form is decided in real-time based on the (N-1)th iteration template library, achieving zero manual intervention and zero downtime in strategy iteration.

[0055] Optionally, determining whether each target anomaly feature is compatible with at least one historical anomaly feature contained in each historical anomaly detection strategy includes: determining whether each target anomaly feature contains time information; if not, determining whether each target anomaly feature is compatible with at least one historical anomaly feature contained in each historical anomaly detection strategy based on the logical semantics of each target anomaly feature and at least one historical anomaly feature contained in each historical anomaly detection strategy; if so, determining whether the time information of each target anomaly feature is mutually exclusive with at least one historical anomaly feature contained in each historical anomaly detection strategy; if so, determining whether each target anomaly feature is incompatible with at least one historical anomaly feature contained in each historical anomaly detection strategy; if not, determining whether each target anomaly feature is compatible with at least one historical anomaly feature contained in each historical anomaly detection strategy based on the logical semantics of each target anomaly feature and at least one historical anomaly feature contained in each historical anomaly detection strategy.

[0056] For example, anomalous feature information may be semantically mutually exclusive, meaning the features have the same meaning but different granularities, such as "age group" and "age," which have overlapping semantics, so only one needs to be selected. Example: User behavior "login count in the last 10 days" and "login count in the last 20 days," although with different ranges, have the same calculation logic and may be redundant. Value mutual exclusion check: Binary classification features such as "whether a user is new" and "whether a user is returning" cannot both be 1 in the sample. Another example is anomalous feature information that is homologous or synonymous, meaning it comes from the same field or table but is derived in different ways, exhibiting a high degree of overlap. Example: "posting on weekdays" and "posting on weekends," derived from operation timestamps, are mutually exclusive.

[0057] Further optional, such as Figure 2fAs shown, the multi-agent system also includes a policy reporting agent, which generates detection reports. These reports explain the reasons for anomalies in user-related data. For example, the report might state that "recent user behavior exhibits risk factors such as frequent device changes, abnormal operation times, and large IP geographical spans. Policies are generated based on these characteristics, and it is recommended that these be included in the audit list." Specifically, the Nth anomaly detection strategy can be input into the strategy reporting agent. The strategy reporting agent encapsulates a strategy report generation model, which corresponds to a fifth prompt word containing the fifth task description information. The strategy reporting agent calls the strategy report generation model to decompose the task based on the fifth task description information, obtaining multiple fifth sub-tasks, and determines whether each fifth sub-task can be directly completed by the strategy report generation model itself. The multiple fifth sub-tasks include the inference link for generating the anomaly detection strategy, natural language understanding processing of the inference link, and structured processing of the natural language processing results. The inference link refers to the complete logical chain from the anomaly detection strategy output in the strategy generation stage to the final anomaly determination. It includes: the original anomaly feature information that triggers the strategy and its score, the comparison relationship between each feature and the threshold, the internal combination rules of the strategy (AND / OR / weighted), and the resulting anomaly level or action instruction. The action instruction can be in the form of JSON / tree structure for subsequent interpretation. Furthermore, if the strategy report generation model can directly generate the inference chain of the anomaly detection strategy, then the strategy report generation model generates the inference chain of each anomaly detection strategy in the Nth anomaly detection strategy based on the Nth anomaly detection strategy; if the strategy report generation model can directly perform natural language understanding processing on the inference chain, then the strategy report generation model performs natural language processing on the inference chain of each anomaly detection strategy to obtain the natural language processing result corresponding to the inference chain of each anomaly detection strategy; if the strategy report generation model can directly perform structured processing on the natural language processing result, then the strategy report generation model performs structured processing on the natural language processing result to obtain the explanation report corresponding to each anomaly detection strategy. Therefore, the strategy report intelligent agent combines inference links, natural language, and structured reports to automatically convert the Nth anomaly detection strategy into an easy-to-read and auditable explanatory report, meeting the readability needs of regulators and business personnel. The strategy report generation model first checks its own capabilities, and if insufficient, it calls dedicated tools through the MCP protocol to complete link generation, natural language polishing, or format conversion, achieving seamless switching between local inference and external extension, ensuring report output efficiency in high-concurrency scenarios. The report content iterates synchronously with the strategy, and the latest explanation can be generated in seconds as soon as the strategy is updated, reducing the cost of manual writing and review, and improving the real-time performance and compliance of the overall risk control closed loop.

[0058] In an optional embodiment, natural language understanding processing of the inference chain refers to the process of converting the above-mentioned structured logic chain into human-readable natural language text, including: translating feature-threshold comparisons into semantic sentences, such as "the number of times a user logs in in the past 7 days exceeds the average of 2.3 standard deviations for the same age group"; and translating logical combinations into causal descriptions, such as "...and the device has been replaced 3 times, therefore it is determined to be high risk".

[0059] In one optional embodiment, structuring the natural language processing results means reorganizing the natural language text into standardized, machine-readable structured data, for example, splitting it into fields such as {rule_id, natural language description, list of abnormal features, trigger threshold, risk level}, and generating JSON, XML, CSV, or other formats that can be inserted into audit systems or reports for easy storage, retrieval, and display.

[0060] In the above embodiments of this application, such as Figure 2g As shown, agents with different roles execute steps 1, 2, 3, 4, 5, and 6 in sequence. The output of each agent is then fed into the next agent to continue working. When the generated strategy has the same or similar cases, the first step is fed back to continue the entire process.

[0061] To facilitate understanding of the above technical solution, a complete example is provided below.

[0062] First, the user enters their identification information, such as user_id = "user_123".

[0063] Furthermore, the data retrieval agent extracts user behavior data, such as login / device / payment data from the last 30 days; however, the number of times within 30 days is relatively high, which poses a risk.

[0064] Furthermore, user profiles can be generated by intelligent agents recognizing device data, such as logging in more than 3 times across regions and preferences for late-night operations.

[0065] Furthermore, the anomaly detection agent identifies high-risk anomaly characteristics.

[0066] Furthermore, the strategy-generating agent infers based on high-risk anomaly characteristic information to generate anomaly detection strategies.

[0067] Specifically, the policy generation agent is responsible for automatically converting the abnormal feature information output by the anomaly detection agent into structured rules. Its core principles include the following four parts: First, strategy template matching (zero-sample reuse stage). A local policy template library is maintained, which stores successfully deployed policy templates. The format can be {“feature expression”: “device switching frequency >= 3 and cross-province IP”, “action”: “add manual review”}. If the current abnormal feature information directly matches a certain template (feature, threshold and logic are completely consistent), the template is immediately reused and all subsequent steps are skipped. Existing policies will not be generated again.

[0068] Second, KMeans behavioral attribution clustering (the starting point when there is no template). When the template library fails to find a match, the policy-generating agent first inputs the anomalous feature information into a local KMeans function for clustering. The input is an anomalous feature vector (e.g., "Nighttime Activity = 1, Cross-Province IP = 1, Device Switching Frequency = 5"), and the output is several clusters. Behaviors within each cluster are similar, but there are significant differences between clusters. After clustering, a "behavior attribution matrix" is constructed—its rows and columns are the cluster ID and feature dimension, respectively, and the values ​​are the average intensity of that feature within the cluster. The matrix's purpose is to compress the chaotic anomalous feature information into a few interpretable, typical behavioral patterns.

[0069] Third, Beam Search rule combinations (multi-path exploration) Starting from each cluster center, the agent initiates Beam Search: State: a policy under construction (feature set + threshold); Action: "Add / delete / modify a feature or threshold" in the current policy; Evaluation function: Policy confidence = f(feature saliency, historical hit rate, business weight). Only Top-K high-scoring paths are retained in each round until a preset depth or confidence convergence is reached. Result: Multiple candidate policies are obtained, each with a confidence score (e.g., 0.92), forming policies with different confidence levels.

[0070] Fourth, conflict detection and redundancy removal (final quality inspection). All candidate strategies undergo final quality control, which includes: a) Conflict detection: If two rules simultaneously hit the same group of users but produce opposite actions, the one with lower confidence is discarded; b) Redundancy removal: If rule A completely includes rule B and both have the same action, only rule A is retained; c) Complexity penalty: Rules that are too long or have too many thresholds are weighted less to prevent overfitting. In summary, the strategy generation agent first queries the existing template library. If no match is found, it clusters abnormal feature information into typical behavioral patterns, then uses Beam Search to attempt to generate new anomaly detection strategies in the pattern space. Finally, quality control removes conflicts and redundancies, outputting the optimal structured anomaly detection strategy that can be directly deployed.

[0071] For example: { "rule": "Device replacement frequency >= 3 and login IP address location changed", "action": "Mark as high risk", "format": "json", "score": 0.92, "origin": ["User Profile", "Anomaly Detection Feedback"] } Furthermore, the strategy reporting agent generates an explanatory report. For example, the explanatory report might state: "Recent user behavior exhibits risk factors such as frequent device changes, abnormal operation times, and large geographical span of IP addresses. The strategy is generated based on these characteristics and is recommended for inclusion in the audit list."

[0072] Figure 3 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. For example... Figure 3 As shown, the electronic device includes: a memory 30a and a processor 30b; the memory 30a is used to store computer programs; the processor 30b is coupled to the memory 30a and is used to execute the computer programs to implement the steps in the above method.

[0073] The detailed implementation methods and beneficial effects of each module in the embodiments of this application have been described in detail in the foregoing embodiments, and will not be elaborated here.

[0074] Furthermore, such as Figure 3 As shown, the electronic device also includes other components such as a communication component 30c, a display 30d, a power supply component 30e, and an audio component 30f. Figure 3 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 3 The components shown. Additionally... Figure 3 The components within the dashed box are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server-side device such as a conventional server, cloud server, or server array. If the electronic device in this embodiment is a terminal device such as a desktop computer, laptop computer, or smartphone, it may include... Figure 3 The components within the dashed box; if the electronic device in this embodiment is implemented as a conventional server, cloud server, or server array, etc., it may be omitted. Figure 3 The component within the dashed box.

[0075] The aforementioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0076] The aforementioned communication components are configured to facilitate wired or wireless communication between the device containing the communication components and other devices. The device containing the communication components can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 6G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication components receive broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication components also include a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), and other technologies.

[0077] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0078] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0079] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0080] Accordingly, exemplary embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps in the above-described method.

[0081] Accordingly, an exemplary embodiment of this application also provides a computer program product comprising a computer program / instructions that, when executed by a processor, cause the processor to perform the steps in the above-described method.

[0082] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0083] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0084] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0085] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0086] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0087] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0088] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0089] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0090] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing anomaly detection information through multi-agent collaboration, characterized in that, The multi-agent system includes a data retrieval agent, a user profiling agent, an anomaly detection agent, and a policy generation agent, with the policy generation agent and the anomaly detection agent forming a feedback loop; the method includes: Receive the Nth anomaly detection request, wherein the Nth anomaly detection request contains the user's identification information; The user's identification information is input into the data retrieval agent, and the data retrieval big model is invoked to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information. The multi-dimensional snapshot data includes at least: user behavior snapshots and device data snapshots corresponding in time. The user's multi-dimensional snapshot data is input into the user profile intelligent agent. The user profile big model is called to perform profile analysis on the user's multi-dimensional snapshot data with reference to the average multi-dimensional snapshot data of the historical group, at least from the perspectives of user stability and device change trends, so as to obtain the user's corresponding structured profile data. The structured profile data includes outlier behavior data and outlier device data. The structured profile data corresponding to the user is input into the anomaly detection agent. The anomaly detection big model is called to perform feature analysis and anomaly detection on the structured profile data corresponding to the user based on the anomaly detection strategy in the anomaly strategy template library, so as to obtain the target anomaly feature information and its score. The anomaly strategy template library is the template library updated by the anomaly detection strategy generated by the strategy generation agent in the N-1th anomaly feature information processing process. The target anomaly feature information and its score are input into the policy generation agent, the policy generation big model is called to generate the Nth anomaly detection policy, and the anomaly policy template library is updated according to the Nth anomaly detection policy so that the anomaly detection agent can perform anomaly detection in the N+1th anomaly information processing process.

2. The method according to claim 1, characterized in that, The business database provides a business data retrieval tool based on the MCP protocol. The large-scale data retrieval model corresponds to a first prompt word, which includes first task description information. The user's identification information is input into the data retrieval agent, and the large-scale data retrieval model is invoked to retrieve the user's multi-dimensional snapshot data from the business database based on the user's identification information, including: The user's identification information and the first prompt word are input into the data retrieval intelligent agent. The data retrieval big model is invoked to decompose the task based on the first task description information to obtain multiple first sub-tasks. It is then determined whether each first sub-task can be directly completed by the data retrieval big model itself. The multiple first sub-tasks include data retrieval from the business database, aggregation analysis of the retrieved data, and structured processing of the aggregation analysis results. If the data retrieval model cannot directly retrieve data from the business database, the data retrieval model calls the business data retrieval tool based on the MCP protocol, so as to use the retrieval tool to retrieve the user's multi-dimensional business data from the business database based on the user's identification information. If the large data retrieval model cannot directly perform aggregation analysis on the multi-dimensional business data, then the large data retrieval model calls an aggregation analysis tool based on the MCP protocol to use the aggregation analysis tool to perform aggregation analysis on the multi-dimensional business data and obtain the aggregation analysis results corresponding to the user.

3. The method according to claim 2, characterized in that, The aggregation analysis tool is used to perform aggregation analysis on the multi-dimensional business data to obtain the aggregation analysis results corresponding to the user, including: Using the aforementioned aggregation analysis tool, based on aggregation rules, the various time windows involved in the user's multi-dimensional business data are determined; Based on the various time windows involved by the user, the multi-dimensional business data is aggregated and classified in multiple dimensions to obtain the multi-dimensional aggregated and classified data. For aggregated classification data of any dimension, vectorization is performed to obtain multiple feature information vectors for each dimension; For multiple feature information vectors in any dimension, pairwise similarity calculations are performed to obtain multiple first similarity calculation results for each dimension; Based on multiple first similarity calculation results in any dimension, one feature information vector from the feature information vector pair with a similarity greater than the first similarity threshold is retained to obtain the first candidate abnormal feature information vector in each dimension. The first candidate anomaly feature information vectors of each dimension are converted to obtain the first candidate anomaly feature information, and the first candidate anomaly feature information is used as the aggregation analysis result corresponding to the user.

4. The method according to claim 1, characterized in that, The user profile database provides a user profile data retrieval tool based on the MCP protocol. The large-scale data retrieval model corresponds to a second prompt word, which contains second task description information. The user's multi-dimensional snapshot data is input into the user profile agent. Using the large-scale user profile model and referencing the average multi-dimensional snapshot data of historical groups, the user's multi-dimensional snapshot data is analyzed to obtain structured user profile data, including: The user's multi-dimensional snapshot data and the second prompt word are input into the user profile intelligent agent. The user profile big model is called to decompose the task based on the second task description information to obtain multiple second sub-tasks. It is determined whether each second sub-task can be completed directly by the user profile big model itself. The multiple second sub-tasks include data retrieval from the profile database and profile analysis of the retrieved data. If the user profile big model cannot directly retrieve data from the profile database, the user profile big model calls the profile data retrieval tool based on the MCP protocol, so as to use the profile data retrieval tool to retrieve the user's basic profile data from the profile database based on the user's identification information. If the user profile model cannot directly perform profile analysis based on the user's basic profile data, the user profile model calls a profile analysis tool based on the MCP protocol. Using the profile analysis tool, with the average multi-dimensional snapshot data of the historical group as a reference, the user's multi-dimensional snapshot data is analyzed from at least the perspectives of user stability and device change trends to obtain the user's structured profile data.

5. The method according to claim 1, characterized in that, The anomaly detection model corresponds to a third prompt word, which contains third task description information. The structured profile data corresponding to the user is input into the anomaly detection agent, and the anomaly detection model is invoked to perform feature analysis and anomaly detection on the structured profile data corresponding to the user based on anomaly detection strategies in the anomaly strategy template library, to obtain target anomaly feature information and its score, including: The structured profile data corresponding to the user and the third prompt word are input into the anomaly detection agent. The anomaly detection big model is called to decompose the task based on the third task description information to obtain multiple third sub-tasks. It is determined whether each third sub-task can be directly completed by the anomaly detection big model itself. The multiple third sub-tasks include feature analysis and anomaly detection of the structured profile data corresponding to the user. If the anomaly detection big model cannot directly perform feature analysis on the structured profile data corresponding to the user, the anomaly detection big model calls a feature analysis tool based on the MCP protocol to perform feature analysis on the structured profile data corresponding to the user and obtain feature analysis results. If the anomaly detection model cannot directly detect anomalies in the feature analysis results, the anomaly detection model calls an anomaly detection tool based on the MCP protocol. The anomaly detection tool then uses the anomaly detection strategy in the anomaly strategy template library to detect anomalies in the feature analysis results, thereby obtaining target anomaly feature information and its score.

6. The method according to claim 1, characterized in that, The strategy generation model corresponds to a fourth prompt word, which contains fourth task description information; the target anomaly feature information and its score are input into the strategy generation agent, the strategy generation model is invoked to generate the Nth anomaly detection strategy, and the anomaly strategy template library is updated according to the Nth anomaly detection strategy, including: The target anomaly feature information and the fourth prompt word are input into the strategy generation agent. The strategy generation big model is called to decompose the task based on the fourth task description information to obtain multiple fourth sub-tasks. It is determined whether each fourth sub-task can be directly completed by the strategy generation big model itself. The multiple fourth sub-tasks include generating anomaly detection strategies and updating the anomaly strategy template library. If the strategy generation model cannot directly generate the Nth anomaly detection strategy, the strategy generation model calls the strategy generation tool based on the MCP protocol to generate the Nth anomaly detection strategy based on the target anomaly feature information and its score. If the strategy generation model cannot directly update the anomaly strategy template library, the strategy generation model calls the anomaly strategy template library update tool based on the MCP protocol to update the anomaly strategy template library according to the Nth anomaly detection strategy.

7. The method according to claim 6, characterized in that, The strategy generation tool is used to generate the Nth anomaly detection strategy, including: Obtain historical anomaly detection strategies from the anomaly strategy template library after the anomaly detection strategy is updated according to the (N-1)th anomaly detection strategy. Each historical anomaly detection strategy contains at least one anomaly feature information. Determine whether the abnormal feature information of each target is compatible with at least one historical abnormal feature information contained in each historical anomaly detection strategy; If compatible, an anomaly detection strategy for the Nth time is generated based on the target anomaly feature information and the historical anomaly feature information in the corresponding historical anomaly detection strategy. The anomaly detection strategy for the Nth time is a comprehensive feature detection strategy. If incompatible, an Nth anomaly detection strategy is generated based on the incompatible target anomaly feature information, wherein the Nth anomaly detection strategy is a single feature detection strategy.

8. The method according to claim 7, characterized in that, Determining whether each target anomaly feature is compatible with at least one historical anomaly feature included in each historical anomaly detection strategy includes: Determine whether the abnormal feature information of each target contains time information; If not included, based on the logical semantics of each target anomaly feature information and at least one historical anomaly feature information contained in each historical anomaly detection strategy, determine whether each target anomaly feature information is compatible with at least one historical anomaly feature information contained in each historical anomaly detection strategy. If included, determine whether the time information of each target anomaly feature information is mutually exclusive with the time information of at least one historical anomaly feature information included in each historical anomaly detection strategy; if yes, determine that each target anomaly feature information is incompatible with at least one historical anomaly feature information included in each historical anomaly detection strategy; if no, determine whether each target anomaly feature information is compatible with at least one historical anomaly feature information included in each historical anomaly detection strategy based on the logical semantics of each target anomaly feature information and at least one historical anomaly feature information included in each historical anomaly detection strategy.

9. The method according to any one of claims 1-8, characterized in that, Also includes: The Nth anomaly detection strategy is input to the strategy reporting agent, which encapsulates a strategy report generation model. The strategy report generation model corresponds to a fifth prompt word, which contains fifth task description information. The strategy reporting agent calls the strategy report generation model to decompose the task based on the fifth task description information, obtaining multiple fifth sub-tasks. It then determines whether each fifth sub-task can be directly completed by the strategy report generation model itself. The multiple fifth sub-tasks include generating an inference chain for the anomaly detection strategy, performing natural language understanding processing on the inference chain, and performing structured processing on the natural language processing results. If the strategy report generation model can directly generate the inference link of the anomaly detection strategy, then the strategy report generation model generates the inference link of each anomaly detection strategy in the Nth anomaly detection strategy based on the Nth anomaly detection strategy. If the strategy report generation model can directly perform natural language understanding processing on the inference link, then the strategy report generation model performs natural language processing based on the inference link of each anomaly detection strategy to obtain the natural language processing result corresponding to the inference link of each anomaly detection strategy. If the strategy report generation model can directly perform structured processing on the natural language processing results, then the strategy report generation model performs structured processing on the natural language processing results to obtain the explanation reports corresponding to each anomaly detection strategy.

10. An electronic device, characterized in that, include: Memory and processor; The memory is used to store a computer program; the processor, coupled to the memory, is used to execute the computer program to implement the steps of the method of any one of claims 1-9.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it causes the processor to perform the steps of any one of claims 1-9.

12. A computer program product, characterized in that, The computer program product includes a computer program / instruction that, when executed by a processor, causes the processor to perform the steps of any one of claims 1-9.

Images