An intelligent algorithm proprietary cloud center safe operation system

Abstract

The application relates to the field of cloud computing, in particular to a smart calculation special cloud center safe operation system, which comprises a data acquisition and enrichment module, is used for converging multi-source safe logs, telemetry data and threat intelligence, and carries out standardized structure extraction and risk assessment by referring to MITRE ATT&CK and a network security response model; an response planning module generates an ordered mitigation scheme for the structured data by a large integrated language model; a task decomposition module converts the response scheme into executable subtasks and dynamically adjusts script content; a man-machine verification module supports experts to audit and confirm the execution steps; an execution module completes the mitigation action by combining static / dynamic analysis, active response, script interpretation and distributed command issuing; a monitoring and feedback module evaluates whether the threat is eliminated after execution ends, supports scheme iteration and knowledge sedimentation; a vector database stores historical event vectors and disposal records, provides decision support for matching similar scenes, and realizes an automatic response and a closed-loop mechanism of continuous evolution. The application can solve the problems of the prior art, such as untimely response, non-in-depth analysis and safe operation islandization of the cloud center.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a secure operation system for a smart private cloud center. Background Technology

[0002] With the rapid development of computing-intensive businesses such as artificial intelligence and big data, intelligent computing private cloud centers, as the core infrastructure supporting the operation of intelligent computing tasks, have gradually become core resource nodes in key industries such as scientific research, high-end manufacturing, and energy. Intelligent computing private cloud centers gather high-performance resources such as large-scale GPUs and AI accelerators. Their operating environment faces highly complex network structures and widely open access permissions, thus becoming a key target for emerging attacks such as advanced persistent threats (APTs) and supply chain attacks.

[0003] Currently, although some intelligent computing private cloud centers have deployed traditional SOAR platforms for unified orchestration of security tools and automated handling of security incidents, these systems are mostly built on static templates and preset processes. They lack the ability to adapt to complex scenarios such as multi-tenancy, multi-model, and heterogeneous computing power in intelligent computing environments. They are unable to respond to dynamic attacks and abnormal behaviors against intelligent computing resources in a timely and accurate manner, resulting in problems such as untimely response, insufficient analysis, and isolated security operations. Summary of the Invention

[0004] In view of the above technical problems, the present invention provides a secure operation system for a smart computing private cloud center to solve the problems of untimely response, insufficient analysis, and isolated security operation in existing cloud centers.

[0005] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0006] According to the present invention, a secure operation system for a smart computing private cloud center is proposed, the secure operation system comprising:

[0007] The data acquisition and enrichment module is used to collect security event data, which comes from security information system and event management system logs, terminal telemetry and threat intelligence data. The module enriches the security event data, maps the extracted attack information to the MITRE ATT&CK knowledge base, and standardizes and decomposes the event process according to the five-stage processing structure in the network security response model to generate structured technical steps, while assessing the event risk.

[0008] A response planning module based on an autonomous agent artificial intelligence language model is used to analyze the enriched security event data using an integrated large language model and automatically generate a response plan for the security event data. The response plan includes multiple ordered technical mitigation steps.

[0009] The task decomposition and script generation module is used to decompose the response plan into an executable sequence of sub-tasks, evaluate the target system environment and collect feedback information from preceding tasks, adjust subsequent action steps based on quantitative risk assessment, and automatically construct corresponding mitigation scripts.

[0010] The human-machine verification module is used to provide a human-machine interaction interface for security analysts to review and adjust the technical steps before executing the mitigation script, and submit the response plan for execution after approval and confirmation.

[0011] The execution module is used to invoke security tools and agents to execute the mitigation script on the target system according to the verified response scheme. During execution, it includes using static and dynamic analysis tools to detect malicious files and behaviors, triggering proactive response actions to block malicious network connections and isolate infected hosts, dynamically executing customized scripts through a code interpreter, and sending commands to a distributed terminal and obtaining execution results through a WebSocket proxy client.

[0012] The monitoring and feedback module is used to continuously monitor the security status of the target environment after the execution module completes all the mitigation scripts, evaluate the threat elimination effect, compare the execution results with the expectations, and if residual threats are found, trigger the response planning module to adjust the response plan and execute iteratively. It also stores the effective response action results in the knowledge base for continuous optimization, forming a closed-loop security response process that combines investigation, verification and proactive monitoring.

[0013] A vector database is used to store vectorized representations of historical security event data and corresponding response measures. The response planning module and the task decomposition and script generation module retrieve historical event information with similar characteristics to the current event based on the vector database to provide decision support.

[0014] Furthermore, the response planning module adopts a multi-agent architecture, which includes at least two large language model agents with different functions and a proxy routing unit. One of the large language model agents focuses on wide-area security policy analysis, general text processing, and strategic threat mitigation, while the other focuses on deep security analysis and advanced query parsing. The proxy routing unit allocates the security event data analysis and response generation requests to the corresponding large language model agents for processing based on predefined routing rules, model expertise, or real-time performance indicators, and enhances the analysis of event context information by combining similar case retrieval results from the vector database.

[0015] Furthermore, the vector database stores vectorized feature representations of historical security incident data and corresponding handling records. The response planning module generates query vectors based on the current security incident and performs a similarity search in the vector database to retrieve historical incidents and their response measures that are similar to the current incident in attack features or context. The retrieval results are used to assist the large language model agent in formulating corresponding response plans.

[0016] Furthermore, the task decomposition and script generation module specifically includes a step splitting submodule, an environment assessment submodule, a risk assessment submodule, and a script construction submodule. The step splitting submodule is used to divide the response plan into several independently executable technical steps. The environment assessment submodule is used to collect the status information of the target system before and after each technical step, and dynamically adjust the execution strategy of subsequent steps based on the feedback results of the previous step. The risk assessment submodule is used to assess the potential impact and risk level of each technical step, and adjust and optimize the response plan under high-risk conditions. The script construction submodule is used to automatically generate corresponding executable scripts or instruction sequences based on the technical steps to achieve corresponding threat mitigation operations.

[0017] Furthermore, the execution module includes a static and dynamic analysis component, an active response component, a code interpreter, and a remote execution agent client. The static and dynamic analysis component is used to perform static analysis and dynamic behavior monitoring on target files and processes during response execution to detect potential malicious code and abnormal activities. The active response component is used to automatically execute real-time threat containment measures, including blocking malicious IP addresses, isolating infected hosts, and deploying security patches to stop attack propagation. The code interpreter is used to dynamically interpret or run code snippets when executing the mitigation script to support custom script execution and unconventional response steps. The remote execution agent client communicates with the central orchestration service through a persistent network connection, receives commands issued by the task decomposition and script generation module in real time, executes the commands on distributed target hosts, and transmits the execution results and related feedback to the monitoring and feedback module.

[0018] Furthermore, the human-machine verification module has a manual review interface, which allows security analysts to review and edit the automatically generated technical steps before the response plan is executed. This ensures that only response plans that have been manually verified and approved are executed by the execution module, thereby introducing expert judgment into the automated response process to improve the accuracy and effectiveness of response measures.

[0019] Furthermore, after executing all steps of the response plan, the monitoring and feedback module continuously monitors the security status of the target system and assesses whether the threat has been completely eliminated. If residual malicious activity or new abnormal signs are detected, the response planning module is triggered to update the response plan and iteratively execute the newly added mitigation script. For response measures that successfully eliminate the threat, the monitoring and feedback module marks the result as verified and stores it in the vector database or knowledge base, so that the security operations system can refer to the verified handling strategy in subsequent security event data, thereby achieving continuous improvement in the proactive monitoring phase.

[0020] The technical solution of the present invention has the following beneficial effects:

[0021] This invention provides a highly automated security orchestration and response security operation system for intelligent computing private cloud centers. It integrates large-scale language models and Agentic AI technology to achieve intelligent closed-loop security response for highly complex computing environments. The system can understand security data from different components such as GPU nodes, AI containers, and computing power scheduling platforms, and automatically generate context-aware response strategies to adapt to the high concurrency, multi-scenario, and multi-attack chain security protection needs of intelligent computing centers.

[0022] Furthermore, while ensuring intelligent and rapid response, this invention introduces a vector database to achieve event similarity matching and experience reuse, and ensures the safety and controllability of critical mitigation operations through a human-machine collaboration mechanism. This invention significantly shortens the response loop time for high-risk events, improves the coverage of automated handling, effectively bridges the gap between computing power services and security operations, and possesses scalable and self-evolving security operation capabilities, providing a forward-looking security protection system for intelligent computing infrastructure. Attached Figure Description

[0023] Figure 1 This is a structural block diagram of a secure operation system for a smart computing private cloud center, as described in the embodiments of this specification. Detailed Implementation

[0024] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make the invention more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of the invention. However, those skilled in the art will recognize that the technical solutions of the invention may be practiced with one or more of these specific details omitted, or other methods, components, apparatus, steps, etc., may be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of the invention.

[0025] Furthermore, the accompanying drawings are merely illustrative of the invention. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0026] This invention provides a secure operation system for a product intelligent computing private cloud center. (See reference...) Figure 1 The diagram shown is a structural block diagram of a secure operation system for a smart computing private cloud center provided according to an embodiment of the present invention. The secure operation system includes:

[0027] The data acquisition and enrichment module 101 is used to collect security event data, which comes from security information system and event management system logs, terminal telemetry and threat intelligence data. The module enriches the security event data, maps the extracted attack information to the MITRE ATT&CK knowledge base, and standardizes and decomposes the event process according to the five-stage processing structure in the network security response model to generate structured technical steps, while assessing the event risk.

[0028] The data acquisition and enrichment module 101 is used to collect multi-source data related to the current security incident. This security incident data includes, but is not limited to, security information system and incident management system (SIEM) logs, endpoint telemetry data, and intelligence data from external threat intelligence sources (such as IOC platforms, APT intelligence reports, and known attack signature databases). This module uses a multi-dimensional acquisition mechanism to form a contextual understanding of attack behavior and, combined with forensic analysis, identifies the root causes and potential threat vectors of the incident, prioritizing attack paths involving high-value assets and critical vulnerabilities.

[0029] In the process of semantic understanding and structuring the collected data, this module maps attack indicators and behavioral information to the MITRE ATT&CK attack technology knowledge base, thereby standardizing the raw data into technical steps with comparability and response guidance significance. Simultaneously, the module references mainstream international cybersecurity response models (such as the five-stage structure in the NIST framework: identification, protection, detection, response, and recovery) to divide the event lifecycle into stages, assisting subsequent modules in planning phased response strategies.

[0030] To further enhance the scientific rigor and controllability of incident response, the data acquisition and enrichment module 101 utilizes the QRA (Quantitative Risk Assessment) method to quantify and score the risk factors involved in an incident. Risk level labels are constructed based on incident severity, attack complexity, propagation path, and resource impact, serving as a crucial reference for prioritizing response plans and allocating strategies. Through this mechanism, the data acquisition and enrichment module achieves the first-stage support of a closed-loop structure of "investigation – verification – proactive monitoring," providing high-quality, structured, and traceable threat information for subsequent response planning and task orchestration.

[0031] The response planning module 102 is based on a language model of autonomous agent artificial intelligence. The response planning module 102 is used to analyze the enriched security event data using an integrated large language model and automatically generate a response plan for the security event data. The response plan includes multiple ordered technical mitigation steps.

[0032] The response planning module 102, based on autonomous agent artificial intelligence technology, integrates multiple large-scale language models with different functions to perform in-depth semantic analysis on structured security event data processed by the data acquisition and enrichment module. Employing the Agentic AI approach, the module uses language model agents to identify attack paths and infer potential impacts within the enriched event context, automatically generating response plans for the current security event based on historical event response experience. These response plans can cover multiple aspects, including attack tracing, initial containment, threat mitigation, and system repair. They also output multiple ordered technical mitigation steps in a structured format, each of which can be executed independently and dynamically adjusted to adapt to the current target environment. Response plans generated through this model possess flexibility, adaptability, and semantic coherence, significantly improving the efficiency and accuracy of response decisions in complex scenarios. This avoids the drawbacks of fixed script templates and rigid rules in traditional SOAR platforms, thus supporting intelligent, context-driven automated cybersecurity response processes.

[0033] The task decomposition and script generation module 103 is used to decompose the response scheme into an executable sequence of sub-tasks, evaluate the target system environment and collect feedback information from preceding tasks, adjust subsequent action steps based on quantitative risk assessment, and automatically construct corresponding mitigation scripts.

[0034] The task decomposition and script generation module 103 is specifically used to refine the response scheme generated by the language model. This includes breaking down the response scheme into a sequence of executable subtasks with logical order, and dynamically evaluating the reachability and impact of each task based on the current target system's operating environment, resource status, and permission configuration. The task decomposition and script generation module 103 further supports real-time adjustment of the execution conditions and paths of subsequent tasks based on the execution feedback of preceding tasks, providing the ability to flexibly reconstruct the response chain, especially when the development of a security incident changes. Furthermore, the task decomposition and script generation module 103 can incorporate a risk quantification model to score the potential system impact, security benefits, and business interruption costs of each mitigation step, and sort and filter tasks based on the risk-benefit ratio to ensure that the system balances security and availability during execution. After the task logic is confirmed, the task decomposition and script generation module 103 can automatically construct standardized mitigation scripts based on the task type and target environment. These scripts support multiple scripting languages ​​or command interfaces, such as Bash, PowerShell, Python, and YARA rules, to achieve cross-platform automated execution.

[0035] The human-machine verification module 104 is used to provide a human-machine interaction interface for security analysts to review and adjust the technical steps before executing the mitigation script, and submit the response plan for execution after approval and confirmation.

[0036] The human-machine verification module 104 provides a manual review mechanism after the security operation system automatically generates a response plan but before the formal execution of the mitigation script. It constructs a visual human-machine interface for security analysts to intervene. This module allows analysts to view the response steps planned by the language model, the task decomposition results, and the automatically generated script content. Analysts can review, adjust, or override each technical step individually, and determine the necessity and risk of script execution based on contextual information. The module includes an interruption mechanism that allows manual termination of the automatic issuance of specific steps in high-risk or uncertain scenarios to prevent misoperation or over-response. Only tasks approved by human review can enter the final execution process, ensuring that expert judgment is embedded on top of intelligent automation, balancing system autonomy and security controllability.

[0037] The execution module 105 is used to invoke security tools and agents to execute the mitigation script on the target system according to the verified response scheme. During execution, it includes using static and dynamic analysis tools to detect malicious files and behaviors, triggering proactive response actions to block malicious network connections and isolate infected hosts, dynamically executing customized scripts through a code interpreter, and sending commands to a distributed terminal and obtaining execution results through a WebSocket proxy client.

[0038] The execution module 105 is used to invoke pre-configured security tools and endpoint agents to implement automated mitigation operations on the target system based on a manually verified response plan. The execution module 105 encompasses multiple execution paths: on the one hand, it utilizes static analysis tools (such as signature-based scanners) and a dynamic behavior analysis engine to perform deep detection of malicious and suspicious files to identify potential attack payloads or covert behavior chains; on the other hand, it triggers built-in proactive response strategies to block detected malicious network connections and isolate infected hosts to prevent lateral movement of attacks. For complex or unstructured tasks, the execution module can also embed a code interpreter to parse and execute dynamically generated script instructions in real time to meet the diverse response needs of different environments. Furthermore, the execution module 105 can deploy a WebSocket protocol proxy client to support continuous connections with large-scale distributed terminals, enabling immediate command issuance and execution result feedback, ensuring efficient, secure, and verifiable command transmission within the response loop.

[0039] The monitoring and feedback module 106 is used to continuously monitor the security status of the target environment after the execution module completes all the mitigation scripts, evaluate the threat elimination effect, compare the execution results with the expectations, and if residual threats are found, trigger the response planning module to adjust the response plan and execute iteratively, and store the effective response action results in the knowledge base for continuous optimization, forming a closed-loop security response process that combines investigation, verification and proactive monitoring.

[0040] The monitoring and feedback module 106 continuously monitors the target system's operational status after the execution module completes all mitigation scripts, proactively assessing whether the threat has been completely eliminated. The monitoring and feedback module 106 collects data such as terminal behavior, network traffic, and asset status in real time, comparing and analyzing this data with the pre-response security baseline and preset mitigation effects to determine if the threat still exists or if new abnormal indicators have appeared. When residual attack behavior or execution deviations are detected, the system automatically triggers the response planning module to reassess the current event context and adjust the response strategy, forming an iterative closed loop. For successfully mitigated cases, the monitoring and feedback module 106 archives the corresponding execution steps, key judgment criteria, and handling effectiveness into a knowledge base as a reference for subsequent event similarity matching and response strategy recommendations. Furthermore, the monitoring and feedback module 106 adopts a three-stage response model of "investigation—verification—proactive monitoring," ensuring closed-loop control while achieving self-evolution and long-term optimization of response capabilities.

[0041] Vector database 107 is used to store vectorized representations of historical security event data and corresponding response measures, wherein the response planning module and the task decomposition and script generation module retrieve historical event information with similar characteristics to the current event based on the vector database to provide decision support.

[0042] Specifically, the vector database 107 is used to efficiently store the semantic vector representations of historical security events and their corresponding response and handling measures. The vector representations are generated by encoding structured security events (including attack paths, attack techniques, environmental characteristics, etc.) using a large model or a specific embedding mechanism, thereby preserving contextual features and attack behavior semantics. The vector database 107 supports vector similarity retrieval. The response planning module and the task decomposition and script generation module can generate query vectors based on the current event to be processed and compare them with historical data to filter out historical cases that are highly similar to the current event in terms of attack methods, asset impact scope, or mitigation paths. Subsequently, the response steps or mitigation scripts from these similar cases can be evaluated, reconstructed, and reused as candidate solutions, providing data-driven decision support for the current response process, significantly improving planning efficiency and action reliability, and thus promoting the continuous learning and evolution capabilities of the entire system.

[0043] In one embodiment, the response planning module employs a multi-agent architecture, which includes at least two large language model agents with different functions and a proxy routing unit. One of the large language model agents focuses on wide-area security policy analysis, general text processing, and strategic threat mitigation, while the other focuses on deep security analysis and advanced query parsing. The proxy routing unit allocates the security event data analysis and response generation requests to the corresponding large language model agents based on predefined routing rules, model expertise, or real-time performance metrics, and enhances the analysis of event context information by combining similar case retrieval results from the vector database.

[0044] Specifically, the response planning module 102 adopts a multi-agent architecture to support intelligent response decisions in complex threat environments. This multi-agent architecture includes at least two large language model (LLM) agents with functional differences, and an agent routing unit for intelligent task allocation. Specifically, one large language model agent performs wide-area security policy analysis, general text semantic processing, and strategic threat mitigation tasks, excelling at formulating comprehensive response strategies from a macro perspective; the other large language model agent focuses on fine-grained security event analysis and complex semantic query parsing tasks, suitable for handling in-depth investigations and technical detail judgments. To achieve efficient division of labor, the agent routing unit dynamically and intelligently routes security event analysis requests and response generation tasks to appropriate language model agents based on predefined routing rules, model expertise, or real-time performance metrics. To improve the completeness and accuracy of the response context, each LLM agent automatically calls historical event records from the vector database during processing, retrieving cases similar to the current event in attack structure, technical path, and contextual patterns based on a vector similarity matching mechanism, as auxiliary knowledge injection to enhance the understanding of the current event and the targeting of the response strategy. By constructing a multi-agent collaborative architecture and combining semantic intelligent routing with a similar case enhancement mechanism, an interpretable, high-precision, and self-learning security response decision-making capability is achieved, effectively breaking through the technical bottlenecks of script rigidity and knowledge silos in traditional SOAR systems.

[0045] In one embodiment, the vector database stores vectorized feature representations of historical security incident data and corresponding handling records. The response planning module generates query vectors based on the current security incident and performs a similarity search in the vector database to retrieve historical incidents and their response measures that are similar to the current incident in attack features or context. The retrieval results are used to assist the large language model agent in formulating corresponding response plans.

[0046] Specifically, the vector database 107 stores vectorized feature representations of historical security events and their corresponding response records. These vectorized features are generated by embedding the contextual information, attack techniques, affected systems, and response results of the security event into a high-dimensional semantic vector, used to support semantic similarity retrieval. Each record in the database not only retains the structural description of the event but also includes the mitigation measures taken and the execution feedback, forming a complete experiential knowledge entry. During operation, the response planning module inputs the current security event to be analyzed into the large language model agent for preprocessing, generating a semantically representative query vector. Subsequently, this query vector is used as a search key to perform a similarity search in the vector database to find historical event records that are similar to the current event in terms of attack structure, behavioral characteristics, and asset impact. The retrieved similar events and their corresponding response steps are injected as prompts into the large language model agent, assisting it in formulating more reasonable and empirically supported response strategies, thereby improving the accuracy, success rate, and industry adaptability of the response plan. By using a similarity matching mechanism driven by a vector database, an intelligent response system with the capabilities of "case reuse" and "experience self-evolution" was constructed. This system enables knowledge reuse and solution transfer in dynamic threat environments, effectively enhancing the generalization ability of response planning and the credibility of decision-making.

[0047] In one embodiment, the task decomposition and script generation module specifically includes a step splitting submodule, an environment assessment submodule, a risk assessment submodule, and a script construction submodule. The step splitting submodule is used to divide the response plan into several independently executable technical steps. The environment assessment submodule is used to collect the status information of the target system before and after each technical step, and dynamically adjust the execution strategy of subsequent steps based on the feedback results of the previous step. The risk assessment submodule is used to assess the potential impact and risk level of each technical step, and adjust and optimize the response plan under high-risk conditions. The script construction submodule is used to automatically generate corresponding executable scripts or instruction sequences based on the technical steps to achieve corresponding threat mitigation operations.

[0048] Specifically, the task decomposition and script generation module 103 further includes a step-splitting submodule, an environment assessment submodule, a risk assessment submodule, and a script construction submodule, used to achieve a structured transformation from response strategy to executable operations. The step-splitting submodule receives the overall response plan generated by the language model agent and breaks it down into several technical steps with clear semantic boundaries and independent execution capabilities. The environment assessment submodule calls the target system's status interface before and after each technical step to collect environmental information (including system status, network connectivity, service operation status, etc.) and dynamically adjusts subsequent operation processes based on the execution feedback of the current step. For example, if a previous step fails to block the threat or the system returns an abnormal status code, an alternative path will be automatically triggered or the priority will be adjusted. The risk assessment submodule assesses the potential impact of each technical step on the target system, including the possibility of service interruption, resource consumption, potential side effects, etc., and generates a risk level label based on quantitative standards. When an operation step is determined to be high-risk or a critical path node, the language model will be invoked to replan the response plan, thereby avoiding systemic damage. The script building submodule is responsible for transforming the broken-down and adjusted technical steps into specific executable instruction sequences. Supported output formats include, but are not limited to, Bash / Python scripts, PowerShell commands, YARA rules, or API call configurations. During script generation, the module considers factors such as the host operating system type, command compatibility, and environment variables to ensure cross-platform consistency and security. Through the collaborative operation of these four submodules, the security operations system can complete the policy implementation and operational execution in the automated response process while ensuring execution effectiveness and system stability, building an intelligent security execution system with high scalability and dynamic adaptability.

[0049] In one embodiment, the execution module includes a static and dynamic analysis component, an active response component, a code interpreter, and a remote execution agent client. The static and dynamic analysis component performs static analysis and dynamic behavior monitoring on target files and processes during response execution to detect potential malicious code and abnormal activity. The active response component automatically executes real-time threat containment measures, including blocking malicious IP addresses, isolating infected hosts, and deploying security patches to stop attack propagation. The code interpreter dynamically interprets or runs code snippets during the execution of the mitigation script to support custom script execution and unconventional response steps. The remote execution agent client communicates with the central orchestration service through a persistent network connection, receives commands from the task decomposition and script generation module in real time, executes the commands on distributed target hosts, and transmits the execution results and related feedback to the monitoring and feedback module.

[0050] The static and dynamic analysis components are used to comprehensively detect target files, processes, and behavioral paths during response execution, identifying potential malicious code and abnormal behavior. Static analysis identifies suspicious objects through hash matching and feature scanning, while dynamic analysis monitors indicators such as system calls, memory changes, and external connections. To support dynamic and flexible responses, this implementation also includes an embedded code interpreter, which can parse and run custom script code output by the task decomposition and script generation module in real time during execution, especially suitable for scenarios where the response plan contains unconventional processes, interactive commands, or platform-related scripts. The remote execution agent client is deployed in distributed terminals or controlled nodes, maintaining communication with the central orchestration service through persistent connections (such as the WebSocket protocol). Upon receiving a task command, the client immediately parses the instruction and executes it in the local system environment, while simultaneously transmitting the task execution status, return output, and exception information back to the monitoring and feedback module in real time, serving as one of the key feedback nodes in the closed-loop process.

[0051] In one embodiment, the human-machine verification module has a manual review interface, which enables security analysts to review and edit the automatically generated technical steps before the response plan is executed. This ensures that only response plans that have been manually verified and approved are executed by the execution module, thereby introducing expert judgment into the automated response process to improve the accuracy and effectiveness of response measures.

[0052] The manual review interface visually displays the complete technical steps and mitigation scripts automatically generated by the response planning and task decomposition modules, allowing security analysts to review, adjust, reorganize, or confirm each item. When analysts identify unreasonable instructions, potential misjudgments, or the need for supplementary strategies, they can edit or overwrite the relevant steps before execution, preventing the automated system from making inappropriate responses in unknown or uncertain situations. By embedding a manual verification process, the human-machine verification module of this invention introduces an expert decision-making guarantee mechanism to the fully automated response process, effectively reducing the risk of misjudgment and over-response while ensuring execution efficiency. It is particularly suitable for critical business systems in intelligent computing private cloud environments that require continuous and high-availability assurance.

[0053] In one embodiment, after executing all steps of the response plan, the monitoring and feedback module continuously monitors the security status of the target system and assesses whether the threat has been completely eliminated. If residual malicious activity or new abnormal signs are detected, the response planning module is triggered to update the response plan and iteratively execute the newly added mitigation script. For response measures that successfully eliminate the threat, the monitoring and feedback module marks the result as verified and stores it in the vector database or knowledge base, so that the security operation system can refer to the verified handling strategy in subsequent security event data, thereby achieving continuous improvement in the proactive monitoring phase.

[0054] This system collects data in real time, including system behavior, network traffic, service status, and user activity logs, and compares this data with the baseline status and expected response results before mitigation to identify any residual threats, abnormal behavior, or new intrusion indications. When an anomaly is detected to persist or new threat indications appear, the monitoring and feedback module automatically triggers the response planning module to update the response plan and iteratively generate new mitigation scripts. These scripts are then distributed to the target environment via task decomposition and execution paths, thus achieving a closed-loop iteration of the response process. For mitigation operations that successfully eliminate threats, the system marks the execution result as "verification passed" and stores it in the vector database or knowledge base in a structured record format, serving as experience data resources for subsequent security incident analysis and response generation. By embedding the closed loop of monitoring-evaluation-feedback-learning into the automated response process, this module implements a continuous improvement mechanism under the proactive monitoring phase, significantly enhancing the adaptive defense and regeneration capabilities of the security operations system in highly complex environments such as intelligent computing private clouds.

[0055] As described above, this invention provides a highly automated security orchestration and response security operation system for intelligent computing private cloud centers. It integrates large-scale language models and Agentic AI technology to achieve intelligent closed-loop security response for highly complex computing environments. The system can understand security data from different components such as GPU nodes, AI containers, and computing power scheduling platforms, and automatically generate context-aware response strategies to adapt to the high concurrency, multi-scenario, and multi-attack chain security protection needs of intelligent computing centers.

[0056] Furthermore, while ensuring intelligent and rapid response, this invention introduces a vector database to achieve event similarity matching and experience reuse, and ensures the safety and controllability of critical mitigation operations through a human-machine collaboration mechanism. This invention significantly shortens the response loop time for high-risk events, improves the coverage of automated handling, effectively bridges the gap between computing power services and security operations, and possesses scalable and self-evolving security operation capabilities, providing a forward-looking security protection system for intelligent computing infrastructure.

[0057] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions of the embodiments of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, portable hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the method according to the exemplary embodiments of the present invention.

[0058] Furthermore, the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0059] It should be noted that although several modules or units of the device for performing actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to exemplary embodiments of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0060] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

[0061] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A secure operation system for a smart computing private cloud center, characterized in that, The security operation system includes: The data acquisition and enrichment module is used to collect security event data, which comes from security information system and event management system logs, terminal telemetry and threat intelligence data. The module enriches the security event data, maps the extracted attack information to the MITRE ATT&CK knowledge base, and standardizes and decomposes the event process according to the five-stage processing structure in the network security response model to generate structured technical steps, while assessing the event risk. A response planning module based on an autonomous agent artificial intelligence language model is used to analyze the enriched security event data using an integrated large language model and automatically generate a response plan for the security event data. The response plan includes multiple ordered technical mitigation steps. The task decomposition and script generation module is used to decompose the response plan into an executable sequence of sub-tasks, evaluate the target system environment and collect feedback information from preceding tasks, adjust subsequent action steps based on quantitative risk assessment, and automatically construct corresponding mitigation scripts. The human-machine verification module is used to provide a human-machine interaction interface for security analysts to review and adjust the technical steps before executing the mitigation script, and submit the response plan for execution after approval and confirmation. The execution module is used to invoke security tools and agents to execute the mitigation script on the target system according to the verified response scheme. During execution, it includes using static and dynamic analysis tools to detect malicious files and behaviors, triggering proactive response actions to block malicious network connections and isolate infected hosts, dynamically executing customized scripts through a code interpreter, and sending commands to a distributed terminal and obtaining execution results through a WebSocket proxy client. The monitoring and feedback module is used to continuously monitor the security status of the target environment after the execution module completes all the mitigation scripts, evaluate the threat elimination effect, compare the execution results with the expectations, and if residual threats are found, trigger the response planning module to adjust the response plan and execute iteratively. It also stores the effective response action results in the knowledge base for continuous optimization, forming a closed-loop security response process that combines investigation, verification and proactive monitoring. A vector database is used to store vectorized representations of historical security event data and corresponding response measures. The response planning module and the task decomposition and script generation module retrieve historical event information with similar characteristics to the current event based on the vector database to provide decision support.

2. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, The response planning module adopts a multi-agent architecture, which includes at least two large language model agents with different functions and a proxy routing unit. One of the large language model agents focuses on wide-area security policy analysis, general text processing, and strategic threat mitigation, while the other focuses on deep security analysis and advanced query parsing. The proxy routing unit allocates the security event data analysis and response generation requests to the corresponding large language model agents for processing based on predefined routing rules, model expertise, or real-time performance indicators, and enhances the analysis of event context information by combining similar case retrieval results from the vector database.

3. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, The vector database stores vectorized feature representations of historical security incident data and corresponding handling records. The response planning module generates query vectors based on the current security incident and performs similarity search in the vector database to retrieve historical incidents and their response measures that are similar to the current incident in attack features or context. The retrieval results are used to assist the large language model agent in formulating corresponding response plans.

4. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, The task decomposition and script generation module specifically includes a step splitting submodule, an environment assessment submodule, a risk assessment submodule, and a script construction submodule. The step splitting submodule is used to divide the response plan into several independently executable technical steps. The environment assessment submodule is used to collect the status information of the target system before and after each technical step, and dynamically adjust the execution strategy of subsequent steps based on the feedback results of the previous step. The risk assessment submodule is used to assess the potential impact and risk level of each technical step, and adjust and optimize the response plan under high-risk conditions. The script construction submodule is used to automatically generate corresponding executable scripts or instruction sequences based on the technical steps to achieve corresponding threat mitigation operations.

5. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, The execution module includes a static and dynamic analysis component, an active response component, a code interpreter, and a remote execution agent client. The static and dynamic analysis component performs static analysis and dynamic behavior monitoring on target files and processes during response execution to detect potential malicious code and abnormal activity. The active response component automatically executes real-time threat containment measures, including blocking malicious IP addresses, isolating infected hosts, and deploying security patches to stop attack propagation. The code interpreter dynamically interprets or runs code snippets during the execution of the mitigation script to support custom script execution and unconventional response steps. The remote execution agent client communicates with the central orchestration service through a persistent network connection, receives commands issued by the task decomposition and script generation module in real time, executes the commands on the distributed target host, and transmits the execution results and related feedback to the monitoring and feedback module.

6. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, The human-machine verification module has a manual review interface, which allows security analysts to review and edit the automatically generated technical steps before the response plan is executed. This ensures that only response plans that have been manually verified and approved are executed by the execution module, thereby introducing expert judgment into the automated response process to improve the accuracy and effectiveness of response measures.

7. The intelligent computing private cloud center security operation system according to claim 1, characterized in that, After executing all steps of the response plan, the monitoring and feedback module continuously monitors the security status of the target system and assesses whether the threat has been completely eliminated. If residual malicious activity or new abnormal signs are detected, the response planning module is triggered to update the response plan and iteratively execute the newly added mitigation script. For response measures that successfully eliminate threats, the monitoring and feedback module marks the results as verified and stores them in the vector database or knowledge base, so that the security operations system can refer to the verified handling strategies in subsequent security incident data, thereby achieving continuous improvement in the proactive monitoring phase.

Images