A multi-source security intelligence collaborative analysis method and system of a fusion AI intelligent agent

Abstract

The application relates to the technical field of network and information security, and discloses a multi-source security information collaborative analysis method and system fusing AI intelligent agents, which collects security-related data; carries out cleaning and normalization processing on the collected data, and extracts target security features from the preprocessed data; a plurality of AI intelligent agents are constructed respectively for different data sources, a preliminary threat judgment result is generated through semantic understanding, behavior pattern recognition and association rule mining based on the target security features; the preliminary threat judgment result is subjected to time sequence fusion, a dynamic security situation model is constructed, a threat evolution trend is captured, and the risk level and the priority processing order of an event are dynamically determined in combination with threat information; an AI intelligent agent generates an automatic response suggestion according to the risk level and historical response experience, and the automatic response suggestion is pushed to an operation and maintenance personnel; and the application improves the identification capability for threats.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, specifically to a multi-source security intelligence collaborative analysis method and system that integrates AI intelligent agents. Background Technology

[0002] In existing Security Operation Center (SOC) and Managed Security Service (MSS) systems, security intelligence analysis typically relies on data from multiple sources, such as log data, network traffic data, endpoint monitoring data, and third-party threat intelligence. These data sources are diverse, have inconsistent formats, and weak correlations, requiring security analysts to invest significant manpower in screening, correlating, and evaluating massive amounts of data. This results in low efficiency, high false positive and false negative rates, and difficulty in timely detection of advanced persistent threats (APTs) and complex attack chains.

[0003] In existing technologies, some security analysis systems have attempted to introduce rule engines, big data processing platforms, or simple machine learning algorithms to improve threat detection efficiency, but the following shortcomings still exist:

[0004] (i) The ability to deeply correlate multi-source security data is insufficient, making it impossible to achieve cross-platform, cross-system, and cross-dimensional intelligence integration and dynamic modeling;

[0005] (ii) It lacks an adaptive intelligent analysis and decision-making mechanism, making it difficult to dynamically adjust the analysis logic and strategy according to the attack scenario;

[0006] (iii) Existing rules or models have limited ability to identify new and unknown threats, and rely on experts to continuously and manually update the rule base and model parameters.

[0007] (iv) The lack of intelligent agents' ability to learn autonomously and continuously optimize makes it impossible to effectively reduce the workload and response time of operation and maintenance personnel. Summary of the Invention

[0008] The purpose of this invention is to solve the above problems by designing a multi-source security intelligence collaborative analysis method and system that integrates AI intelligent agents. By introducing AI intelligent agents with autonomous learning and reasoning capabilities, the invention achieves dynamic fusion of multi-source security data, real-time threat correlation analysis, and intelligent decision support, thereby improving the accuracy, timeliness, and automation level of security threat identification.

[0009] The first aspect of this invention provides a method for collaborative analysis of multi-source security intelligence that integrates AI agents, the method comprising the following steps:

[0010] Security-related data is collected from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms.

[0011] The collected data is cleaned and normalized, and target security features are extracted from the preprocessed data.

[0012] Multiple AI agents are constructed for different data sources, and preliminary threat assessment results are generated based on target security characteristics through semantic understanding, behavioral pattern recognition, and association rule mining.

[0013] The initial threat assessment results are fused over time to construct a dynamic security situation model, capture threat evolution trends, and dynamically determine the risk level and priority of events based on threat intelligence.

[0014] Based on risk levels and historical response experience, the AI ​​agent generates automated response suggestions and pushes them to operations and maintenance personnel. These suggestions include alarm escalation, blocking commands, and patch recommendations.

[0015] Optionally, in a first implementation of the first aspect of the present invention, the step of cleaning and normalizing the collected data includes:

[0016] The collected data is format-converted and standardized, converting numerical data into fixed-dimensional vectors and performing one-hot encoding on categorical data;

[0017] An anomaly detection model based on an autoencoder is constructed. The model consists of two parts: an encoder and a decoder. The encoder compresses the processed data into a low-dimensional feature vector, and the decoder reconstructs the low-dimensional vector back to the original data dimension.

[0018] Calculate the reconstruction error between the input data and the reconstruction output of the anomaly detection model. If the reconstruction error exceeds a preset threshold, mark the current data as an anomaly and identify the anomaly.

[0019] Optionally, in a second implementation of the first aspect of the present invention, the step of extracting target security features from preprocessed data includes:

[0020] The preprocessed data is converted into word vectors that the RoBERTa model can recognize. A classification head is added to the output layer of the RoBERTa model, and the model parameters are adjusted through backpropagation.

[0021] The RoBERTa model is used to obtain sentence-level contextual semantic vectors from unstructured data, where the contextual semantic vectors include the association information between words and sentences.

[0022] By using the attention weights output by the RoBERTa model to locate threat-related keywords, and combining them with contextual semantic vectors to determine features, target security features are formed.

[0023] Optionally, in a third implementation of the first aspect of the present invention, the step of generating a preliminary threat determination result based on target security features through semantic understanding, behavioral pattern recognition, and association rule mining includes:

[0024] Extract entities from the target security features and standardize them, define the types of relationships between entities and extract related information;

[0025] The standardized entities are used as nodes, and the extracted relationships are used as directed edges to connect the corresponding nodes, thus constructing an initial attack chain knowledge graph.

[0026] A GNN model is constructed, using the GAT network as the basic framework. Each layer of the network contains a node feature mapping and attention weight calculation module.

[0027] The agent inputs the initial attack chain knowledge graph into the GNN model, aggregates neighbor node information through multi-layer message passing to mine cross-data source associations, and finally generates node embedding vectors containing cross-data source association information.

[0028] The agent extracts the node embedding vectors output by the GNN model and compares them with the similarity of known threat patterns. If the similarity exceeds a preset threshold, it determines that there is a threat in the current associated path. Combined with the relationship attributes, it finally generates a preliminary threat determination result containing the threat entity, the associated path, and the determination basis.

[0029] Optionally, in a fourth implementation of the first aspect of the present invention, the node feature mapping module converts the attribute information of entities into low-dimensional feature vectors; the attention weight calculation module assigns different attention coefficients to adjacent nodes according to the importance of the relationship between entities.

[0030] Optionally, in the fifth implementation of the first aspect of the present invention, the step of performing time-series fusion on the preliminary threat assessment results to construct a dynamic security situation model and capture threat evolution trends includes:

[0031] The preliminary threat assessment results are time-series aligned to obtain time-series data, and the time-series data within the current time window is input into the dynamic security posture model built based on the TCN network.

[0032] The input layer of the dynamic security situation model converts time-series data into feature vectors. The intermediate layer uses multiple dilated convolutional modules to extract cross-time point correlation features. The output layer outputs a fused feature vector containing time-series trends through global pooling. Each dilated convolutional module contains a convolutional layer, a normalization layer, and an activation function. The dilation coefficient increases with the layer level. A skip connection is added after each dilated convolutional module to add the input and output features of the dilated convolutional module.

[0033] Optionally, in a sixth implementation of the first aspect of the present invention, the step of dynamically determining the risk level and priority order of an event in conjunction with threat intelligence includes:

[0034] Initialize a population containing multiple candidate solutions, each solution corresponding to a set of threat levels and processing order, and calculate the objective function value for each solution;

[0035] The population is divided into different levels by non-dominated sorting, and sorted by crowding within the same level. The next generation of population is generated by selection, crossover and mutation operations, and the process is repeated until the population converges.

[0036] The optimal solution is selected from the convergent population. The solution with the highest threat urgency and the lowest treatment cost among the non-dominated solutions is obtained. The solutions are then sorted by threat level from high to low, and by threat urgency within the same level, to determine the final treatment priority.

[0037] A second aspect of the present invention provides a multi-source security intelligence collaborative analysis system that integrates AI intelligent agents, the system comprising:

[0038] The data collection module is used to collect security-related data from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms.

[0039] The extraction module is used to clean and normalize the collected data, and extract the target security features from the preprocessed data.

[0040] The generation module is used to construct multiple AI agents for different data sources, and generate preliminary threat assessment results based on target security features through semantic understanding, behavioral pattern recognition and association rule mining.

[0041] The capture module is used to perform time-series fusion of preliminary threat assessment results, build a dynamic security situation model, capture threat evolution trends, and dynamically determine the risk level and priority order of events in combination with threat intelligence.

[0042] The push module is used to generate automated response suggestions based on risk level and historical response experience, and push them to operations and maintenance personnel. These suggestions include alarm escalation, blocking commands, and patch recommendations.

[0043] A third aspect of the present invention provides a multi-source security intelligence collaborative analysis device integrating AI agents, the multi-source security intelligence collaborative analysis device integrating AI agents including a memory and at least one processor, the memory storing instructions; the at least one processor calling the instructions in the memory to cause the multi-source security intelligence collaborative analysis device integrating AI agents to perform the various steps of the multi-source security intelligence collaborative analysis method integrating AI agents as described in any of the preceding claims.

[0044] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the multi-source security intelligence collaborative analysis method for fusion AI agents as described in any of the preceding claims.

[0045] The technical solution provided by this invention collects security-related data from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms; the collected data is cleaned and normalized, and target security features are extracted from the pre-processed data; multiple AI agents are constructed for different data sources, and preliminary threat assessment results are generated based on the target security features through semantic understanding, behavioral pattern recognition, and association rule mining; the preliminary threat assessment results are fused over time to construct a dynamic security posture model, capture threat evolution trends, and dynamically determine the risk level and priority of events in conjunction with threat intelligence; based on the risk level and historical response experience, the AI ​​agents generate automated response plans. The system provides suggestions and pushes them to operations and maintenance personnel. Response suggestions include alarm escalation, blocking commands, and patch recommendations. This invention integrates AI intelligent agent technology to achieve semantic understanding, feature extraction, and dynamic correlation of multi-source data, breaking through the limitations of traditional rule-based or static model-based analysis. It supports real-time situational awareness and threat assessment, automatically identifying potential attack paths and threat levels, and improving the real-time response capability of security operations. It possesses continuous learning and model adaptive optimization capabilities, automatically adjusting analysis logic and detection accuracy according to changes in the security situation. It significantly reduces the burden of manual judgment, improves the intelligence and automation level of the security operations platform, and is suitable for large-scale security service scenarios such as MSS, enabling adaptive optimization of detection strategies and improving the system's ability to identify new threats. Attached Figure Description

[0046] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0047] Figure 1A flowchart of a multi-source security intelligence collaborative analysis method for integrating AI agents provided in an embodiment of the present invention;

[0048] Figure 2 This is a schematic diagram of the structure of the multi-source security intelligence collaborative analysis system that integrates AI intelligent agents, provided in an embodiment of the present invention.

[0049] Figure 3 A schematic diagram of the structure of the multi-source security intelligence collaborative analysis device that integrates AI intelligent agents provided in an embodiment of the present invention. Detailed Implementation

[0050] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0051] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 The flowchart of the multi-source security intelligence collaborative analysis method for fusion AI agents provided in this embodiment of the invention includes the following steps:

[0052] Step 101: Collect security-related data from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms;

[0053] In this embodiment, the network environment is scanned, and system operation logs and application access logs from the log management platform, real-time packet capture data and traffic statistics reports from the network traffic monitoring system, process behavior records and file operation logs from the terminal security agent, and malicious IP lists and vulnerability intelligence databases from third-party threat intelligence platforms are automatically identified and accessed. Differentiated collection strategies are adopted for the characteristics of different data sources. For network traffic data with high real-time requirements, streaming collection technology is used to achieve millisecond-level data capture. For terminal logs, incremental synchronization is used to acquire only newly added records to reduce resource consumption. For third-party intelligence platforms, updated data is pulled periodically through API interfaces. During data transmission, encrypted transmission protocols are used to ensure data security, and large-scale data is processed through data sharding and breakpoint resumption mechanisms. At the same time, a lightweight collection agent is deployed locally to perform preliminary filtering of raw data, uploading only key fields related to security analysis to avoid invalid data consuming transmission bandwidth and storage resources.

[0054] Step 102: Clean and normalize the collected data, and extract the target security features from the preprocessed data;

[0055] In this embodiment, the collected data is format-converted and standardized, converting numerical data into fixed-dimensional vectors and performing one-hot encoding on categorical data. An anomaly detection model based on an autoencoder is constructed, which consists of an encoder and a decoder. The encoder compresses the processed data into low-dimensional feature vectors, and the decoder reconstructs the low-dimensional vectors back to the original data dimensions. The reconstruction error between the input data and the reconstruction output of the anomaly detection model is calculated. If the reconstruction error exceeds a preset threshold, the current data is marked as an anomaly, and the anomaly is identified.

[0056] In this embodiment, the preprocessed data is converted into word vectors that can be recognized by the RoBERTa model. A classification head is added to the output layer of the RoBERTa model, and the model parameters are adjusted through backpropagation. The RoBERTa model is used to obtain sentence-level contextual semantic vectors from unstructured data, where the contextual semantic vectors include the association information between words and sentences. The attention weights output by the RoBERTa model are used to locate threat-related keywords, and the features are determined by combining the contextual semantic vectors to form target security features.

[0057] Step 103: Construct multiple AI agents for different data sources, and generate preliminary threat assessment results based on target security features through semantic understanding, behavioral pattern recognition, and association rule mining;

[0058] In this embodiment, entities are extracted and standardized from the target security features. For logs, network traffic, terminal data and third-party intelligence, basic entities such as IP, domain name, vulnerability number and process ID are identified by regular expression matching such as IP address format and domain name rules. Entity linking technology is used to merge different representations of the same entity, such as different port records of the same IP, into a unique node. The entity naming format is unified, such as standardizing 192.168.1.1 and 192.168.01.1 into the same IP node.

[0059] Define the types of relationships between entities and extract related information. Preset relationship categories include communication, such as data packet transmission between IPs; exploitation, such as the exploitation of vulnerabilities by attack behavior; inclusion, such as a process containing malicious files; and access, such as a terminal accessing a domain name. Extract relationship features from the data. For example, extract the sending of 80 port data packets from IPA to IPB from traffic data as a communication relationship, and extract the exploitation relationship from vulnerability intelligence, such as attack method X exploiting vulnerability CVE-XXX. Record the attributes of the relationship, such as communication time, data packet size, and access frequency.

[0060] An initial attack chain knowledge graph is constructed. Standardized entities are stored as nodes in a graph database, and extracted relationships are used as directed edges to connect the corresponding nodes. The weight of the edges is dynamically set according to the strength of the relationship, such as the edge weight between IP pairs with high-frequency communication being higher than that between low-frequency communication. At the same time, attribute tags are added to nodes and edges, such as marking nodes with high-risk attributes (CVE-XXX) and marking edge communication with TCP protocol attributes, forming an initial graph containing entities, relationships, and attributes.

[0061] We designed a GNN model structure adapted to attack chain analysis, and selected the Graph Attention Network (GAT) as the basic framework. Each layer of the network includes a node feature mapping module and an attention weight calculation module: The node feature mapping module converts the attribute information of entities, such as the geographical location of the IP and the CVSS score of the vulnerability, into low-dimensional feature vectors; The attention weight calculation module assigns different attention coefficients to adjacent nodes according to the importance of the relationship between entities, such as using the relationship weight to be higher than the access relationship, to ensure that key associations are given priority in message passing.

[0062] The GNN model is trained using historical threat cases. Known attack chain cases, such as the complete path of malicious IP → exploiting vulnerabilities → controlling the terminal, are collected as training samples. The entity association paths in the samples are input into the model, and the model parameters are optimized through backpropagation. This enables the model to learn the aggregation rules of node features in threat scenarios, such as the feature combination pattern of malicious IP and vulnerable nodes. During the training process, the mini-batch gradient descent method is used to gradually adjust the attention coefficient calculation logic to improve the model's ability to identify threat associations.

[0063] The agents use the GNN message passing mechanism to uncover hidden relationships across data sources. Each agent's logs, traffic, and terminal agents input the subgraphs corresponding to their local data, such as the IP communication subgraph processed by the traffic agent, into the trained GNN model. Starting from the input layer, the model aggregates neighbor node information through multi-layer message passing: the first layer aggregates the features of directly related nodes, such as the features of the domain name nodes that IP nodes directly communicate with; the higher-level network aggregates the features of indirectly related nodes, such as the features of terminal nodes that IP nodes indirectly communicate with through domain name nodes; and finally, it generates a node embedding vector containing cross-data source relationship information.

[0064] Based on the associated features, a preliminary threat assessment result is generated. The agent extracts the node embedding vectors output by the GNN and compares them with the feature differences of known threat patterns, such as the similarity with node vectors in the APT attack chain feature library. If the similarity exceeds a set threshold, the associated path is determined to be a threat. At the same time, the judgment criteria are strengthened by combining relational attributes such as communication at abnormal times and high-frequency exploitation of high-risk vulnerabilities. Finally, a preliminary threat result containing the threat entity, associated path, and judgment criteria is generated.

[0065] In this embodiment, the node feature mapping module converts the attribute information of entities into low-dimensional feature vectors; the attention weight calculation module assigns different attention coefficients to adjacent nodes according to the importance of the relationship between entities.

[0066] Step 104: Perform time-series fusion on the preliminary threat assessment results, construct a dynamic security situation model, capture threat evolution trends, and dynamically determine the risk level and priority order of events in conjunction with threat intelligence;

[0067] In this embodiment, the preliminary threat assessment results are time-aligned to obtain time-series data. The time-series data within the current time window is input into a dynamic security situation model constructed based on a TCN network. The input layer of the dynamic security situation model converts the time-series data into feature vectors. The intermediate layer uses multiple dilated convolutional modules to extract cross-time point correlation features. The output layer outputs a fused feature vector containing time-series trends through global pooling. Each dilated convolutional module contains a convolutional layer, a normalization layer, and an activation function. The dilation coefficient increases with the layer level. A skip connection is added after each dilated convolutional module to add the input and output features of the dilated convolutional module.

[0068] Step 105: Based on the risk level and historical response experience, the AI ​​agent generates automated response suggestions and pushes them to the operations and maintenance personnel. The response suggestions include alarm escalation, blocking instructions, and patch recommendations.

[0069] In this embodiment, the AI ​​agent first structurally analyzes historical response cases, establishing a response strategy library based on dimensions such as risk level, threat type, and asset attributes. This library includes alarm escalation thresholds for different scenarios (e.g., automatically triggering the highest-level alarm for a level 5 threat), precise location rules for blocking objects (e.g., determining the IP or port to be blocked based on the attack chain graph), and a patch and vulnerability matching library that associates CVE numbers with corresponding patch versions. When generating response suggestions, the agent matches the risk level of the current event with the strategy library and dynamically adjusts the response strength based on real-time asset status (e.g., whether it is a core business server). For example, for a level 5 threat event involving core assets, the agent generates a combined suggestion of immediately blocking the attack source IP, pushing emergency patches to affected terminals, and escalating the alarm to senior operations personnel. For a level 3 threat event with a limited impact, the agent generates a suggestion of temporarily blocking abnormal connections, sending a regular alarm to the responsible operations personnel, and attaching relevant vulnerability patch links. Simultaneously, the agent uses a natural language generation model to convert technical parameters into directly executable operation instructions and pushes suggestions to the most appropriate personnel based on the operations personnel's load status and historical processing domain, ensuring response efficiency and accuracy.

[0070] In this embodiment, the intelligent agent is significantly different from traditional systems that rely solely on static rules through historical experience learning and adaptive optimization. At the same time, through deep fusion of contextual understanding and cross-source data association, it achieves accurate semantic modeling of alarms, thus having outstanding advantages in the accuracy and timeliness of automated response suggestions.

[0071] In this embodiment, the intelligent decision-making and response suggestion generation mechanism has the following significant innovations and advantages in its technical implementation:

[0072] First, compared to traditional response strategy generation methods that rely on fixed rule bases, this invention introduces an AI agent with continuous learning capabilities. This agent can train models and optimize parameters based on historical alarm information and response results, enabling adaptive adjustment of response strategies. This mechanism can significantly improve the accuracy of responses to new threats or unknown scenarios, avoiding misjudgments and omissions caused by rule aging or knowledge lag.

[0073] Secondly, this invention utilizes semantic analysis and multi-source data fusion technology to deeply model the context of alarm events, including asset criticality, attack chain location, and historical processing records, resulting in more business-relevant and security-accurate response recommendations. This capability overcomes the limitations of traditional systems' "isolated event analysis and single, fixed actions," enhancing the executability and targeted effectiveness of response recommendations.

[0074] Building upon this foundation, a multi-objective optimization dynamic response decision-making mechanism is further proposed. When generating response recommendations, the intelligent agent considers not only the threat level but also the comprehensive benefits of various response actions across multiple dimensions, including response speed, success rate, impact on business continuity, and resource usage costs. By constructing a multi-objective scoring model, it selects the optimal or second-best response path from multiple candidate solutions. For example, when facing high-risk threats, the system can intelligently prioritize a combination of blocking and tracing responses; during peak business periods, it automatically adjusts to isolation and manual review to minimize business impact. This intelligent response recommendation generation mechanism represents a technological leap from static response to intelligent, scenario-aware, and adaptive decision-making, significantly improving the automation, accuracy, and systematization of security incident response.

[0075] Please see Figure 2 A schematic diagram of the structure of the multi-source security intelligence collaborative analysis system integrating AI intelligent agents provided in this embodiment of the invention. The system includes:

[0076] The data collection module is used to collect security-related data from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms.

[0077] The extraction module is used to clean and normalize the collected data, and extract the target security features from the preprocessed data.

[0078] The generation module is used to construct multiple AI agents for different data sources, and generate preliminary threat assessment results based on target security features through semantic understanding, behavioral pattern recognition and association rule mining.

[0079] The capture module is used to perform time-series fusion of preliminary threat assessment results, build a dynamic security situation model, capture threat evolution trends, and dynamically determine the risk level and priority order of events in combination with threat intelligence.

[0080] The push module is used to generate automated response suggestions based on risk level and historical response experience, and push them to operations and maintenance personnel. These suggestions include alarm escalation, blocking commands, and patch recommendations.

[0081] Figure 3This is a schematic diagram of the structure of a multi-source security intelligence collaborative analysis device 300 integrating AI agents, provided in an embodiment of the present invention. This multi-source security intelligence collaborative analysis device 300 integrating AI agents can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 333 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the multi-source security intelligence collaborative analysis device 300 integrating AI agents. Furthermore, the processor 310 may be configured to communicate with the storage media 330, executing the series of instruction operations in the storage media 330 on the multi-source security intelligence collaborative analysis device 300 integrating AI agents to implement the method provided in the above embodiment.

[0082] The multi-source security intelligence collaborative analysis device 300 integrating AI intelligent agents may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 3 The multi-source security intelligence collaborative analysis device structure shown does not constitute a limitation on the computer device provided by the present invention. It may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0083] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the various steps of the multi-source security intelligence collaborative analysis method for fusion AI agents provided in the above embodiments.

[0084] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described equipment or apparatus / unit can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0085] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0086] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A multi-source security intelligence collaborative analysis method integrating AI intelligent agents, characterized in that, The method includes the following steps: Security-related data is collected from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms. The collected data is cleaned and normalized, and target security features are extracted from the preprocessed data. Multiple AI agents are constructed for different data sources, and preliminary threat assessment results are generated based on target security characteristics through semantic understanding, behavioral pattern recognition, and association rule mining. The preliminary threat assessment results are fused over time to construct a dynamic security situation model, capture threat evolution trends, initialize a population containing multiple candidate solutions, with each solution corresponding to a set of threat levels and processing order, and calculate the objective function value for each solution. The population is divided into different levels by non-dominated sorting, and sorted by crowding within the same level. The next generation of population is generated by selection, crossover and mutation operations, and the process is repeated until the population converges. The optimal solution is selected from the convergent population to obtain the solution with the highest threat urgency and the lowest treatment cost among the non-dominated solutions. The solutions are then sorted by threat level from high to low, and by threat urgency within the same level, to determine the final treatment priority. Based on risk levels and historical response experience, the AI ​​agent generates automated response suggestions and pushes them to operations and maintenance personnel. These suggestions include alarm escalation, blocking commands, and patch recommendations. The preliminary threat assessment results are generated based on the target security features through semantic understanding, behavioral pattern recognition, and association rule mining, including: Extract entities from the target security features and standardize them, define the types of relationships between entities and extract related information; The standardized entities are used as nodes, and the extracted relationships are used as directed edges to connect the corresponding nodes, thus constructing an initial attack chain knowledge graph. A GNN model is constructed, using the GAT network as the basic framework. Each layer of the network contains a node feature mapping and attention weight calculation module. The agent inputs the initial attack chain knowledge graph into the GNN model, aggregates neighbor node information through multi-layer message passing to mine cross-data source associations, and finally generates node embedding vectors containing cross-data source association information. The agent extracts the node embedding vectors output by the GNN model and compares them with the similarity of known threat patterns. If the similarity exceeds a preset threshold, it determines that there is a threat in the current associated path. Combined with the relationship attributes, it finally generates a preliminary threat determination result containing the threat entity, the associated path, and the determination basis.

2. The multi-source security intelligence collaborative analysis method integrating AI intelligent agents as described in claim 1, characterized in that, The process of cleaning and normalizing the collected data includes: The collected data is format-converted and standardized, converting numerical data into fixed-dimensional vectors and performing one-hot encoding on categorical data; An anomaly detection model based on an autoencoder is constructed. The model consists of two parts: an encoder and a decoder. The encoder compresses the processed data into a low-dimensional feature vector, and the decoder reconstructs the low-dimensional vector back to the original data dimension. Calculate the reconstruction error between the input data and the reconstruction output of the anomaly detection model. If the reconstruction error exceeds a preset threshold, mark the current data as an anomaly and identify the anomaly.

3. The multi-source security intelligence collaborative analysis method integrating AI intelligent agents as described in claim 1, characterized in that, The extraction of target security features from preprocessed data includes: The preprocessed data is converted into word vectors that the RoBERTa model can recognize. A classification head is added to the output layer of the RoBERTa model, and the model parameters are adjusted through backpropagation. The RoBERTa model is used to obtain sentence-level contextual semantic vectors from unstructured data, where the contextual semantic vectors include the association information between words and sentences. By using the attention weights output by the RoBERTa model to locate threat-related keywords, and combining them with contextual semantic vectors to determine features, target security features are formed.

4. The multi-source security intelligence collaborative analysis method integrating AI intelligent agents as described in claim 1, characterized in that, The node feature mapping module converts the attribute information of entities into low-dimensional feature vectors; the attention weight calculation module assigns different attention coefficients to adjacent nodes according to the importance of the relationship between entities.

5. The multi-source security intelligence collaborative analysis method integrating AI intelligent agents as described in claim 1, characterized in that, The process of performing time-series fusion on the preliminary threat assessment results to construct a dynamic security situation model and capture threat evolution trends includes: The preliminary threat assessment results are time-series aligned to obtain time-series data, and the time-series data within the current time window is input into the dynamic security posture model built based on the TCN network. The input layer of the dynamic security situation model converts time-series data into feature vectors. The intermediate layer uses multiple dilated convolutional modules to extract cross-time point correlation features. The output layer outputs a fused feature vector containing time-series trends through global pooling. Each dilated convolutional module contains a convolutional layer, a normalization layer, and an activation function. The dilation coefficient increases with the layer level. A skip connection is added after each dilated convolutional module to add the input and output features of the dilated convolutional module.

6. A multi-source security intelligence collaborative analysis system integrating AI intelligent agents, characterized in that, The system includes: The data collection module is used to collect security-related data from heterogeneous data sources, including log management platforms, network traffic monitoring systems, endpoint security agents, and third-party threat intelligence platforms. The extraction module is used to clean and normalize the collected data, and extract the target security features from the preprocessed data. The generation module is used to construct multiple AI agents for different data sources. Based on the target security features, it generates preliminary threat assessment results through semantic understanding, behavioral pattern recognition, and association rule mining. This involves: extracting and standardizing entities from the target security features; defining the relationship types between entities and extracting association information; using the standardized entities as nodes and the extracted relationships as directed edges to connect the corresponding nodes, constructing an initial attack chain knowledge graph; building a GNN model using a GAT network as the basic framework, with each layer containing node feature mapping and attention weight calculation modules; the agent inputs the initial attack chain knowledge graph into the GNN model, aggregating neighbor node information through multi-layer message passing to mine cross-data source associations, ultimately generating node embedding vectors containing cross-data source association information; the agent extracts the node embedding vectors output by the GNN model, compares their similarity with known threat patterns, and if the similarity exceeds a preset threshold, determines that the current association path poses a threat, and combines this with relationship attributes to finally generate a preliminary threat assessment result containing the threat entity, association path, and judgment criteria. The capture module is used to perform time-series fusion on the preliminary threat assessment results, construct a dynamic security situation model, capture threat evolution trends, initialize a population containing multiple candidate solutions, with each solution corresponding to a set of threat levels and processing order, and calculate the objective function value of each solution; divide the population into different levels through non-dominated sorting, sort the solutions within the same level according to crowding, and generate the next generation population using selection, crossover, and mutation operations, repeating the iteration until the population converges; select the optimal solution from the converged population, obtaining the solution with the highest threat urgency and lowest processing cost among the non-dominated solutions, sort them from high to low threat level, and within the same level according to threat urgency, to determine the final processing priority; The push module is used to generate automated response suggestions based on risk level and historical response experience, and push them to operations and maintenance personnel. These suggestions include alarm escalation, blocking commands, and patch recommendations.

7. A multi-source security intelligence collaborative analysis device integrating AI intelligent agents, characterized in that, The multi-source security intelligence collaborative analysis device for fusion AI agents includes a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the multi-source security intelligence collaborative analysis device for fusion AI agents to execute the various steps of the multi-source security intelligence collaborative analysis method for fusion AI agents as described in any one of claims 1-5.

8. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the various steps of the multi-source security intelligence collaborative analysis method for fusion AI agents as described in any one of claims 1-5.

Images