Multi-agent decision framework and method based on kernel event perception

Abstract

The invention relates to a multi-agent decision framework based on kernel event awareness, and the framework is divided into three layers: (1) a kernel awareness layer which comprises an eBPF event collection unit and an event preprocessing unit, the collection unit is responsible for collecting kernel events, and the preprocessing unit is responsible for carrying out preliminary classification and attribute extraction on original kernel events; (2) the decision-making layer comprises a local decision-making unit and a collaborative decision-making unit, the local decision-making unit is used for generating a local strategy by a lightweight GNN (Graph Neural Network), and the collaborative decision-making unit is used for dynamically aggregating neighborhood values; the execution layer comprises an action execution unit and an environment feedback unit, a kernel mode directly executes a high-priority action, and a user mode executes a complex strategy; the scheme is quick in response and efficient in resource.

Description

Technical Field

[0001] This invention relates to a decision-making framework, specifically a multi-agent decision-making framework based on kernel event awareness, belonging to the fields of artificial intelligence and decision-making systems. Background Technology

[0002] In recent years, the field of artificial intelligence, especially large-scale model technology, has developed rapidly. Among them, multi-agent systems (MAS), as a core paradigm of distributed artificial intelligence, are mostly based on Markov Decision Processes (MDPs) and game theory, with centralized or distributed decision-making as their typical architecture. Empowered by large-scale model technology, multi-agent collaboration has presented more possibilities for technological breakthroughs. However, even with the current support of various large-scale model technologies, existing technologies and architectures of multi-agent systems still have several problems and performance bottlenecks. The first is the latency problem of "perception-decision." The decision-making process of traditional agents is as follows... Figure 1 As shown. Its core flaw is that the switching from kernel-mode applications to user-mode (including possible ModeSwitch and ContextSwitch) and data replication introduce latency, while the periodic data polling mechanism typically used in user-mode leads to untimely event response. In latency- and security-sensitive scenarios, latency in "perception and decision-making" can trigger serious failures or even disasters. Typical cases in the fields of data security and automated control show that a 50ms delay can increase the security incident rate by 3 times;

[0003] Second, the utilization efficiency of computing resources is low. The empowerment of agents by large models relies on a stable model foundation, and the large number of model parameters leads to significant deployment overhead. In large-scale distributed intelligent systems composed of numerous agents, resource utilization efficiency is low.

[0004] Third, collaborative decision-making efficiency is insufficient. In a communication architecture based on a fully distributed fixed topology, the communication volume can be expressed as:

[0005] (where β is the complexity and β is the amount of data)

[0006] Furthermore, the full interaction of data in a fully distributed topology directly raises privacy and data security issues. In data-sensitive scenarios, this data interaction model directly violates relevant domestic and international data privacy protection regulations, making it completely impractical.

[0007] In addition, eBPF technology is mostly used for monitoring in terms of kernel event awareness, and its integration with decision-making systems is insufficient. Furthermore, the complexity of the program is limited (e.g., validator rejection loops and other structural code). If a hardware acceleration solution is adopted, it will lead to a rapid increase in cost.

[0008] In summary, building a multi-agent decision-making framework that combines rapid response, resource efficiency, and adaptive collaboration has become a major challenge. Summary of the Invention

[0009] This invention addresses the technical problems existing in the prior art by providing a multi-agent decision-making framework based on kernel event awareness, which offers rapid response and high resource efficiency.

[0010] A multi-agent decision-making framework based on kernel event awareness, the overall architecture of which is as follows: Figure 2 As shown, the whole is divided into 3 layers: (1) Kernel perception layer:

[0011] The core module includes an eBPF event acquisition unit and an event preprocessing unit. The acquisition unit is responsible for collecting kernel events, while the preprocessing unit is responsible for preliminary classification and attribute extraction of the raw kernel events. The execution process in this stage is as follows:

[0012] S1. Event Awareness: The node eBPF event acquisition unit program is mounted as an operating system kernel hook (specifically, it is mounted to various system calls, network events, resource scheduling events, and many other operating system-level events as needed), and subscribes to and receives event messages. When a system event occurs, event information is obtained in real time.

[0013] S2. Initial event screening: The data collection program pre-sets filtering rules or sensitive event sets, matches the current system events with the sensitive event sets, ignores irrelevant events as needed without processing them, and otherwise includes the events in the event set to be processed.

[0014] S3. Feature Extraction: The event preprocessing unit extracts necessary information attributes such as the type, priority, and risk assessment of the event to be processed according to classification judgment rules, forming a multi-attribute group of events, such as...

[0015] <Type, Priority, Risk Assessment> (Information fields can be further expanded with multiple attribute groups);

[0016] S4. Event time window aggregation, as detailed below.

[0017] The S4.1 preprocessing unit program uses a RingBuffer or similar data structure to aggregate events within a time window; its mathematical expression...

[0018] E t =window(e t-τ,…,e t )

[0019] Wherein, sequence e t-τ ,…,e t Representing events within the time window from time t-τ to time t, the following 7-tuple is defined as an extension of the traditional MDP (Markov Decision Process):

[0020]

[0021] This forms a Labeled Observation Markov Decision Process with Event Constraints (LOMDP).

[0022] Among them, S i For agent i, the state space describes the discrete or continuous states that the agent may be in in the environment, such as the process / thread tree of the local node (operating system), resource utilization, etc.

[0023] A i Let i be the action space of agent i, representing the set of all actions that agent i can perform, such as security control actions like "rate limiting and access denial" in the field of data security.

[0024] R i R(s,a) or R(s,a,s′) is the reward function for agent i, which represents the immediate reward obtained after performing action a in state s. For example, in a game environment, the increase or decrease in score is the reward.

[0025] Ω i For the observation space, O i The observation generation function (or simply observation function) uses a lightweight GNN encoder to map the state and event stream to observations (the agent cannot directly obtain the complete state; it can only infer the state through observation), and generates a vector representation at time t:

[0026]

[0027] φ(ε t ) is the event feature extraction function.

[0028] For the event space, the event flow Et = {e t-τ ,…,e t Each event is captured by an eBPF hook:

[0029]

[0030] P i The state transition probability is usually defined as the conditional probability P(s′|s,a,···), which represents the probability that state s will transition to state s' under the condition of performing action a and other constraints.

[0031] By introducing an event stream, state transitions depend only on the event stream and the current local state, which significantly reduces model complexity.

[0032]

[0033] Note that when the event stream in S4 contains sufficient information within the time window, a global state transition can be approximated (in fact, state transitions are equivalent to a sufficient event stream representation in many scenarios).

[0034] This plan has a sufficient information theory basis for its feasibility.

[0035] The S4.2 event preprocessing unit writes event information (including multi-attribute groups and other data) into eBPF Maps. User-mode programs can then access the event information through the shared memory mechanism, achieving a zero-copy channel and avoiding the latency caused by user-mode programs polling their own memory regions and frequent data copying from kernel to user mode.

[0036] (2) Decision-making level,

[0037] The core modules include local decision-making units and collaborative decision-making units. The execution steps are as follows:

[0038] S5. Local Decision-Making: The decision-making unit program of the local agent calls a lightweight GNN or a lightweight embedding model to encode event features into fixed-length feature vectors (i.e., event embeddings) as event observations. Depending on the complexity requirements of the actual business scenario and the balance between data volume, each event feature vector can be represented using 32 / 64 / 128 / 256 dimensions, mathematically as follows:

[0039]

[0040] One typical design consideration for a lightweight GNN is as follows:

[0041] (1) Use shallow networks to reduce the number of layers, for example, 2 to 3 layers;

[0042] (2) Multi-layer structures can use shared weight matrices to reduce computational load and complexity.

[0043] (3) The adjacency matrix is ​​stored in Compressed Sparse Row (CSR) format to further reduce memory usage.

[0044] (4) Different activation functions are used in the input layer, intermediate layer and output layer to balance computational complexity and graph computation quality. For example, ReLU is used for preliminary feature extraction of the input layer, GeLU is used for feature fusion and Tanh is used for output normalization.

[0045] (5) Quantize the model to 8 bits or even 4 bits according to the actual hardware equipment to reduce the model size and computational requirements.

[0046] This design ensures efficient computing even in scenarios with limited computing and storage resources, such as edge devices.

[0047] S6. Collaborative Decision Making: This includes stages such as dynamic neighborhood discovery and federated value aggregation.

[0048] S6.1. Neighborhood Value Request and Response: This stage designs and implements an algorithm to construct a temporary cooperative network by calculating the similarity of event vectors in real time. Unlike traditional fixed topologies, this algorithm has the following characteristics:

[0049] Event-driven: Neighborhood discovery is triggered only when a critical event occurs (via the eBPF collector for a "sensitive event set").

[0050] control)

[0051] Spatiotemporal correlation: simultaneously considering feature similarity and physical distance

[0052] Timeliness filtering: Automatic elimination of outdated nodes is available.

[0053] By combining the above features, the efficiency of communication and collaboration among nodes within the network can be significantly improved.

[0054] The algorithm flow is as follows Figure 5 As shown, the core steps to achieve this include:

[0055] Step 1: Each node's local agent encodes events into event embedding vectors as event observations, following the local decision-making method in S5.

[0056] Step 2: Events from all nodes are collected to form a KD-Tree index. Based on index timeliness and data volume maintenance requirements, strategies such as fixed-time expiration, data volume threshold expiration, and FIFO (First In, First Out) can be used to expirate nodes, ensuring data freshness and the timeliness of the KD-Tree index.

[0057] Step 3: When an event occurs at a node, use the event embedding vector of that node to query the k nearest nodes (including itself) in the KD-Tree.

[0058] Step 4: For each candidate neighbor node, calculate the cosine similarity between its event embedding vector and the current node's event embedding vector using a parallel GPU-accelerated dot product calculation method, based on the computational performance requirements.

[0059] Step 5: If the cosine similarity exceeds the threshold τ, then add the node to the neighborhood list.

[0060] The corresponding mathematical representations mentioned above are as follows:

[0061] (1) Event embedding vector (feature vector): Where d is the dimension, for example, 16 / 32 / 64, R d It is a d-dimensional vector space, φ(e i () is the event feature extraction function, which is extracted by the event preprocessing unit according to the judgment rules.

[0062] (2) Constructing a neighborhood tree KD-Tree: in, It is a set of event embedding vectors, where N is the total number of events.

[0063] (3) Neighborhood query (which can use a cosine similarity filtering mechanism based on distance decay):

[0064]

[0065] in, It is the distance decay factor, d geo (i,j) represents the physical distance between nodes i and j (using Euclidean distance); λ is a positive real number that controls the rate of decay. The larger λ is, the faster the similarity decays as the distance increases. The exponential decay factor maps the physical distance to the interval (0,1]. The factor is 1 when the distance is 0, and the factor approaches 0 as the distance increases.

[0066] S6.2 Federated Value Aggregation: This stage designs and implements an algorithm that avoids obtaining the original value data of neighboring nodes through differential data interaction, thereby strengthening the privacy protection of nodes within the network.

[0067] The general process of federal value aggregation is as follows: Figure 3 Partially shown.

[0068] Specifically, it includes the following steps:

[0069] Step 1: The local agent of each node initializes the necessary parameters such as the current node's historical value, historical value window size, feature embedding, and weight distribution coefficients.

[0070] Step 2: The current node obtains the local node embedding of the event.

[0071] Step 3: Obtain the last local value of the current node based on its historical value, or dynamically calculate the average value of the window based on the window size as the current value.

[0072] Step 4: Based on the local node embedding of the current node and the neighbor node discovery results in S6.1, a parallel computing method is used to request the differential value from each neighbor node. The differential value is calculated by the difference between the node's current value and the average of its historical values.

[0073] Step 5: Based on the event embedding similarity calculation results of neighboring nodes in S6.1, the weight distribution coefficient w is calculated using the softmax function.

[0074] Step 6: Calculate the sum of weighted difference values ​​at the current node based on the weight distribution coefficients.

[0075] Step 7: Calculate the aggregated value as the sum of the local value and the weighted differential values ​​of all neighboring nodes.

[0076] The calculation formula is as follows:

[0077] Federal differential value aggregation calculation

[0078]

[0079] Among them, u j It is the historical average value of node j (i.e., the value baseline).

[0080] Differential value: V j diff =V j -μ j That is, the difference between the current value of node j and the average historical value.

[0081] The weight (w) is calculated as (the weight assigned to node j by node i):

[0082]

[0083] β = 2.0 is a temperature coefficient (hyperparameter that controls the sharpness of the weight distribution; a larger β results in a larger weight allocation for the nearest neighbor node, and vice versa). This parameter can be adjusted as needed; for example, in security-sensitive systems, the parameter can be increased to trust only the most similar node. N i Let be the set of all neighboring nodes of node i. sim(i,j) represents the similarity between nodes i and j, which can be achieved using the neighborhood query method in S6.1.

[0084] The cosine similarity was calculated based on distance decay improvement.

[0085] Vlocal V represents the current value of the local node. agg The value is aggregated for local nodes in a federated manner.

[0086] (3) Execution layer,

[0087] The core module includes an action execution unit and an environment feedback unit. The execution steps are as follows:

[0088] S7. Action Execution:

[0089] The node action execution unit decides whether to execute a direct kernel-level action or further perform a deep user-space analysis based on the federated aggregation value and threshold settings.

[0090] The execution process in a typical scenario is as follows:

[0091] When the aggregate value exceeds the threshold, the node execution unit directly performs related operations such as event blocking at the kernel level according to the priority of each event category or specific event name. These operations include blocking network requests, dropping data packets, sending a termination signal (SIGKILL) to a process to terminate the process, and blocking syscalls.

[0092] Otherwise, user-space deep analysis is initiated. During execution, event information is first written to the ring buffer via shared memory. The user-space program listens to the ring buffer and consumes the event information. Since user-space programs can execute arbitrarily complex logic, sandbox analysis programs can be started as independent processes using methods such as process isolation or container isolation.

[0093] The sandbox analysis program analyzes event information or its associated files. This step can perform targeted fixed rule judgments and ML model risk assessments.

[0094] Finally, the user-space program writes the evaluation results back to the shared map.

[0095] The kernel-mode program sets a timeout mechanism for deep analysis of user space. If user space fails to return decision information in a timely manner, the kernel-mode program can decide to execute a default policy (such as blocking or allowing). Otherwise, the kernel-mode program decides to perform the aforementioned blocking or related operations or do nothing about the event based on the evaluation results.

[0096] Compared to traditional event handling methods, this solution balances the timeliness and complexity of event processing. For high-risk or sensitive events, it handles them at the kernel level with extremely low latency; for complex scenarios, it performs complex evaluations in user space. Furthermore, it provides a default fallback mechanism for timeout exceptions and other scenarios, ensuring the overall stability of the system.

[0097] S8. Environmental Feedback: The environmental feedback unit operates in two modes simultaneously: active mode and passive mode.

[0098] In active mode, user-space programs indirectly trigger kernel-space program processing logic through syscalls such as device file operations, netlink communication protocol components, and eBPF Map writing.

[0099] In passive mode, user-space programs do not need to perform any additional operations. When they are executing normal business logic, the kernel will monitor the relevant events, and then the events will undergo a complete processing process starting from step S1.

[0100] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the aforementioned kernel event-aware multi-agent decision-making method.

[0101] A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the aforementioned kernel event-aware multi-agent decision-making method.

[0102] Compared with existing technologies, this invention has the following advantages: by reconstructing the multi-agent decision chain driven by kernel events, this invention fully utilizes the computing advantages of the operating system kernel to achieve a response paradigm optimization from "perception-decision" separation to "event-based decision". Specifically, this invention has the following three major technological innovations:

[0103] Kernel event-driven decision engine (overcoming performance bottlenecks caused by data polling and replication latency),

[0104] Dynamic federated value networks (solving collaborative efficiency and privacy issues through differential data interaction),

[0105] The lightweight GNN (enabling edge intelligence under resource constraints) achieves a good balance between performance and resource overhead while maintaining high decision-making accuracy. It can serve as an alternative infrastructure solution in multiple fields such as large model inference service optimization, intelligent cloud resource scheduling, network and data security management, and embodied intelligence, and has high practical value. Attached Figure Description

[0106] Figure 1 This is a flowchart of a traditional intelligent agent decision-making process.

[0107] Figure 2 A diagram illustrating the overall architecture design for multi-agent decision-making.

[0108] Figure 3 For general flowcharts,

[0109] Figure 4 For the system implementation architecture diagram,

[0110] Figure 5 A flowchart for dynamic neighborhood discovery. Detailed Implementation

[0111] To enhance understanding of the present invention, the embodiments will be described in detail below with reference to the accompanying drawings.

[0112] Example 1: A multi-agent decision-making framework based on kernel event awareness, the overall architecture of which is as follows: Figure 2 As shown, the whole structure is divided into 3 layers:

[0113] (1) Kernel awareness layer:

[0114] The core module includes an eBPF event acquisition unit and an event preprocessing unit. The acquisition unit is responsible for collecting kernel events, while the preprocessing unit is responsible for preliminary classification and attribute extraction of the raw kernel events. The execution process in this stage is as follows:

[0115] S1. Event Awareness: The node eBPF event acquisition unit program is mounted as an operating system kernel hook (specifically, it is mounted to various system calls, network events, resource scheduling events, and many other operating system-level events as needed), and subscribes to and receives event messages. When a system event occurs, event information is obtained in real time.

[0116] S2. Initial event screening: The data collection program pre-sets filtering rules or sensitive event sets, matches the current system events with the sensitive event sets, ignores irrelevant events as needed without processing them, and otherwise includes the events in the event set to be processed.

[0117] S3. Feature Extraction: The event preprocessing unit extracts necessary information attributes such as the type, priority, and risk assessment of the event to be processed according to classification rules, forming an event...

[0118] Multiple attribute groups, such as <type, priority, risk assessment> (information fields can be further expanded).

[0119] A typical framework for defining classification rules is shown in Table 1 below (a structured representation of the rule structure, where attribute types are exemplified by C language types):

[0120] Table 1 Classification Judgment Rule Structure

[0121] Attribute type Attribute Name Remark __u32 event_type Event categories (system calls / network / files, etc.) __u32 target_id Target identifier (system call number / port number / file path, etc.) __u32 flags Matching flags (exact match / regular expression match / containment match, etc.) __u32 priority Priority (0-2: low-high) __u32 risk_level Risk Level (0-3: No Risk - Extremely High Risk) __u32 action Subsequent actions (PASS / DROP / QUARANTINE, etc.) char

[64] description Rule Description

[0122] The broad categories of events can be further subdivided based on specific scenarios to improve the precision of event handling. Taking network event categories as an example, a typical subdivision and classification rule is shown in Table 2 below:

[0123] Table 2 Examples of Network Event Sub-classification Rules

[0124] Rule ID Event Type Target ID Matching conditions Priority Risk level describe NW-01 Network incidents TCP Source port = 53 and not a DNS process (1) (2) Illegal DNS tunnel NW-02 Network incidents ICMP The data packet contains 'bash-i' High (2) High (3) ICMP reverse shell NW-03 Network incidents HTTP User-Agent includes 'sqlmap' High (2) High (3) SQL injection tool detection NW-04 Network incidents any Target IP in the known list of C2 servers High (2) Extremely high (4) Malicious C2 communication NW-05 Network incidents any High-frequency connection to different ports in a short period of time High (2) (2) Port scanning behavior

[0125] Similarly, system calls, file system access, and other major categories can be further subdivided and classified according to the actual scenario.

[0126] Furthermore, a typical framework for defining multi-attribute groups is shown in Table 3 below:

[0127] Table 3 Multi-attribute groups

[0128] Attribute type Attribute Name Remark __u32 event_type Event categories (1 = System calls, 2 = Network, 3 = Files, etc.) __u32 subtype Subtypes (101 = execve, 102 = open, etc.) __u32 priority Priority (0 = low, 1 = medium, 2 = high, 3 = urgent) __u32 risk_level Risk level (0 = None, 1 = Low, 2 = Medium, 3 = High, 4 = Very High) __u32 process_id Process ID __u32 user_id User ID __u32 timestamp Event timestamp char

[64] process_name process name char

[128] context Context information

[0129] S4. Event Time Window Aggregation:

[0130] S4.1: The preprocessing unit uses a RingBuffer or similar data structure to aggregate events within a time window, mathematically expressed as follows:

[0131] E t =window(e t-τ ,…,e t )

[0132] Based on the traditional MDP, this invention extends the definition of the following 7-tuple:

[0133]

[0134] This leads to the formation of a Labeled Observation Markov Decision Process with Event Constraints (LOMDP).

[0135] Among them, S i For agent i, the state space describes the discrete or continuous states that the agent may be in in the environment, such as the process / thread tree of the local node (operating system), resource utilization, etc.

[0136] A i Let i be the action space of agent i, representing the set of all actions that agent i can perform, such as security control actions like "rate limiting and access denial" in the field of data security.

[0137] R is the reward function, defined as R(s,a) or R(s,a,s′), representing the immediate reward obtained after performing action a in state s. For example, in a game environment, the increase or decrease in score is the reward;

[0138] Ω represents the observation space, and O represents the observation generation function (or simply observation function). The observation function can use a lightweight GNN encoder to map the state and event stream to observations (the agent cannot directly obtain the complete state; it can only infer the state through observation) and generate a vector representation.

[0139]

[0140] φ(ε t ) is the event feature extraction function.

[0141] For the event space, the event flow Et = {e t-τ ,…,e t Each event is captured by an eBPF hook:

[0142]

[0143] P is the state transition probability, usually defined as the conditional probability P(s′|s,a,···), which represents the probability that state s will transition to state s' under the condition of performing action a and other constraints.

[0144] By introducing an event stream, state transitions depend only on the event stream and the current local state, which significantly reduces model complexity.

[0145]

[0146] Note that when the event stream in S4 contains sufficient information within the time window, a global state transition can be approximated (in fact, state transitions are equivalent to a sufficient event stream representation in many scenarios).

[0147] This plan has a sufficient information theory basis for its feasibility.

[0148] S4-2. The aforementioned event preprocessing unit writes event information (including multi-attribute groups and other data) into eBPF Maps. User-mode programs can access event information through the shared memory mechanism, realizing a zero-copy channel and avoiding the latency caused by user-mode programs polling their own memory areas and frequent data copying from kernel mode to user mode.

[0149] (2) Decision-making level

[0150] The core modules include local decision-making units and collaborative decision-making units. The execution steps are as follows:

[0151] S5. Local Decision-Making: The decision-making unit program of the local agent calls a lightweight GNN or a lightweight embedding model to encode event features into fixed-length feature vectors (i.e., event embeddings) as event observations. Depending on the complexity requirements of the actual business scenario and the balance between data volume, each event feature vector can be represented using 32 / 64 / 128 / 256 dimensions, mathematically as follows:

[0152]

[0153] One typical design consideration for a lightweight GNN is as follows:

[0154] (1) Use shallow networks to reduce the number of layers, for example, 2 to 3 layers;

[0155] (2) Multi-layer structures can use shared weight matrices to reduce computational load and complexity.

[0156] (3) The adjacency matrix is ​​stored in Compressed Sparse Row (CSR) format to further reduce memory usage.

[0157] (4) Different activation functions are used in the input layer, intermediate layer and output layer to balance computational complexity and graph computation quality. For example, ReLU is used for preliminary feature extraction of the input layer, GeLU is used for feature fusion and Tanh is used for output normalization.

[0158] (5) The model is quantized to 8 bits or even 4 bits according to the actual hardware conditions to reduce the model size and computational requirements. This design ensures efficient computation even in scenarios with limited computing and storage resources, such as edge devices.

[0159] S6. Collaborative Decision Making: This includes stages such as dynamic neighborhood discovery and federated value aggregation.

[0160] S6.1. Neighborhood Value Request and Response: This stage designs and implements an algorithm to construct a temporary cooperative network by calculating the similarity of event vectors in real time. Unlike traditional fixed topologies, this algorithm has the following characteristics:

[0161] Event-driven: Neighborhood discovery is triggered only when a critical event occurs (controlled by the eBPF collector for "sensitive event sets").

[0162] Spatiotemporal relevance: Considers both feature similarity and physical distance; Timeliness filtering: Allows for the automatic removal of outdated nodes.

[0163] By combining the above features, the efficiency of communication and collaboration among nodes within the network can be significantly improved.

[0164] The algorithm flow is as follows Figure 5As shown, the core steps to achieve this include:

[0165] Step 1: Each node's local agent encodes events into event embedding vectors as event observations, following the local decision-making method in S5.

[0166] Step 2: Events from all nodes are collected to form a KD-Tree index. Based on index timeliness and data volume maintenance requirements, strategies such as fixed-time expiration, data volume threshold expiration, and FIFO (First In, First Out) can be used to expirate nodes, ensuring data freshness and the timeliness of the KD-Tree index.

[0167] Step 3: When an event occurs at a node, use the event embedding vector of that node to query the k nearest nodes (including itself) in the KD-Tree.

[0168] Step 4: For each candidate neighbor node, calculate the cosine similarity between its event embedding vector and the current node's event embedding vector using a parallel GPU-accelerated dot product calculation method, based on the computational performance requirements.

[0169] Step 5: If the cosine similarity exceeds the threshold τ, then add the node to the neighborhood list.

[0170] The corresponding mathematical representations mentioned above are as follows:

[0171] (1) Event embedding vector (feature vector):

[0172] R d Where d = 16 (the output dimension of the lightweight GNN can be customized as needed), φ(e i ) is the event feature extraction function.

[0173] (2) Constructing a neighborhood tree KD-Tree:

[0174] (3) Neighborhood query (which can use a cosine similarity filtering mechanism based on distance decay):

[0175]

[0176] The physical distance between nodes i and j can be calculated using Euclidean distance from the pre-maintained global node physical coordinates. S6.2 Federated Value Aggregation: This stage designs and implements an algorithm that, through differential data interaction, avoids obtaining the original value data of neighboring nodes, thereby strengthening node privacy protection within the network.

[0177] The general process of federal value aggregation is as follows: Figure 3 Partially shown.

[0178] Specifically, it includes the following steps:

[0179] Step 1: Each node's local agent initializes necessary parameters such as the current node's historical value, historical value window size, feature embedding, and weight distribution coefficients.

[0180] Step 2: The current node retrieves the local node embedding of the event.

[0181] Step 3: Obtain the last local value of the current node based on its historical value, or dynamically calculate the average value of the window based on the window size as the current value.

[0182] Step 4: Based on the local node embedding of the current node and the neighbor node discovery results in S6.1, a parallel computing method is used to request the differential value from each neighbor node. The differential value is calculated by the difference between the node's current value and the average of its historical values.

[0183] Step 5: Based on the event embedding similarity calculation results of neighboring nodes in S6.1, the weight distribution coefficient w is calculated using the softmax function.

[0184] Step 6: Calculate the sum of weighted difference values ​​at the current node based on the weight distribution coefficients.

[0185] Step 7: Calculate the aggregated value as the sum of the local value and the weighted differential values ​​of all neighboring nodes.

[0186] The mathematical formulas involved in the above process are as follows:

[0187] Federal differential value aggregation calculation

[0188]

[0189] Among them, u j It is the historical average value of node j (i.e., the value baseline).

[0190] Differential value: v j diff =V j -μ j

[0191] The weight (w) is calculated as follows:

[0192]

[0193] β = 2.0 is a temperature coefficient.

[0194] (3) Execution layer

[0195] The core module includes an action execution unit and an environment feedback unit. The execution steps are as follows:

[0196] S7. Action Execution:

[0197] The node action execution unit decides whether to execute a direct kernel-level action or further perform a deep user-space analysis based on the federated aggregation value and threshold settings.

[0198] The execution process in a typical scenario is as follows:

[0199] When the aggregate value exceeds the threshold, the node execution unit directly performs related operations such as event blocking at the kernel level according to the priority of each event category or specific event name. These operations include blocking network requests, dropping data packets, sending a termination signal (SIGKILL) to a process to terminate the process, and blocking syscalls.

[0200] Otherwise, user-space deep analysis is initiated. During execution, event information is first written to the ring buffer via shared memory. The user-space program listens to the ring buffer and consumes the event information. Since user-space programs can execute arbitrarily complex logic, sandbox analysis programs can be started as independent processes using methods such as process isolation or container isolation.

[0201] The sandbox analysis program analyzes event information or its associated files. This step can perform targeted fixed rule judgments and ML model risk assessments.

[0202] Finally, the user-space program writes the evaluation results back to the shared map.

[0203] The kernel-mode program sets a timeout mechanism for deep analysis of user space. If user space fails to return decision information in a timely manner, the kernel-mode program can decide to execute a default policy (such as blocking or allowing). Otherwise, the kernel-mode program decides to perform the aforementioned blocking or related operations or do nothing about the event based on the evaluation results.

[0204] Compared to traditional event handling methods, this solution balances the timeliness and complexity of event processing. For high-risk or sensitive events, it handles them at the kernel level with extremely low latency; for complex scenarios, it performs complex evaluations in user space. Furthermore, it provides a default fallback mechanism for timeout exceptions and other scenarios, ensuring the overall stability of the system.

[0205] S8. Environmental Feedback:

[0206] The environmental feedback unit operates in two modes simultaneously: active mode and passive mode.

[0207] In active mode, user-space programs indirectly trigger kernel-space program processing logic through syscalls such as device file operations, netlink communication protocol components, and eBPF Map writing.

[0208] In passive mode, user-space programs do not need to perform any additional operations. When executing normal business logic, the kernel will monitor relevant events and continue to respond and handle them according to the aforementioned process.

[0209] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of the present invention.

Claims

1. A multi-agent decision-making framework based on kernel event awareness, characterized in that, The framework is divided into 3 layers. (1) Kernel awareness layer, which includes eBPF event acquisition unit and event preprocessing unit. The acquisition unit is responsible for acquiring kernel events, and the preprocessing unit is responsible for performing preliminary classification and attribute extraction on the raw kernel events. (2) The decision-making level, including local decision-making units and collaborative decision-making units. Local decision-making unit: Lightweight GNN (Graph Neural Network) generates local policies; Collaborative decision-making unit: Dynamic neighborhood value aggregation. (3) Execution layer, including The action execution unit and environment feedback unit execute high-priority actions directly in kernel mode and complex strategies in user mode.

2. A multi-agent decision-making method based on kernel event awareness, characterized in that, The method using the multi-agent decision-making framework of claim 1 includes the following steps: S1. Event Awareness: The point eBPF event acquisition unit program is mounted as an operating system kernel hook (specifically, it is mounted to various system calls, network events, resource scheduling events, and many other operating system-level events as needed), subscribes to and receives event messages, and obtains event information in real time when system events occur. S2. Initial Event Screening: The data collection program pre-sets filtering rules or sensitive event sets, matches current system events with these sets, and ignores irrelevant events as needed without processing; otherwise, the events are added to the event set to be processed. S3. Feature Extraction: The event preprocessing unit extracts necessary information attributes such as the type, priority, and risk assessment of the event to be processed according to classification rules, forming a multi-attribute group of events. S4. Event Time Window Aggregation S5. Local decision-making. S6. Collaborative decision-making, specifically including the dynamic neighborhood discovery and federated value aggregation stages. S7. Action Execution: The node action execution unit determines whether to execute a direct kernel-level action or further perform user-space deep analysis based on the federated aggregation value and threshold settings. S8. Environmental feedback: The environmental feedback unit operates simultaneously in two modes: active mode and passive mode. In active mode, user-space programs use syscalls such as device file operations, netlink communication protocol components, and eBPF. The Map write method indirectly triggers kernel-mode program processing logic; In passive mode, user-space programs do not need to perform any additional operations. When they are executing normal business logic, the kernel will monitor the relevant events, and then the events will undergo a complete processing process starting from step S1.

3. The multi-agent decision-making method based on kernel event awareness according to claim 2, characterized in that, S4. Event time window aggregation, as detailed below. The S4.1 preprocessing unit program uses a RingBuffer or similar data structure to aggregate events within a time window; its mathematical expression... AND t = window(e t-τ ,…,and t ) Wherein, sequence e t-τ ,…,e t This represents the events within the time window from time t-τ to time t. Based on the traditional MDP (Markov Decision Process), the following 7-tuple is defined: This forms a Labeled Observation Markov Decision Process with Event Constraints (LOMDP). Among them, S i Let be the state space of agent i, describing the discrete or continuous states that the agent may be in in the environment. A i Let be the action space of agent i, representing the set of all actions that agent i can perform. R i Let R(s,a) or R(s,a,s′) be the reward function for agent i, which is usually defined as R(s,a) or R(s,a,s′), representing the immediate reward obtained after performing action a in state s. Ω i For the observation space, O i The observation generation function (or simply observation function) uses a lightweight GNN encoder to map the state and event stream to observations (the agent cannot directly obtain the complete state; it can only infer the state through observation), and generates a vector representation at time t: φ(ε t ) is the event feature extraction function. ε t For the event space, the event stream E t ={e t-τ ,…,e t Each event is captured by an eBPF hook: AND t ={and t-τ ,…,And t } P i The state transition probability is usually defined as the conditional probability P(s′|s,a,···), which represents the probability that state s will transition to state s' under the condition of performing action a and other constraints. By introducing an event stream, state transitions depend only on the event stream and the current local state, which significantly reduces model complexity. The S4.2 event preprocessing unit writes event information (including multi-attribute groups and other data) into eBPF Maps. User-mode programs can then access the event information through the shared memory mechanism, achieving a zero-copy channel and avoiding the latency caused by user-mode programs polling their own memory regions and frequent data copying from kernel to user mode.

4. The multi-agent decision-making method based on kernel event awareness according to claim 2, characterized in that, S5. Local Decision-Making: The decision-making unit program of the local agent calls a lightweight GNN or a lightweight embedding model to encode event features into fixed-length feature vectors (i.e., event embeddings) as event observations. Based on the requirements of the actual business scenario for event complexity representation, and weighing the data volume, each event feature vector is represented using 32 / 64 / 128 / 256 dimensions, mathematically as follows: The key design considerations for lightweight GNNs are as follows: (1) Use shallow networks to reduce the number of layers. (2) Multi-layer structures can use a shared weight matrix to reduce computational cost and complexity. (3) The adjacency matrix is ​​stored in Compressed Sparse Row (CSR) format to further reduce memory usage. (4) Different activation functions are used in combination in the input layer, intermediate layer and output layer to balance computational complexity and graph computation quality. For example, ReLU is used for preliminary feature extraction in the input layer, GeLU is used for feature fusion and Tanh is used for output normalization. (5) Quantize the model to 8 bits or even 4 bits according to the actual hardware equipment to reduce the model size and computational requirements.

5. A multi-agent decision-making method based on kernel event awareness according to claim 2, characterized in that, S6. In collaborative decision-making, dynamic neighborhood discovery is as follows: S6.1 Neighborhood Value Request and Response: A temporary cooperative network is constructed by calculating the similarity of event vectors in real time. The algorithm flow is as follows: Step 1: Each node's local agent encodes events into event embedding vectors as event observations, following the local decision-making method in S5. Step 2: Events from all nodes are collected to form a KD-Tree index. Based on index timeliness and data volume maintenance requirements, strategies such as fixed-time expiration, data volume threshold expiration, and FIFO (First In, First Out) can be used to expirate nodes, ensuring data freshness and the timeliness of the KD-Tree index. Step 3: When an event occurs at a node, use the event embedding vector of that node to query the k nearest nodes (including itself) in the KD-Tree. Step 4: For each candidate neighbor node, based on computational performance requirements, calculate the cosine similarity between its event embedding vector and the current node's event embedding vector using a parallel GPU-accelerated dot product calculation method. Step 5: If the cosine similarity exceeds the threshold τ, then add the node to the neighborhood list. The corresponding mathematical representations mentioned above are as follows: (1) Event embedding vector (feature vector): Where d is the dimension, 16 / 32 / 64, R d It is a d-dimensional vector space, φ(e i () is the event feature extraction function, which is extracted by the event preprocessing unit according to the judgment rules. (2) Constructing a neighborhood tree KD-Tree: in, It is a set of event embedding vectors, where N is the total number of events. (3) Neighborhood query (using a cosine similarity filtering mechanism improved based on distance decay): in in, It is the distance decay factor, d geo (i,j) represents the physical distance between nodes i and j (using Euclidean distance); λ is a positive real number that controls the rate of decay. The larger λ is, the faster the similarity decays as the distance increases. The exponential decay factor maps the physical distance to the interval (0,1]. When the distance is 0, the factor is 1, and as the distance increases, the factor approaches 0.

6. A multi-agent decision-making method based on kernel event awareness according to claim 5, characterized in that, S6. In collaborative decision-making, the federal value aggregation stage is as follows: S6.2 Federated Value Aggregation: By using differential data exchange, it avoids obtaining the original value data of neighboring nodes, thereby enhancing the privacy protection of nodes within the network. Specifically, it includes the following steps: Step 1: For each node, the local Agent initializes the necessary parameters for the current node's historical value, historical value window size, feature embedding, and weight distribution coefficients. Step 2: The current node retrieves the local node embedding of the event. Step 3: Obtain the last local value of the current node based on its historical value, or dynamically calculate the average value of the window based on the window size as the current value. Step 4: Based on the local node embedding of the current node and the neighbor node discovery results in S6.1, a parallel computing method is used to request the differential value from each neighbor node. The differential value is calculated by the difference between the node's current value and the average of its historical values. Step 5: Based on the event embedding similarity calculation results of neighboring nodes in S6.1, the weight distribution coefficient w is calculated using the softmax function. Step 6: Calculate the sum of weighted difference values ​​at the current node based on the weight distribution coefficients. Step 7: Calculate the aggregated value as the sum of the local value and the weighted differential values ​​of all neighboring nodes. The calculation formula is as follows: Federal differential value aggregation calculation Among them, u j It is the historical average value of node j (i.e., the value baseline). Differential value: V j diff =V j -μ j That is, the difference between the current value of node j and the average historical value. The weight (w) is calculated as (the weight assigned to node j by node i): β = 2.0 is a temperature coefficient (hyperparameter that controls the sharpness of the weight distribution; when β is larger, the nearest neighbor node will receive a larger weight allocation, and vice versa, all neighboring nodes will receive a more even weight allocation). i Let V be the set of all neighboring nodes of node i, and sim(i,j) be the similarity between nodes i and j, calculated using the cosine similarity improved by distance decay in neighborhood query in S6.

1. local V represents the current value of the local node. agg The value is aggregated for local nodes in a federated manner.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements a kernel event-aware multi-agent decision-making method as described in any one of claims 2 to 6.

8. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, the computer instructions implement a kernel event-aware multi-agent decision-making method as described in any one of claims 2-6.

Images