Security management and control system supporting multi-agent cooperation

Abstract

The invention discloses a security management and control system supporting multi-agent cooperation, and relates to the technical field of network security. The system comprises a security agent layer, a network instruction bus layer and a central coordination layer, the security agent layer comprises a plurality of agents, and the agents are used for receiving a scheduling instruction from the network instruction bus layer, executing a security detection task according to the scheduling instruction, and sending own state information and task execution conditions to the central coordination layer in a heartbeat packet form through the network instruction bus layer; and the central coordination layer is used for performing global task scheduling and load balancing according to the state information of each agent and the task execution condition, generating a scheduling instruction, and sending the scheduling instruction to each agent through the network instruction bus layer. According to the network instruction bus technology based on multi-agent cooperation, through parallel execution and cooperation of the distributed agents, high availability, multi-dimensional detection and self-adaptive cooperation of security control are achieved, and the reliability of security detection is improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a security management system that supports multi-agent collaboration. Background Technology

[0002] With the increasing complexity and distributed nature of cyberattacks, traditional single security devices or centralized security management systems are no longer sufficient to meet the demands for real-time, high reliability, and multi-dimensional detection. In existing technologies, security functions (such as log auditing and intrusion detection) are typically performed by a single module or device, posing a single point of failure risk, and lacking dynamic coordination mechanisms between different security tasks. Summary of the Invention

[0003] The purpose of this application is to provide a security management and control system that supports multi-agent collaboration, so as to achieve multi-party collaborative security management and control and improve the reliability of security detection.

[0004] To achieve the above objectives, this application provides the following solution.

[0005] In a first aspect, this application provides a security management and control system that supports multi-agent collaboration, comprising: a security agent layer, a network command bus layer, and a central coordination layer; The secure intelligent agent layer is connected to the network command bus layer, and the network command bus layer is connected to the central coordination layer; The security intelligent agent layer includes multiple intelligent agents. The intelligent agents are used to receive scheduling instructions from the network instruction bus layer, execute security detection tasks according to the scheduling instructions, and send their own status information and task execution status to the central coordination layer in the form of heartbeat packets through the network instruction bus layer. The central coordination layer is used to perform global task scheduling and load balancing based on the state information and task execution status of each intelligent agent, generate scheduling instructions, and send the scheduling instructions to each intelligent agent through the network instruction bus layer.

[0006] Optionally, the central coordination layer is further configured to count the arrival interval of heartbeat packets of each agent based on a sliding window, determine an agent that times out three times consecutively as a failed agent, select a takeover agent from the list of currently active agents, and send a data snapshot request to the failed agent through the network command bus layer to retrieve unprocessed data from the cache of the failed agent and send it to the takeover agent; the list of currently active agents is a list of non-failed agents in the real-time recording security agent layer; The takeover agent is used to perform security detection tasks for failed agents.

[0007] Optionally, a takeover agent can be selected from the list of currently active agents, specifically including: Select agents from the list of currently active agents whose task type matches that of the failed agents as candidate agents. The candidate agent with the lowest CPU load is selected as the takeover agent.

[0008] Optionally, each agent corresponds to one or more security detection tasks at a specified layer, wherein the specified layer is the network layer, application layer, or terminal layer. The agent that performs the security detection task at the network layer is a network layer agent, the agent that performs the security detection task at the application layer is an application layer agent, and the agent that performs the security detection task at the terminal layer is a terminal layer agent.

[0009] Optionally, the intelligent agent includes: a task execution module, a status monitoring module, a data interface module, and a local cache; The task execution module is used to run security detection algorithms to perform security detection tasks. The security detection algorithms include the Snort rule engine algorithm and / or the YARA signature matching algorithm. The status monitoring module is used to monitor the agent's own status information and task execution status. The own status information includes: CPU load and health status; the task execution status includes task progress. The data interface module is used to encapsulate its own status information and task execution status into a standardized data format, send it to the central coordination layer in the form of a heartbeat packet through the network command bus layer, and receive scheduling instructions from the network command bus layer. The local cache is used to store data to be processed and intermediate data; the intermediate data is data generated during the execution of the security detection task.

[0010] Optionally, the network instruction bus layer is used to perform instruction distribution, state synchronization, and task scheduling; The instruction distribution specifically includes: when an instruction is received from an instruction issuer, the instruction is sent to intelligent agents that have subscribed to the topic of the instruction; the instruction issuer is a central coordination layer or an intelligent agent; The state synchronization specifically includes: receiving heartbeat packets sent by each intelligent agent, updating the state database of each intelligent agent in real time according to the heartbeat packets sent by each intelligent agent, receiving query instructions from intelligent agents or the central coordination layer, querying the state database of each intelligent agent according to the query instructions, obtaining query results, and sending the query results to intelligent agents or the central coordination layer. The task scheduling specifically includes: when a new security detection task is received, selecting an agent to execute the new security detection task as the target agent based on the priority of the new security detection task and the CPU load of each agent, and sending the allocation result to the target agent.

[0011] Optionally, the network instruction bus layer is further configured to, when receiving a threat event published by the first agent, search the log tables of each second agent, obtain log records associated with the threat event, and further determine whether the threat event is a malicious process; the first agent is any agent in the security agent layer, and the second agent is an agent whose object of the security detection task being performed has an interactive relationship with the object of the security detection task being performed by the first agent.

[0012] Optionally, the network command bus layer includes a message middleware, a command routing table, a heartbeat manager, and a data standardization engine; The message middleware is used to facilitate communication between agents and the central coordination layer, as well as between individual agents, using a publish-subscribe pattern through a lightweight distributed messaging system. The instruction routing table is used to dynamically maintain the mapping relationship between each agent ID and task type; The heartbeat manager is used to record the last active time of the agent and configure the timeout threshold; The data standardization engine is used to unify the output format of various intelligent agents.

[0013] Optionally, the central coordination layer is used to perform global load balancing, conflict resolution, and policy distribution; The global load balancing specifically includes: allocating security detection tasks to each intelligent agent based on their geographical location and resource utilization rate; The conflict resolution specifically includes: when multiple agents detect a threat at the same time, determining the priority of the threats detected by each agent and merging the alarms; The policy deployment specifically includes: dynamically updating security rules.

[0014] Optionally, the intelligent agent is deployed on a server in the form of a virtual machine or container, or the intelligent agent is set on a hardware security device.

[0015] According to the specific embodiments provided in this application, this application has the following technical effects.

[0016] This application provides a security management and control system supporting multi-agent collaboration, comprising: a security agent layer, a network command bus layer, and a central coordination layer; the security agent layer is connected to the network command bus layer, and the network command bus layer is connected to the central coordination layer; the security agent layer includes multiple agents, each agent receiving scheduling instructions from the network command bus layer, executing security detection tasks according to the scheduling instructions, and sending its own status information and task execution status to the central coordination layer via the network command bus layer in the form of heartbeat packets; the central coordination layer performing global task scheduling and load balancing based on the status information and task execution status of each agent, generating scheduling instructions, and sending the scheduling instructions to each agent via the network command bus layer. This application, based on multi-agent collaborative network command bus technology, achieves high availability, multi-dimensional detection, and adaptive collaboration in security management and control through the parallel execution and collaboration of distributed agents, thereby improving the reliability of security detection. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of a security management system supporting multi-agent collaboration, provided as an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0021] Existing similar solutions include centralized security management systems, traditional load balancing technologies, and blockchain collaborative detection. Centralized security management systems rely on a single control center, resulting in performance bottlenecks and single points of failure. Traditional load balancing technologies only distribute traffic and cannot support task takeover after an agent fails. While blockchain collaborative detection provides a decentralized trust mechanism, its high latency makes it unsuitable for real-time security scenarios. This application achieves low-latency collaboration through a lightweight instruction bus, while also ensuring the high reliability and flexibility of a distributed architecture, filling a gap in existing technologies.

[0022] In one exemplary embodiment, a security management system supporting multi-agent collaboration is provided, such as... Figure 1 As shown, it includes: a secure intelligent agent layer, a network command bus layer, and a central coordination layer; the secure intelligent agent layer is connected to the network command bus layer, and the network command bus layer is connected to the central coordination layer; The security intelligent agent layer includes multiple intelligent agents. Each intelligent agent receives scheduling instructions from the network instruction bus layer, executes security detection tasks according to the scheduling instructions, and sends its own status information and task execution status to the central coordination layer in the form of heartbeat packets through the network instruction bus layer. The central coordination layer performs global task scheduling and load balancing based on the status information and task execution status of each intelligent agent, generates scheduling instructions, and sends the scheduling instructions to each intelligent agent through the network instruction bus layer.

[0023] In the security management system provided in the above embodiments, there is a security intelligent agent layer and a network command bus layer: Each intelligent agent in the security intelligent agent layer connects to the network command bus layer through a data interface module. The intelligent agents periodically send their own status information (such as load, health status, etc.) to the network command bus layer in the form of heartbeat packets; simultaneously, the intelligent agents receive instructions from the network command bus layer, including task allocation instructions, collaborative analysis instructions, etc. Furthermore, after detecting a threat or completing a specific task, the intelligent agents also publish relevant information to the network command bus layer for other intelligent agents to subscribe to and collaboratively analyze.

[0024] Network Command Bus Layer and Central Coordination Layer: When deploying a central coordination layer in a large network, the network command bus layer communicates with it. The network command bus layer summarizes and reports the status information and task execution status of agents to the central coordination layer. Based on this information, the central coordination layer performs global task scheduling and load balancing, and sends scheduling instructions to each agent through the network command bus layer to achieve optimized operation of the entire system.

[0025] In another exemplary embodiment, each agent corresponds to one or more security detection tasks at a specified layer, wherein the specified layer is the network layer, the application layer, or the terminal layer. The agent that performs the security detection task at the network layer is a network layer agent, the agent that performs the security detection task at the application layer is an application layer agent, and the agent that performs the security detection task at the terminal layer is a terminal layer agent.

[0026] The security intelligent agent layer encompasses security detection functions across different dimensions, including the network layer, application layer, and terminal layer. Each agent corresponds to one or more security detection tasks at a specific layer. For example, the network layer agent focuses on network layer security detection, such as network traffic analysis and network protocol compliance checks; the application layer agent is responsible for application layer security detection, such as application vulnerability scanning and application behavior auditing; and the terminal layer agent focuses on the security of terminal devices, such as terminal process monitoring and terminal file integrity checks. This division of labor improves the professionalism and efficiency of security detection.

[0027] In another exemplary embodiment, the intelligent agent includes: a task execution module, a status monitoring module, a data interface module, and a local cache.

[0028] Task execution module: Runs security detection algorithms (such as the Snort rule engine and YARA signature matching). Snort is an open-source Network Intrusion Detection System (NIDS). Its rule engine detects anomalies and attacks in network traffic based on a predefined set of rules. These rules contain information such as the characteristics of various network protocols and attack signatures. The rule engine analyzes and matches network packets byte by byte. When a packet matches a rule, it triggers a corresponding alarm or response. For example, rules can be defined to detect common network attacks such as port scanning, Structured Query Language (SQL) injection attacks, and Distributed Denial of Service (DDoS) attacks. YARA is a tool for malware detection and classification. It identifies specific files or processes by defining text patterns or binary patterns (called signatures). YARA signatures can describe the characteristics of malware, such as specific strings, function calls, and code structures. The YARA signature matching engine scans the target file or process and compares it with a predefined signature. If a match is found, the file or process is determined to be malware or has malicious characteristics.

[0029] Snort rule engine and YARA signature matching are existing mature algorithms to some extent. However, in the security management system supporting multi-agent collaboration in this application, they may be optimized and customized according to specific security requirements and system architecture to better collaborate with other agents and system components.

[0030] Status monitoring module: Used to monitor the agent's own status information and task execution status. This status monitoring module periodically collects its own load (Central Processing Unit (CPU) / memory usage), task progress, and health status (such as process liveness).

[0031] Data interface module: used to encapsulate its own status information and task execution status into a standardized data format, send it to the central coordination layer in the form of heartbeat packets through the network command bus layer, and receive scheduling instructions from the network command bus layer; that is, to encapsulate standardized data format (JSON / Protobuf) and communicate with the command bus.

[0032] Local cache: Stores pending data and intermediate data to prevent data loss when the task is taken over; the intermediate data is the data generated during the execution of the security detection task.

[0033] As described above, the intelligent agent comprises a task execution module, a state monitoring module, and a data interface module. The task execution module runs corresponding security detection algorithms and task logic based on the security dimension the intelligent agent focuses on, executing specific security tasks, such as traffic analysis algorithms for network layer agents and vulnerability scanning programs for application layer agents. The state monitoring module is responsible for monitoring the intelligent agent's own state, including load and health status, and sending this information to the network command bus through the data interface module. The data interface module serves as the channel for data interaction between the intelligent agent and the network command bus layer, responsible for receiving commands and sending data.

[0034] In another exemplary embodiment, the network command bus layer functions as follows: It acts as the central hub for communication between agents, implementing command distribution, state synchronization, and task scheduling. Command Distribution: The network command bus adopts a publish-subscribe message bus architecture. Command publishers (such as a central coordinator or other agents) publish commands to the command bus, specifying the command's topic or category. Command subscribers (each agent) subscribe to the corresponding topic based on their task requirements and interests. When a command is published to a topic, the command bus pushes the command to all agents subscribed to that topic, thus distributing the command. State Synchronization: Agents periodically send heartbeat packets via the command bus, containing information such as the agent's load and health status. The command bus collects this heartbeat information and updates the agent's state database in real time. Other agents or the central coordinator can query the state database on the bus by querying commands to obtain the current state of each agent, achieving state synchronization. In this way, each component in the system can promptly understand the operational status of other components, enabling reasonable task allocation and collaborative work. The task scheduling process is as follows: When a new security task needs to be executed, the task publisher (such as a central coordinator or an agent triggered according to preset rules) publishes the task information to the instruction bus. This information includes the task type, objective, and priority. The instruction bus, based on the task type and objective, and combined with the status information of each agent (such as load and focused security dimensions), filters out a list of agents capable of executing the task. From this list, the instruction bus selects the optimal agent to execute the task based on task priority and agent load. If the task priority is high, it will be preferentially assigned to an agent with a lighter load and corresponding capabilities. The assignment result is sent to the selected agent via the instruction bus. Upon receiving the task assignment instruction, the selected agent begins execution. During task execution, the agent periodically reports the task progress and status information to the instruction bus. If an anomaly occurs during task execution or task parameters need adjustment, the instruction bus will handle the situation accordingly, such as reassigning the task or adjusting its priority.

[0035] In another exemplary embodiment, the core components of the network command bus layer described above include a message middleware, a command routing table, a heartbeat manager, and a data standardization engine. The message middleware is used to facilitate communication between agents and the central coordination layer, as well as between individual agents, using a publish-subscribe pattern with a lightweight distributed messaging system. The command routing table is used to dynamically maintain the mapping relationship between agent IDs and task types. The heartbeat manager is used to record the last active time of agents and configure timeout thresholds. The data standardization engine is used to unify the output format of each agent, as detailed below.

[0036] Message middleware: Employs lightweight distributed messaging systems (such as Zero Message Queue (ZeroMQ) or Neural Autonomic Transport System (NATS)) and supports publish-subscribe patterns.

[0037] Instruction routing table: Dynamically maintains the mapping relationship between agent ID and task type (e.g., Agent_A → Intrusion Detection).

[0038] Heartbeat Manager: Records the last active time of the agent; the timeout threshold is configurable (default 30 seconds).

[0039] Data standardization engine: unifies the output format of different intelligent agents (such as converting terminal logs into a common threat intelligence model).

[0040] In another exemplary embodiment, the aforementioned network command bus layer also includes a dynamic task takeover mechanism. Based on a sliding window, the arrival interval of heartbeat packets for each agent is statistically analyzed. Agents that time out three consecutive times are identified as failed agents. A takeover agent is selected from the list of currently active agents, and a data snapshot request is sent to the failed agent via the network command bus layer. Unprocessed data is retrieved from the failed agent's cache and sent to the takeover agent. The list of currently active agents is a real-time record of non-failed agents in the security agent layer. Specifically, selecting a takeover agent from the list of currently active agents includes: filtering agents with the same task type as the failed agent as candidate agents; and selecting the candidate agent with the lowest CPU load as the takeover agent. The takeover agent is used to perform the security detection task of the failed agent.

[0041] In another exemplary embodiment, the implementation process of the above-mentioned dynamic task takeover mechanism is as follows: [Agent A] → (heartbeat timeout) → [Command bus] → (query routing table) → [select takeover agent B] → [Agent B] ← (get unprocessed data) ← [Command bus] ← [Agent A local cache].

[0042] The key algorithms of the aforementioned dynamic task takeover mechanism include failure detection, takeover node selection, and data migration.

[0043] Failure detection: Based on the sliding window to count the heartbeat packet arrival interval, if there are 3 consecutive timeouts, it is marked as a failure.

[0044] Takeover node selection: Filter candidate agents that match the failed task type from the list of currently active agents, and select the agent with the lowest CPU load as the takeover (pseudocode logic: traverse the candidate agents, sort them in ascending order of CPU load, and return the optimal node).

[0045] Data migration: Send a data snapshot request to the failed agent via the instruction bus, and the takeover agent restores the context from its cache.

[0046] In another exemplary embodiment, the Go language logic of the above failure detection algorithm is as follows.

[0047] Data structure: Use map[string]time.Time to record the agent ID and last active time (LastActiveTime). Notify expired agent IDs via channel (chNotify).

[0048] Core method: Upon receiving a heartbeat packet from an agent, update its last active time to the current time. Periodically check all agents; if an agent fails to update within a preset timeout period, trigger a task takeover process (send its ID via a channel) and remove it from the monitoring list.

[0049] In another exemplary embodiment, the Python pseudocode logic for updating the instruction bus routing table described above is as follows.

[0050] Data structure: Use a dictionary (routes) to maintain the mapping relationship between task types and agent ID lists, for example: {TaskType: [AgentID1, AgentID2,...]}.

[0051] Core method: When registering an agent, add its ID to the list corresponding to the task type. Query the list of matching agent IDs based on the task type.

[0052] Traditional solutions struggle to achieve joint analysis across multiple dimensions (such as network traffic, endpoint behavior, and application layer protocols), leading to delays or missed threats.

[0053] In another exemplary embodiment, the network instruction bus layer of this application can also realize cross-dimensional collaborative analysis. When a threat event is received from a first agent, the log tables of each second agent are searched to obtain log records associated with the threat event, and it is further determined whether the threat event is a malicious process; the first agent is any agent in the security agent layer, and the second agent is an agent that has an interaction relationship with the object of the security detection task being performed and the object of the security detection task being performed by the first agent.

[0054] In another exemplary embodiment, the following example is provided to illustrate the specific implementation process of the cross-dimensional collaborative analysis described above.

[0055] Example scenario: The network layer agent detects port scanning behavior (source IP: 192.168.1.101) and needs to work with the terminal layer agent to verify whether there is a malicious process.

[0056] The implementation steps are as follows.

[0057] Event publishing: The network layer agent publishes a threat event to the network command bus layer, including the event ID (NET_SCAN_001), type (port_scan), source IP, and timestamp.

[0058] Rule matching: The association engine in the network command bus layer queries the terminal log table (terminal_logs) according to predefined rules. The filtering conditions include: Records with IP address 192.168.1.101 and timestamp greater than 1625097500; process names containing the keyword "malware".

[0059] In another exemplary embodiment, the network instruction bus layer described above can also achieve lightweight instruction bus optimization based on zero-message copy technology.

[0060] Use shared memory to transfer data and avoid kernel-to-user mode switching.

[0061] Message batching reduces I / O operations; for example, aggregating heartbeat packets every 100ms.

[0062] Protocol design: Header (8 bytes) | Payload (Variable) | Checksum (4 bytes) |; Header: [Version(1B)| Command(1B)| Task_Type(2B)| Agent_ID(4B)].

[0063] In another exemplary embodiment, this central coordination layer is suitable for ultra-large-scale networks (such as data centers and cross-regional branch offices). The central coordination layer is used to perform global load balancing, conflict resolution, and policy distribution.

[0064] The global load balancing specifically includes: allocating security detection tasks to each agent based on their geographical location and resource utilization.

[0065] The conflict resolution specifically includes: when multiple agents detect threats simultaneously, determining the priority of the threats detected by each agent and merging the alarms. First, priority is determined by pre-defining a set of priority rules based on factors such as threat type, source, and scope of impact. For example, threats targeting critical business systems are given higher priority; attacks from known malicious IP addresses also have relatively high priority; while suspicious but unconfirmed threats are given lower priority. In addition to preset rules, threat priority can be dynamically evaluated based on real-time network environment and system status. For example, if current network traffic is high, some low-priority threats may be temporarily downgraded to prioritize threats with a greater impact on network performance; if a terminal device stores important data, the priority of threats targeting that terminal will be increased accordingly. Next, alarm merging: when multiple agents detect threats simultaneously, the command bus performs similarity matching on these threats. By analyzing threat characteristics such as attack type, target address, and attack time, it determines whether these threats belong to the same category or are related. If multiple threats are determined to be similar, the command bus merges the alarm information for these threats. The merged alert information will include more comprehensive threat information, such as information on multiple agents that detected the threat, detailed threat characteristics, and detection results from different dimensions. Additionally, the highest priority of the threat will be marked in the merged alert, allowing subsequent processing and analysis personnel to quickly understand the severity of the threat.

[0066] The specific implementation of the strategy includes: dynamically updating security rules (such as updating the intrusion detection signature database).

[0067] In another exemplary embodiment, the deployment and expansion scheme of the above-mentioned security management system is as follows.

[0068] 1) Hardware deployment.

[0069] Small networks: Agents are deployed on servers as virtual machines / containers.

[0070] Large networks: employ dedicated hardware security devices (such as network cards equipped with Intel DPDK to accelerate command bus communication).

[0071] 2) Extensible design.

[0072] Horizontal scaling: When a new agent is added, it is automatically registered with the command bus and the routing table is updated.

[0073] Dynamic policy loading: Update correlation analysis rules in real time via REST API (such as adding APT attack features).

[0074] In another exemplary embodiment, in order to illustrate the effectiveness of the security control system of this application, a technical effect verification was performed, and the specific technical effect verification results are shown in Table 1.

[0075] Table 1. Results of Technical Effectiveness Verification

[0076] Based on the above technical effect verification results, this application has the following technical effects.

[0077] Decentralized resilience: No single point of failure, supports offline operation of some nodes.

[0078] Low-latency collaboration: Real-time security requirements are met through memory-level communication and batch processing optimization.

[0079] Open ecosystem: Provides standardized interfaces that can be integrated with open-source tools such as Suricata and Osquery.

[0080] In summary, the technical solution of this application has been verified to be feasible through simulation testing. The next step is to carry out customized development in combination with specific industry needs (such as anti-fraud in the financial industry).

[0081] According to the specific embodiments provided in this application, this application has the following technical effects.

[0082] High availability: Single point of failure does not affect the overall security functions, and the system availability is improved to over 99.99%.

[0083] Multidimensional detection capability: Through cross-dimensional collaborative analysis, the accuracy of threat detection is improved by more than 40%.

[0084] Elastic scalability: Supports adding or removing agents as needed to adapt to network environments of different sizes.

[0085] Reduce operation and maintenance costs: Automated task takeover reduces manual intervention and improves operation and maintenance efficiency by 60%.

[0086] Adapting to future threats: The distributed architecture supports rapid iteration of security features to address unknown attack methods.

[0087] Ecosystem compatibility: Through the open command bus interface, third-party security tools can be integrated to build an open and secure ecosystem.

[0088] This application's technical solution is the first to apply a distributed intelligent agent architecture to the field of security management, solving the single point of failure problem of traditional solutions. Through zero-message copying and asynchronous communication optimization, it achieves microsecond-level command transmission latency. It is suitable for industries with extremely high security requirements, such as finance and energy.

[0089] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0090] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A security management and control system supporting multi-agent collaboration, characterized in that, include: The layers consist of a secure intelligent agent layer, a network command bus layer, and a central coordination layer. The secure intelligent agent layer is connected to the network command bus layer, and the network command bus layer is connected to the central coordination layer; The security intelligent agent layer includes multiple intelligent agents. The intelligent agents are used to receive scheduling instructions from the network instruction bus layer, execute security detection tasks according to the scheduling instructions, and send their own status information and task execution status to the central coordination layer in the form of heartbeat packets through the network instruction bus layer. The central coordination layer is used to perform global task scheduling and load balancing based on the state information and task execution status of each intelligent agent, generate scheduling instructions, and send the scheduling instructions to each intelligent agent through the network instruction bus layer.

2. The security management and control system supporting multi-agent collaboration according to claim 1, characterized in that, The network command bus layer is used to count the heartbeat packet arrival interval of each agent based on a sliding window, determine the agent that times out three times in a row as a failed agent, select a takeover agent from the list of currently active agents, and send a data snapshot request to the failed agent through the network command bus layer to obtain unprocessed data from the cache of the failed agent and send it to the takeover agent. The list of currently active agents is a real-time record of the list of agents that have not failed in the secure agent layer; The takeover agent is used to perform security detection tasks for failed agents.

3. The security management and control system supporting multi-agent collaboration according to claim 2, characterized in that, Select the takeover agent from the list of currently active agents, specifically including: Select agents from the list of currently active agents whose task type matches that of the failed agents as candidate agents. The candidate agent with the lowest CPU load is selected as the takeover agent.

4. The security management and control system supporting multi-agent collaboration according to claim 1, characterized in that, Each agent corresponds to one or more security detection tasks at a specified layer, wherein the specified layer is the network layer, application layer, or terminal layer. An agent that performs a security detection task at the network layer is a network layer agent, an agent that performs a security detection task at the application layer is an application layer agent, and an agent that performs a security detection task at the terminal layer is a terminal layer agent.

5. The security management and control system supporting multi-agent collaboration according to claim 1, characterized in that, The intelligent agent includes: a task execution module, a status monitoring module, a data interface module, and a local cache; The task execution module is used to run security detection algorithms to perform security detection tasks. The security detection algorithms include the Snort rule engine algorithm and / or the YARA signature matching algorithm. The status monitoring module is used to monitor the agent's own status information and task execution status. The own status information includes: CPU load and health status; the task execution status includes task progress. The data interface module is used to encapsulate its own status information and task execution status into a standardized data format, send it to the central coordination layer in the form of a heartbeat packet through the network command bus layer, and receive scheduling instructions from the network command bus layer. The local cache is used to store data to be processed and intermediate data; the intermediate data is data generated during the execution of the security detection task.

6. The security management system supporting multi-agent collaboration according to claim 1, characterized in that, The network instruction bus layer is used to perform instruction distribution, state synchronization, and task scheduling. The instruction distribution specifically includes: when an instruction is received from an instruction issuer, the instruction is sent to intelligent agents that have subscribed to the topic of the instruction; the instruction issuer is a central coordination layer or an intelligent agent; The state synchronization specifically includes: receiving heartbeat packets sent by each intelligent agent, updating the state database of each intelligent agent in real time according to the heartbeat packets sent by each intelligent agent, receiving query instructions from intelligent agents or the central coordination layer, querying the state database of each intelligent agent according to the query instructions, obtaining query results, and sending the query results to intelligent agents or the central coordination layer. The task scheduling specifically includes: when a new security detection task is received, selecting an agent to execute the new security detection task as the target agent based on the priority of the new security detection task and the CPU load of each agent, and sending the allocation result to the target agent.

7. The security management system supporting multi-agent collaboration according to claim 6, characterized in that, The network command bus layer is also used to, when receiving a threat event published by the first agent, search the log tables of each second agent, obtain the log records associated with the threat event, and further determine whether the threat event is a malicious process; the first agent is any agent in the security agent layer, and the second agent is an agent that has an interaction relationship with the object of the security detection task being performed and the object of the security detection task being performed by the first agent.

8. The security management system supporting multi-agent collaboration according to claim 6, characterized in that, The network command bus layer includes a message middleware, a command routing table, a heartbeat manager, and a data standardization engine; The message middleware is used to facilitate communication between agents and the central coordination layer, as well as between individual agents, using a publish-subscribe pattern through a lightweight distributed messaging system. The instruction routing table is used to dynamically maintain the mapping relationship between each agent ID and task type; The heartbeat manager is used to record the last active time of the agent and configure the timeout threshold; The data standardization engine is used to unify the output format of various intelligent agents.

9. The security management system supporting multi-agent collaboration according to claim 1, characterized in that, The central coordination layer is used to perform global load balancing, conflict resolution, and policy distribution. The global load balancing specifically includes: allocating security detection tasks to each intelligent agent based on their geographical location and resource utilization rate; The conflict resolution specifically includes: when multiple agents detect a threat at the same time, determining the priority of the threats detected by each agent and merging the alarms; The policy deployment specifically includes: dynamically updating security rules.

10. The security management and control system supporting multi-agent collaboration according to claim 1, characterized in that, The intelligent agent is deployed on a server in the form of a virtual machine or container, or the intelligent agent is set on a hardware security device.

Images