Network security event analysis method and system based on multi-agent decision, and storage medium

Abstract

The invention discloses a network security event analysis method and system based on multi-agent decision, and a storage medium, and the method mainly comprises the steps: carrying out the deep investigation and judgment through a deep decision agent based on a reinforcement learning network after an abnormal alarm of a monitoring platform is received, triggering the deep investigation when the calculated deep investigation probability is greater than a threshold value, and carrying out the early warning of the network security event. Calling an LLM-based sub-expert agent to carry out deep analysis aiming at specific features; and according to the analysis result of the sub-expert agent and the risk information provided by the risk information platform, the LLM-based comprehensive risk decision assessment agent performs conjoint analysis decision to generate a network security situation comprehensive assessment report. According to the method, the processing analysis capability of massive and heterogeneous security data and the recognition capability of complex attack paths are remarkably improved, and the discovery capability of unknown threats and the intelligent level of security operation and maintenance are effectively enhanced by introducing reinforcement learning optimization decision and the deep analysis capability of LLM.

Description

Technical Field

[0001] This invention relates to the field of network security situation assessment technology, and in particular to a network security incident analysis method and system based on multi-agent decision-making. Background Technology

[0002] Traditional network security situation awareness methods typically rely on technologies such as feature matching and rule engines, and perform joint analysis and alerts on heterogeneous logs from different security devices by manually configuring rules and setting thresholds. However, in today's highly complex and dynamic network environment, the sheer volume and variety of security logs and device logs pose challenges to existing technologies in quickly and accurately analyzing complex attack paths and identifying unknown or advanced persistent threats (APTs).

[0003] AIAgent (hereinafter referred to as "Agent") is based on artificial intelligence technology and has the ability to autonomously perceive, analyze, make decisions and invoke tools. It can automatically execute security situation analysis and judgment tasks, identify and respond to complex threats, and accurately find potential correlations between heterogeneous security logs. However, a single Agent is limited by issues such as context window, accuracy of multiple tools and API calls, and cannot fully meet the urgent need for comprehensive, accurate and efficient security situation assessment in complex network environments. Summary of the Invention

[0004] To address the aforementioned technical issues, this disclosure provides a network security incident analysis method and system based on multi-agent decision-making.

[0005] This method mainly includes the following steps: S1, acquire the raw alarm data from each monitoring and alarm platform, and perform noise reduction processing on the raw alarms; S2, obtain the asset information of the victim IP in the alarm, as well as the compliance requirements and handling suggestions related to the alarm type and asset attributes; S3 utilizes a deep investigation decision-making agent to perform in-depth analysis and intelligent decision-making on the acquired data, determining whether to initiate a deep investigation and which sub-expert agents or risk intelligence platforms to activate to complete the deep investigation. S4, based on the decision output and parameters transmitted by the deep investigation decision-making agent, drives the corresponding sub-expert agents and / or risk intelligence platform to execute their respective network analysis tasks in parallel and output structured analysis results. S5, the comprehensive risk decision assessment agent receives the analysis results output by each sub-expert agent and the risk intelligence platform, uses them as prompt words for the locally deployed LLM large language model, extracts confidence information from them, and after confidence weighting calculation, the LLM large model performs joint analysis and decision-making based on high confidence alarms, and outputs a network security situation assessment report after in-depth investigation.

[0006] Furthermore, step S1 specifically includes: Establish a unified data acquisition interface to centrally collect and standardize the processing of multi-source heterogeneous alarm data; Noise reduction of original alarms is achieved through data cleaning, key field filtering, data transformation, and alarm merging.

[0007] Furthermore, step S2 specifically includes: Detailed asset information of the victim IP in the alarm data can be obtained from the asset management system through a pre-packaged asset query API interface, including one or more of the following: device type, service affiliation, service type, and network policy. By querying the management regulations knowledge base using a vector matching algorithm, compliance requirements and handling suggestions related to alarm types and asset attributes can be obtained.

[0008] Furthermore, step S3 specifically includes: S31, Construct the deep investigation decision-making agent: The core of the deep investigation decision-making agent is a policy network π based on reinforcement learning. θ ( A t | S t The network is based on the current state vector. S t Output a complex action A t ;in: S t The data obtained from steps S1 and S2 is converted into a fixed-length vector representation, then the embedding layer processes textual information, and finally concatenates them to form a high-dimensional state vector. A t For structured data containing risk metrics and the probability of invocation for each sub-agent / intelligence platform:

[0009] Specifically, it includes: (1) Risk measurement indicators The deep investigation decision-making agent policy network first outputs a set of intermediate risk metrics, which are its comprehensive assessment results of the current alarms and asset status, including: Alarm Apparent Severity Score Score sev This represents the potential level of harm indicated by the alarm itself. ; Asset Importance Score Score asset : Represents the criticality of the affected assets. ; Compliance urgency score Score comp This indicates the urgency of the incident crossing compliance red lines. ; in, f(⋅) For the corresponding part of the neural network, θ is its parameter; (2) Sub-agent calling decisions and parameters For each predefined sub-expert agent j and external intelligence platform k, the deep investigation decision agent policy network outputs two types of parameters: Call probability P call_sub_j and P call_intel_k : Indicates the expected benefits or necessity of invoking the sub-agent and intelligence platform, where P call_sub_j This represents the probability of calling the j-th sub-agent. P call_intel_k This represents the probability of calling the k-th external intelligence platform; Dynamic parameter configuration Params sub_j and Params intel_k : Preset parameters used to configure different sub-expert agents. These preset parameters are used to set the specific working mode of the sub-agent and the intelligence platform. S32, based on the risk metric output by the deep investigation decision-making agent, calculate the final probability of initiating the deep investigation using the following formula:

[0010] in, w sev , w aseet, w compThese are the weighting coefficients of various risk metrics, which are obtained according to the preset security strategy; b is the bias term; the sigmoid function maps the weighted sum of risk metrics to the probability interval [0,1]. S33, when P deep_investigation Setting a survey threshold determines whether to conduct an in-depth investigation. according to A t Call probability P call_sub_j or P call_intel_k Sub-agents or intelligence platforms that exceed the set investigation threshold are included in in-depth investigations.

[0011] Furthermore, the reinforcement learning training method for the deep investigation decision-making agent includes: (1) Policy Network π θ Training reward function settings: reward function R t Used to quantify the decisions made by an intelligent agent conducting in-depth investigations. A t The degree of good or bad is calculated after a comprehensive evaluation at the end of each time step t, that is, after a decision is made.

[0012] in, W benefit and W cost These are the weighted hyperparameters used to balance benefits and costs; Benefit t To assess the overall effectiveness of the investigation, the following criteria will be determined based on the comprehensive risk decision assessment report and manual verification results in subsequent steps:

[0013] in, w tp ，w fp ，w fn ，w crit The weights of each benefit indicator; TruePos t Rewards will be given for genuine alerts. FalsePos t Investigation and punishment for false reports; FalseNeg t Penalties for underreporting; CriAli tThe key alignment reward represents the risk metric output by the deep investigation decision-making agent. Score sev Score asset Score comp The degree of matching with the overall risk level of the event in the final assessment of step S5; Cost t The cost of the survey and analysis was determined through data statistics:

[0014] in, w num_agents ，w time These are the weights of various cost indicators; NumCalledSubAgents t This refers to the number of sub-agents invoked, specifically the number of sub-expert agents and intelligence platforms actually invoked. Total Analysis Time t Total analysis time is the sum of the time consumed by all called sub-agents and intelligence platforms to complete the analysis.

[0015] (2) Loss function settings: The policy network π of the deep survey decision agent is trained using the PPO proximal policy optimization method. θ ( A t | S t ) and an auxiliary value network V ϕ ( S t In this context, the value network is used to evaluate the value of a state to reduce the variance of the policy gradient, while the policy network π... θ ( A t | S t The parameter θ replaces the objective function by maximizing the pruning of PPO. L CLIP (θ) Optimization can be achieved using gradient ascent.

[0016] in, This represents the expectation for a set of empirical samples; r t (θ) For the current strategy π θ and the old strategy θ when collecting experience oldOutput the probability ratio of the same action.

[0017] For the advantage function estimate at time step t, it measures the advantage function in state t. S t Take action A t The generalized advantage estimation (GAE) is used to calculate the relative strength of actions to the average level of good or bad.

[0018] Where K is the number of GAE steps; γ∈[0,1] is the discount factor for future rewards; λ∈[0,1] is the trace decay parameter in GAE; δ t+l For TD error,

[0019] Value Network V ϕ ( S t The parameter ϕ is minimized by the value loss function. L VF (ϕ) Optimization is performed using the mean squared error method:

[0020] Finally, the total loss function is:

[0021] in, H (⋅) represents the entropy of the strategy distribution, used for entropy rewards to encourage exploration; c1 is the coefficient of value loss; c2 is the coefficient of entropy reward. (3) Specific training and feedback iteration process of the in-depth investigation decision-making agent: ① Initialization: Initialize the policy network π θ Value Network V ϕ Assign the initial parameter θ to θ′ and ϕ to ϕ′; ② Data Collection: The deep investigation decision-making agent, based on the current strategy, i.e., π with parameter θ′. θ′ It interacts with the environment and collects experience sequences over multiple rounds. S t , A t , R t , S t+1 ); ③ Advantage calculation: Utilizing the collected reward and value network, i.e., V with parameter ϕ′. ϕ′The prediction calculates the advantage at each time step. Harmony and Value Goals ( R t +γV ϕ′ ( S t+1 )); ④ Parameter Update: Using the collected data, optimize the above L... total (θ,ϕ) is used to update the policy network parameters θ′ to θ and the value network parameters from ϕ′ to ϕ; ⑤ Iteration: Repeat steps ②-④ until the performance of the deep investigation decision agent converges or the preset training budget is reached.

[0022] Furthermore, the sub-expert agents in step S3 include one or more of the following: host behavior analysis agent, antivirus analysis agent, raw traffic analysis agent, application firewall analysis agent, and application log analysis agent. Each sub-expert agent is driven by an LLM, prompt words, and tool calls. The LLM is responsible for understanding the task in the prompt words, calling tools, parsing the data obtained from the tools, executing analysis logic, and finally generating structured JSON output for subsequent analysis steps.

[0023] Furthermore, step S5 specifically includes: The integrated intelligent agent receives output results from various sub-expert intelligent agents and external risk intelligence platforms, and encapsulates them into complex prompt words for the locally deployed LLM large language model; Extract the independent confidence scores from the structured data output by each sub-agent and perform a weighted calculation: Suppose that for a specific alarm or entity, N sub-agents provide analysis results, and each sub-agent i gives a confidence level of... C i The corresponding weight is W i Then the overall confidence level of the event or indicator. C integrated The calculation method is as follows:

[0024] Data Fusion: LLM uses the calculated overall confidence level, combined with compliance requirements, asset importance information, and the potential impact of events obtained from the management regulations knowledge base, to correlate security events and alarms from different sub-agents that have an overall confidence level exceeding a set threshold and are temporally and logically related, under the guidance of complex prompt words. Attack chain analysis: Based on related events and alerts, reconstruct the most likely attack chain according to time sequence and logical relationships; Finally, based on the confidence level calculation, information fusion, and attack chain analysis results, LLM, guided by complex prompts, makes final joint decisions and risk assessments, including: comprehensive risk level assessment, assessment of the actual impact and potential risks on the business, and prediction of one or more of the attacker's subsequent actions.

[0025] Furthermore, the cybersecurity situation assessment report includes one or more of the following components: Security incident summary, attack chain analysis, detailed analysis and evidence, risk assessment, impact analysis, handling recommendations, and compliance analysis.

[0026] A network security incident analysis system based on multi-agent decision-making, applying the above method, mainly includes: Alarm data processing module: Configured to periodically acquire raw alarm data from various monitoring and alarm platforms, perform noise reduction on the raw alarms, and establish a unified data acquisition interface to achieve centralized collection and standardization of multi-source heterogeneous alarm data; Deep Investigation Decision-Making Agent: Combining the asset information and management regulations knowledge base information of the victim IP, it performs in-depth analysis and intelligent decision-making on the integrated data, and outputs structured JSON decision results. These results determine the subsequent calls to sub-agents and external risk intelligence platforms in a probabilistic weighted manner. Sub-expert analysis module: includes multiple sub-expert agents driven by LLM, prompt words, and tool calls; executes corresponding analysis tasks in parallel based on the output and parameters passed by the deep investigation decision agent, and outputs structured JSON analysis results; Comprehensive Risk Decision Assessment Agent: This agent receives the analysis results from various sub-expert agents and the risk intelligence platform, uses them as prompts for the locally deployed LLM large language model, extracts confidence information from them, and performs joint analysis and decision-making based on high-confidence alarms after confidence weighting calculation. It then outputs a cybersecurity situation assessment report based on in-depth investigation.

[0027] A storage medium having a computer program stored thereon, which, when installed in a computer system or executed by a processor, enables the implementation of the methods described herein.

[0028] The network security incident analysis method based on multi-agent decision-making disclosed herein, through the collaborative operation among multiple agents and the precise design of each stage, proceeds from noise reduction processing of multi-source heterogeneous alarm data, accurate acquisition of the status of victim IP assets and compliance requirements, to dynamic optimization decision-making of the deep investigation decision-making agent, to parallel analysis of sub-expert agents driven by LLM, and finally to joint decision-making and generation of assessment report by the comprehensive risk decision assessment agent. Each link is closely coupled and efficiently linked.

[0029] Compared with existing technologies, the beneficial effects of this disclosure are: ① It significantly improves the ability to process and analyze massive and heterogeneous security data and the ability to identify complex attack paths; ② By introducing reinforcement learning to optimize decision-making and LLM's deep analysis capabilities, it effectively enhances the ability to discover unknown threats and the level of intelligent security operations and maintenance; ③ It provides more professional, accurate and efficient security situation assessment services for complex business scenarios, and dynamically responds to the continuously evolving cybersecurity challenges. Attached Figure Description

[0030] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of exemplary embodiments of this disclosure taken in conjunction with the accompanying drawings, in which the same reference numerals generally represent the same components.

[0031] Figure 1 This is a diagram illustrating the overall architecture of a network security incident analysis system based on multi-agent decision-making, according to the present disclosure. Figure 2 This is a flowchart of a network security incident analysis method under an exemplary implementation. Figure 3 This is a flowchart illustrating the knowledge base retrieval process under an exemplary implementation. Figure 4 This is a block diagram of a network security incident analysis system under an exemplary implementation. Detailed Implementation

[0032] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0033] This disclosure provides a network security incident analysis method based on multi-agent decision-making. In one exemplary implementation, the network security incident analysis method according to this disclosure is as follows: Figure 2 As shown, the main steps include: 1. Regularly acquire the raw alarm data of each monitoring and alarm platform for the most recent 24 hours, perform data processing, and achieve noise reduction of raw alarms through data cleaning, key field filtering, data transformation and alarm merging; as a preferred option, establish a unified data acquisition interface to centrally collect and standardize the processing of multi-source heterogeneous alarm data. 2. Obtain the asset information of the affected IP in the alarm through the encapsulated asset query API, including device type, service ownership, service type, network policy and other information. Use the m3e-base Embedding model in combination with the Weaviate vector database to query the management regulations knowledge base to obtain compliance requirements and handling suggestions related to alarm type and asset attributes. The relevant query results are returned in JSON format. 3. Conduct in-depth analysis and intelligent decision-making on the integrated multi-source heterogeneous data through an in-depth investigation and decision-making intelligent agent; This intelligent agent not only decides whether an in-depth investigation is needed, but also dynamically optimizes its decision-making strategy through reinforcement learning to maximize the "investigation benefits" (such as accurately identifying high-risk events, improving threat detection rates, and ensuring the security of critical assets) while minimizing the "investigation costs" (such as the number of sub-agents invoked, analysis time, and computational resource consumption), and outputs structured JSON decision results. 4. Based on the structured JSON decision results output by the deep investigation decision-making agent, determine which sub-expert agents and external risk intelligence platforms to invoke in a probabilistic weighted manner, and pass the corresponding analysis parameters to these sub-expert agents; each sub-expert agent is driven by a large language model (LLM), prompt words and tool calls. The LLM is responsible for understanding the task, calling tools, parsing data and executing analysis logic, and finally generating structured JSON output; 5. The comprehensive risk decision assessment agent receives the output results from each sub-expert agent and the risk intelligence platform, encapsulates this information as a key component of complex prompt words, and inputs it into the locally deployed LLM. After confidence calculation, the agent relies on the large model to make joint decisions and generates a network security situation assessment report based on in-depth investigation. The report is output in a structured form.

[0034] The overall architecture of a network security incident analysis system based on multi-agent decision-making, corresponding to the above method, is attached. Figure 1 As shown, it should be noted that, considering the heterogeneous sources of security devices in actual application scenarios are not entirely the same, the design principle of this embodiment ensures considerable redundancy. Sub-expert modules can be added or removed arbitrarily according to the actual situation, and each intelligent agent can also call different tools and knowledge bases according to the actual situation.

[0035] The specific methods for each step are further explained below.

[0036] Step 1 The system periodically acquires the raw alarm data from each monitoring and alarm platform for the past 24 hours, processes the data, and achieves noise reduction of the raw alarms through data cleaning, key field filtering, data transformation, and alarm merging. This stage mainly addresses the issues of data preprocessing and acquisition by establishing a unified data acquisition interface to achieve centralized collection and standardized processing of multi-source heterogeneous alarm data.

[0037] First, through the configured scheduled task module, API calls are automatically initiated to the data platform at fixed time intervals Δt (default setting is 1 hour) to obtain the raw alarm dataset of the most recent 24 hours. D raw For the i-th alarm platform, the acquired raw alarm data can be represented as:

[0038] in, a j i This represents the j-th alarm record on the i-th platform, which includes timestamp, alarm type, alarm level, source IP, destination IP, port information, and other fields.

[0039] During the data cleaning phase, the original alarm dataset is... D raw Missing values, outliers, and duplicate records are handled. For missing values, the following strategy is adopted: for missing critical fields (such as IP address, alarm type), the alarm is directly filtered out; for non-critical fields, the mean, mode, or a specific default value is used to fill in the missing values, depending on the field type. For numeric fields x, its standardized score is calculated:

[0040] Where μ is the mean of the field, and σ is the standard deviation. When | Z(x) |>θ z (In this scenario, set to 3.0), it is identified as an outlier and processed. For duplicate records, identification and deduplication are performed based on a combination of timestamps and key fields, retaining the latest alarm record.

[0041] During the key field filtering phase, system administrators can manually specify the set K of key fields to be retained through the configuration interface. For each alarm platform, different field filtering strategies can be customized based on its unique alarm characteristics. For example, for a network traffic monitoring platform, {timestamp, source IP, destination IP, alarm type, attack method} can be specified as core fields; for a host security platform, {timestamp, host IP, process name, alarm type, impact level} can be specified as core fields. The system retains only these manually specified key fields, removing redundant information that is not important for subsequent analysis, thereby reducing the data processing burden and improving analysis efficiency.

[0042] During the alarm merging phase, the system clusters alarms based on three core dimensions: attack source (source IP address), attack type (alarm type), and time window. First, the system initially groups alarms according to their source IP address. Second, within each IP group, the system further considers the similarity of alarm types and time window constraints, treating multiple alarms occurring within a specified time window and exhibiting similar alarm types as multiple manifestations of the same attack behavior, and merging them into a single attack event. The formal representation is as follows: For an alarm set S = {a1, a2, ..., a...} with the same source IP address... k}, a will be a if and only if the following condition is met. i and a j Merged into a single attack event:

[0043] in sim type For attack type similarity function, θ sim This is the threshold for type similarity.

[0044]

[0045] in Time(a) For alarm timestamps, T This is the threshold for the time window.

[0046] Through the above processing, the system can reduce noise and correlate alarms within a platform while maintaining the original characteristics of alarm data from each platform. The system aggregates multiple similar alarms generated by the same attack source within a specific time window into a single attack event, while retaining statistical information such as the first occurrence time, last occurrence time, attack frequency, and number of attempts. This time-window-constrained clustering method effectively identifies continuous attack behavior and avoids mistakenly merging independent attacks with large intervals into a single event. The noise-reduced alarm data will be used for subsequent asset correlation and security posture assessment analysis.

[0047] Step 2: The system retrieves information on the victim's IP assets through a packaged asset query API, and uses a vector matching algorithm to query the management regulations knowledge base to obtain compliance requirements and disposal suggestions. In this step, the system first retrieves detailed asset information of the victim IPs involved in the alarm data from the asset management system through a pre-packaged asset query API interface. The asset query API input parameter is the list of victim IP addresses extracted from the alarm data, and the output result is returned in JSON format. The returned asset information includes, but is not limited to, the following fields: device type (such as server, router, switch, etc.), service affiliation (such as core business, edge business, etc.), service type (such as live streaming service, data transmission, etc.), and network policy (such as access control list ACL, firewall rules, etc.).

[0048] After obtaining the asset information of the victim IP, the system uses the m3e-base Embedding model (a Chinese pre-trained model based on multi-task learning) combined with the Weaviate vector database to query the management regulations knowledge base to obtain compliance requirements and handling suggestions related to the alarm type and asset attributes. (Attached) Figure 3 This demonstrates the entire process of knowledge base retrieval. During the query process, alarm data is preprocessed, and alarm type (such as DDoS attack, SQL injection, etc.) and asset attributes (such as device type, business type) are extracted as query conditions. These are then transformed into query vectors using the m3e-baseEmbedding model. The system utilizes Weaviate's built-in cosine similarity calculation function to retrieve the management regulations most similar to the query vector from the vector database, returning the top K relevant regulations.

[0049] The output of this step is returned in structured JSON format, containing the victim IP's asset information, a list of matching management regulations, and compliance requirements and handling suggestions for each management regulation.

[0050] Step 3: The decision-making agent conducts in-depth analysis and intelligent decision-making on integrated multi-source heterogeneous data through in-depth investigation.

[0051] In this step, the deep investigation decision-making agent first receives the data processed in the previous steps. This data is multi-dimensional and structured, specifically including: 1. The raw alarm data from the most recent 24 hours after noise reduction processing such as data cleaning, key field filtering, data transformation, and alarm merging; 2. Detailed information about the affected IP assets obtained through the asset query API, such as device type (server, router, workstation, etc.), business affiliation (core business system, office network, etc.), business type (Web service, database service, file sharing, etc.), deployed network policies (ACL rules, firewall policies, etc.), and asset importance level; 3. Compliance requirements, historical experience in handling similar events, and standard handling recommendations highly related to the current alarm type and the attributes of the affected assets, retrieved from the management regulations knowledge base through the m3e-base Embedding model and the Weaviate vector database. For use by the reinforcement learning model, this structured and semi-structured data will be converted into a unified numerical feature vector. S t To enable the agent to process this information effectively, it is converted into a fixed-length vector representation. This textual information is then processed through an embedding layer, and finally concatenated to form a high-dimensional state vector. S t .

[0052] The core of the deep investigation decision-making agent is a policy network π based on reinforcement learning. θ ( A t | S t The network is based on the current state. S t Output a complex action A t . A t It is not a single instruction, but a structured set of decisions, specifically comprising the following components and levels: (1) Risk measurement index output The deep investigation decision-making agent policy network first outputs a set of intermediate risk metrics, which are its comprehensive assessment results of the current alarms and asset status: Alarm apparent severity score ( Score sev ): The range is [0,1], representing the potential harm level indicated by the alarm itself, based on factors such as alarm type, frequency, and source reputation.

[0053]

[0054] Asset Importance Score Score asset): The range is [0,1], representing the criticality of the affected assets, based on factors such as business impact and data value.

[0055]

[0056] Compliance urgency score ( Score comp ): The range is [0,1], representing the urgency of an event that crosses the compliance red line, based on the strictness of relevant compliance clauses and potential penalties.

[0057]

[0058] in f(⋅) θ represents the corresponding part of the neural network, and θ is its parameter.

[0059] (2) Sub-agent calling decisions and parameters For each predefined sub-expert agent j (e.g., the original traffic analysis agent RTA, the host behavior analysis agent HSP, etc.) and the external intelligence platform k, there are two types of parameters: Call probability P call_sub_j and P call_intel_k The range [0,1] represents the expected benefits or necessity of invoking this sub-agent / intelligence platform. P call_sub_j This represents the probability of calling the j-th sub-agent. P call_intel_k This represents the probability of calling the k-th external intelligence platform.

[0060] Dynamic parameter configuration Params sub_j and Params intel_k Dynamic parameter configuration is directly preset for different expert agents. These preset parameters guide the specific operation of the sub-agent / intelligence platform. For example, for RTA, preset parameters may include analysis_window and protocol_filters; for HSP, they may include scan_depth and target_processes.

[0061] Therefore, action A t This can be understood as structured data containing risk metrics and the probability of each sub-agent / intelligence platform being invoked:

[0062] Based on the risk metrics output by the deep investigation decision-making agent, the system will calculate the final probability of initiating a deep investigation as follows.

[0063] in, w sev , w aseet, w comp ... P deep_investigation >τ investigate , (where τ investigate (This is a fixed investigation threshold set by the system, with a value of 0.6). The system will then conduct an in-depth investigation. Similarly, based on... A t Probability of calling various sub-agents and intelligence platforms P call_sub_j or P call_intel_k Greater than τ investigate The intelligent experience was incorporated into the in-depth investigation.

[0064] Training methods for deep investigation decision-making agents: In this embodiment, the deep investigation decision agent not only decides whether an in-depth investigation is needed, but also dynamically optimizes its decision-making strategy through reinforcement learning. Its goal is to maximize the "investigation benefits" (such as accurately identifying high-risk events, improving threat detection rates, and ensuring the security of critical assets) while minimizing the "investigation costs" (such as the number of sub-agents invoked, analysis time, and computational resource consumption), and output structured JSON decision results.

[0065] • Reward function settings To train the policy network π of the deep investigation decision-making agent θ reward function R t The reward function is calculated at the end of each time step t (i.e., after a comprehensive evaluation following a decision-making process). The reward function aims to quantify the decisions made by the deep investigation decision-making agent. A t Degree of good or bad:

[0066] In the formula, W benefit and W cost It is a weighted hyperparameter used to balance benefits and costs.

[0067] Benefitt (Comprehensive survey benefits) will be determined based on the comprehensive risk decision assessment report and manual verification results in subsequent steps.

[0068]

[0069] in, w tp ，w fp ，w fn ，w crit These are the weights of various performance indicators; TruePos t (Reward for True Alarm Discovery): If an investigation initiated by the deep investigation decision-making agent is ultimately confirmed as a True Positive (TP) event in step 4, a positive reward is given. The reward value can be scaled according to the actual severity level of the event; FalsePos t (False Positive Investigation Penalty): If an investigation initiated by the deep investigation decision-making agent is ultimately confirmed as a false positive or low-risk event (FP), a negative reward will be given; FalseNeg t (Penalty for underreporting): If the deep investigation decision-making agent decides not to initiate an investigation (or its assessed risk metric is low, resulting in...) P deep_investigation ≤τ investigate However, if it is found through other means or manual analysis that the alarm actually corresponds to a real high-risk event (False Negative, FN), a significant negative reward will be given. CriAli t (Key Alignment Reward): Risk metrics (Score) output by the deep investigation decision-making agent. sev Score asset Score comp The degree of matching between the risk level and the overall risk level of the event as determined in step 5. The higher the degree of matching, the greater the reward.

[0070] Cost t The cost of the survey and analysis is determined by statistical data.

[0071]

[0072] in, w num_agents , w time These are the weights of various cost indicators; NumCalledSubAgents t (Number of sub-agents invoked): The actual number of sub-expert agents and intelligence platforms invoked.

[0073] Total Analysis Time t (Total Analysis Time): The total time consumed by all called sub-agents to complete the analysis (from the start of the call to the return of the result).

[0074] • Loss function settings To ensure effectiveness, the system employs Proximal Policy Optimization (PPO) to train the policy network π of the deep survey decision-making agent. θ ( A t | S t ) and an auxiliary value network V ϕ ( S t Value networks are primarily used to evaluate the value of a state in order to reduce the variance of policy gradients.

[0075] And the policy network π θ ( A t | S t The parameter θ is replaced by maximizing the pruning of PPO in the objective function L. CLIP (θ) Optimization is achieved using gradient ascent.

[0076]

[0077] in This represents the expectation for a set of empirical samples; r t (θ) It is the current strategy π θ and the old strategy for collecting experience (denoted as θ) old Output the probability ratio of the same action;

[0078] It is the advantage function estimate at time step t. It measures the advantage function in state t. S t Take action A tThe relative strength or weakness of an action compared to the average action. Calculated using Generalized Advantage Estimation (GAE):

[0079] Where K is the number of GAE steps; γ∈[0,1] is the discount factor for future rewards; λ∈[0,1] is the trace decay parameter in GAE; δ t+l Yes, it is a TD error.

[0080]

[0081] Value Network V ϕ (S t ) The parameter ϕ is obtained by minimizing the value loss function. L VF (ϕ) Optimization is performed using mean squared error.

[0082]

[0083] Finally, the total loss function is:

[0084] in H (⋅) is the entropy of the policy distribution, mainly used for entropy rewards to encourage exploration; c1 is the coefficient of value loss; c2 is the coefficient of entropy reward.

[0085] Thus, the system completed the setting of the reward function and loss function for the reinforcement learning of the deep investigation decision-making agent. The specific training and feedback iteration process of the agent is as follows: (1) Initialization: Initialize the policy network π θ Value Network V ϕ Assign the initial parameter θ to θ′ and ϕ to ϕ′.

[0086] (2) Data collection: The deep investigation decision-making agent is based on the current strategy (π with parameter θ′). θ′ ) interacts with the environment, collecting experience sequences over multiple rounds. S t , A t , R t , S t+1 ).

[0087] (3) Advantage calculation: using the collected reward and value network (V with parameter ϕ′) ϕ′The prediction calculates the advantage at each time step. and value goals ( R t +γV ϕ′ ( S t+1 )).

[0088] (4) Parameter update: Using the collected data, optimize the above L total (θ,ϕ) is used to update the policy network parameters θ′ to θ and the value network parameters from ϕ′ to ϕ.

[0089] (5) Iteration: Repeat steps (2)-(4) until the performance of the deep investigation decision agent converges or the preset training budget is reached.

[0090] Finally, the JSON format of the deep investigation decision-making agent and its subsequent deep investigation probabilities is shown below: { "request_id": "unique_alert_incident_id_12345", "timestamp": "2025-06-03T14:30:00Z", "dida_outputs": { / / Direct outputs of the deep investigation decision-making agent policy network "apparent_severity_score": 0.75, "asset_importance_score": 0.90, "compliance_urgency_score": 0.60, "sub_agent_decisions": [ { "agent_name": "HSP_Agent", "call_probability": 0.88 / / Parameter is preset }, { "agent_name": "RTA_Agent", "call_probability": 0.70 / / Parameter is preset } / / ... Decisions made by other sub-agents (including only the probability of invocation) ], "intelligence_platform_decisions": [ { "platform_name": "ThreatIntelPlatform_VirusTotal", "call_probability": 0.95 / / Parameter is preset } / / ... Decisions made by other intelligence platforms (including only the probability of being invoked) ] }, "derived_investigation_parameters": { "deep_investigation_probability": 0.825, / / Calculated based on the above score and weights "investigation_threshold_used": 0.60, "trigger_deep_investigation": true / / (0.825>0.60) }, "selected_investigation_plan": { / / The actual investigation plan executed "activated_sub_agents": [ { "agent_name": "HSP_Agent", "parameters_used": { / / Default parameters for HSP_Agent "analysis_depth": "critical_processes_only", "time_window_hours": 4, "focus_events": ["suspicious_process_execution","unusual_network_outbound"] } }, { "agent_name": "ThreatIntelPlatform_VirusTotal", "parameters_used": { / / Default parameters for ThreatIntelPlatform_VirusTotal "query_indicators": ["suspicious_file_hash_xyz","malicious_domain_abc.com"], "report_type": "full_context_and_relations" } } ], "estimated_cost_score": 0.38, "expected_benefit_score": 0.85 } } After dynamically optimizing its decision-making strategy through reinforcement learning, the deep investigation decision-making agent will eventually output structured decision results upon receiving new security alerts. Based on the decision results, it will call different sub-expert agents or intelligence platforms. The sub-expert agents in this system include: Host Behavior Analysis Agent (HSP); Antivirus Analysis Agent (AVP); Raw Traffic Analysis Agent (RTA); Application Firewall Analysis Agent (AFA); and Application Log Analysis Agent (ALA).

[0091] Through the above design, the deep investigation decision-making agent can not only make decisions on whether to conduct an investigation, but also intelligently orchestrate and configure downstream analytical resources, and continuously improve the accuracy and efficiency of its decisions through continuous learning, thereby significantly enhancing the intelligence level of the entire cybersecurity situation assessment system.

[0092] Step 4: In step 3, the structured JSON decision results output by the deep investigation decision-making agent will be used in a probabilistic weighted manner to determine which sub-expert agents and external risk intelligence platforms to invoke, and which analysis parameters to pass to these sub-expert agents. Each sub-expert agent is driven by an LLM, prompts, and tool calls. The LLM is responsible for understanding the tasks in the prompts, calling tools, parsing the data obtained from the tools, and executing analysis logic (such as pattern recognition, correlation, and anomaly detection), ultimately generating structured JSON output for subsequent analysis steps.

[0093] Detailed design of the sub-expert agent in the system: (1) Host Behavior Analysis Agent (HSP): The core function of this intelligent agent is to deeply analyze various system logs (such as EDR logs, system event logs, and security audit logs) and alarm logs from the host security monitoring platform on a specified host in order to detect malicious activities, abnormal behaviors, policy violations, and assess the extent to which the host is affected.

[0094] Inputs include: alarm logs from host protection security products; parameters transmitted by the deep investigation decision-making agent.

[0095] The output includes a structured JSON analysis report containing findings summary, detailed events, IOCs, risk assessment, action recommendations, and confidence levels.

[0096] The required tools include: Log Query API for querying host system logs and host protection security logs; and Threat Intelligence API for querying suspicious file hashes, IP addresses, or domain names.

[0097] The prompt word template used in this method: As a host behavior analysis expert, you will analyze host activity related to the event [{{request_id}}].

[0098] Initial alarm information: {{initial_alert_context}} Target host identifier: {{target_host_identifier}} (e.g., IP address or hostname) Analysis parameters: - Analysis depth: {{parameters.analysis_depth}} (e.g., 'critical_processes_only', 'full_system_scan', 'user_activity_focused') - Time window: Past {{parameters.time_window_hours}} hours - Focus events: {{parameters.focus_events}} (a list of event types, e.g., ["suspicious_process_execution","unusual_network_outbound","privilege_escalation", "file_tampering"]) Asset information summary: {{asset_summary}} (e.g., Type: Database Server, Business Importance: Core) Your task is: 1. Use the [Log Query API] tool to retrieve logs related to "Events of Priority" on the target host within a specified time window. If the "Analysis Depth" is set to 'full_system_scan', a wider range of logs will be retrieved.

[0099] 2. Analyze the logs and look for the following signs: a. Specific activities that match the "Key Concerns" list.

[0100] b. Unknown or suspicious process creation, service installation, scheduled tasks.

[0101] c. Abnormal user login behavior (time, location, frequency, permission changes).

[0102] d. Unauthorized access to or modification of sensitive files or the registry.

[0103] e. Activity sequences that match known malware behavior patterns.

[0104] f. Communication with suspicious external IPs / domains.

[0105] 3. If suspicious file hashes, IP addresses, or domain names are found, you can optionally use the [ThreatIntelligenceAPI] tool to check their reputation.

[0106] 4. Based on the analysis, summarize the key findings on the host, identify potential IOCs, and assess the host's compromised state and risks.

[0107] 5. Provide the confidence level of the analysis (0.0-1.0).

[0108] The output JSON format is as follows: { "agent_name": "HSP_Agent", "request_id": "{{request_id}}", "host_identifier": "{{target_host_identifier}}", "analysis_summary": "Analysis and summary of host activity..." "key_findings": [ / / Discovery list] { "timestamp": "YYYY-MM-DDTHH:MM:SSZ", "event_description": "A detailed description of the suspicious event", "event_type": "For example: suspicious_process_execution", "indicators": ["evil.exe", "C:\\temp\\evil.exe"], "severity_estimate": "High / Medium / Low", "supporting_log_entries": ["Original log fragment 1","Original log fragment 2"] } ], "threat_intelligence_results": [ / / Optional threat intelligence query results] {"indicator": "1.2.3.4", "report_summary": "Known C2 server"} ], "overall_host_risk_assessment": "Assessment of the current risk status of the host", "confidence_score": 0.85 } (2) Antivirus Analysis Agent (AVP) The core function of this intelligent agent is to analyze logs from antivirus software to identify detected malware, its type, status, and any unresolved threats.

[0109] Inputs include: antivirus software scan logs; parameters passed by the deep investigation decision-making agent.

[0110] The output includes a structured JSON analysis report containing findings summary, detailed events, risk assessment, action recommendations, and confidence levels.

[0111] Dependencies: Log Query API for querying antivirus product logs; Threat Intelligence API for querying malicious file information.

[0112] The prompt word template used in this method is: As an antivirus analysis expert, you will analyze antivirus detection logs related to the event [{{request_id}}].

[0113] Initial alarm information: {{initial_alert_context}} Target host identifier: {{target_host_identifier}} Analysis parameters: - Time window: Past {{parameters.time_window_hours_av | default(24)}} hours - Threat names / signatures to focus on: {{parameters.threat_signatures_focus | default("any")}} (e.g., ["Trojan.GenericKD", "WannaCry"]) - Whether to check for failed cleanup records: {{parameters.check_failed_actions | default(true)}} Asset Information Summary: {{asset_summary}} Your task is: 1. Use the [Log Query API] tool to obtain the antivirus logs of the target host within a specified time window, paying particular attention to records related to "threat names / signatures".

[0114] 2. Analyze the logs to identify all malware detection events. Records: a. Detection time.

[0115] b. Name and type of malware (e.g., virus, Trojan, ransomware).

[0116] c. Affected file paths and filenames.

[0117] d. Actions taken by the antivirus software (such as quarantine, deletion, failure to remove, logging only).

[0118] e. If "Check for failed cleanup records" is true, any failed cleanup attempts or cases where only uncleaned cleanup attempts are detected will be highlighted.

[0119] 3. For the detected high-risk malware name or file hash, call the [Threat Intelligence API] to query more detailed information.

[0120] 4. Summarize the analysis results, listing the detected threats, their status, and any unresolved risks.

[0121] 5. Provide the confidence level of the analysis (0.0-1.0).

[0122] The output JSON format is as follows: { "agent_name": "AVP_Agent", "request_id": "{{request_id}}", "host_identifier": "{{target_host_identifier}}", "analysis_summary": "Antivirus log analysis summary...", "detected_threats": [ { "timestamp": "YYYY-MM-DDTHH:MM:SSZ", "malware_name": "Trojan.GenericKD.321568", "malware_type": "Trojan", "file_path": "C:\\Users\\user\\AppData\\Local\\Temp\\evil.exe", "action_taken": "Quarantined", / / Deleted, Cleaned, Failed,LoggedOnly "action_status": "Success", / / Failed, Partial "threat_intel_summary": "(Optional threat intelligence summary)" } ], "unresolved_threat_count": 1, / / Number of threats that failed to be resolved or were only logged. "confidence_score": 0.9 } (3) Raw Traffic Analysis Agent (RTA) The core function of this intelligent agent is to analyze network traffic logs to identify suspicious network connections, data transmission patterns, communication with malicious entities, and potential policy violations.

[0123] Inputs include: alarm logs from the traffic monitoring platform; parameters transmitted by the deep investigation decision-making agent.

[0124] The output includes a structured JSON analysis report containing findings summary, detailed events, risk assessment, action recommendations, and confidence levels.

[0125] Dependencies: Log Query API for querying traffic monitoring platform logs; Threat Intelligence API for querying threat intelligence.

[0126] The prompt word template used in this method is: As a network traffic analysis expert, you will analyze network traffic related to the event [{{request_id}}].

[0127] Initial alarm message: {{initial_alert_context}} (may contain source / destination IP) Analysis parameters: - Source IP filtering: {{parameters.source_ip_filter}} (e.g., 'victim_ip_subnet', 'specific_internal_ip', 'any_internal_to_external') - Destination IP filtering (optional): {{parameters.destination_ip_filter}} - Protocol focus: {{parameters.protocol_focus}} (e.g., ["DNS", "HTTP", "HTTPS", "SMB"]) - Analysis time window (lookback minutes): {{parameters.lookback_minutes}} - Analysis granularity: {{parameters.analysis_granularity}} (e.g., 'flow_metadata', 'connection_summary', 'dns_queries_only') Asset Information Summary (Related IPs): {{asset_summary}} Your task is: 1. Based on the relevant parameters, call the [Log Query API] tool to obtain the relevant network traffic logs / metadata.

[0128] 2. Analyze traffic data and look for the following signs: a. Communication with known malicious IP addresses, domain names, or URLs (optionally verified by calling the [Threat Intelligence API]).

[0129] b. Abnormal data transfer volume or pattern (e.g., large amounts of outbound data to unexpected destinations, periodic small-volume "heartbeat" connections).

[0130] c. Using protocols on non-standard ports, or exhibiting unusual protocol behavior on standard ports.

[0131] d. Specific analysis regarding "protocol concerns": DNS: Numerous failed queries, queries for suspicious or DGS domains, and abnormal record types.

[0132] HTTP / S: Suspicious User-Agent, request to a malicious URL, abnormal request method or response code.

[0133] e. Signs of unusual lateral movement between internal hosts.

[0134] 3. Summarize the analysis results and list suspicious connections, identified IOCs (IP, domain, URL), and potential risks.

[0135] 4. Provide the confidence level of the analysis (0.0-1.0).

[0136] The output JSON format is as follows: { "agent_name": "RTA_Agent", "request_id": "{{request_id}}", "analysis_scope": { "source_filter": "{{parameters.source_ip_filter}}", "destination_filter": "{{parameters.destination_ip_filter |default('any')}}", "protocols": "{{parameters.protocol_focus}}", "time_window_minutes": "{{parameters.lookback_minutes}}" }, "analysis_summary": "Summary of network traffic analysis...", "suspicious_connections": { "timestamp_start": "YYYY-MM-DDTHH:MM:SSZ", "source_ip": "...", "source_port": "...", "destination_ip": "...", "destination_port": "...", "protocol": "TCP", "bytes_sent": 1024, "bytes_received": 20480, "reason_for_suspicion": "Connection to known C2 IP.", "threat_intel_match": {"indicator": "...", "report": "..."} / / Optional } , "identified_iocs": { "ips": ["1.2.3.4"],"domains": ["evil.com"], "urls": [] }, "confidence_score": 0.75 } (4) Application Firewall Analysis Agent (AFA) The core function of this intelligent agent is to analyze the logs of the application firewall (WAF), identify attacks against web applications or other protected applications (such as SQL injection, XSS, CSRF), and evaluate the success or failure of the attack and the effectiveness of the firewall's protection.

[0137] Inputs include: application firewall protection logs; parameters passed by the deep investigation decision-making agent.

[0138] The output includes: structured JSON containing detected attack events, potential bypass signs, and confidence levels.

[0139] Dependency: The Log Query API is used to query application firewall protection logs.

[0140] The prompt word template used in this method is: As an application firewall analytics expert, you will analyze application protection logs related to the event [{{request_id}}].

[0141] Initial alert message: {{initial_alert_context}} (may contain the target URL or application name) Analysis parameters: - Target application / URL identifier: {{parameters.target_application_identifier}} (e.g., 'ecom_portal', 'https: / / example.com / login') - Analysis time window: Past {{parameters.time_window_hours_afa | default(6)}} hours - Attack type of focus: {{parameters.attack_type_focus | default(["SQLInjection", "XSS", "PathTraversal", "Command Injection"])}} - Check for blocked attacks: {{parameters.check_blocked | default(true)}} - Check for potentially successful attacks (alert only or not detected): {{parameters.check_allowed_suspicious | default(true)}} Asset Information Summary (Application): {{asset_summary}} Your task is: 1. Use the [Log Query API] tool to retrieve application firewall logs for the target application / URL identifier within a specified time window.

[0142] 2. Analyze the logs to identify events related to the "attack types of interest". Records: a. Attack time, source IP, target URL, HTTP method.

[0143] b. Detected attack types and related rule IDs.

[0144] c. Actions taken by the application firewall (such as Block, Alert, Monitor, Pass).

[0145] d. Suspicious parameters or payload fragments in the request (if provided in the logs).

[0146] 3. If “Check for potentially successful attacks” is true, pay special attention to suspicious requests that are only alerted but not blocked, or judge attacks that may bypass detection based on request characteristics.

[0147] 4. (Optional) Query the reputation of the high-frequency attack source IP using the [Threat Intelligence API].

[0148] 5. Summarize and analyze the results, including attack summaries detected, blocked attacks, and potential bypass or successful attack indications.

[0149] 6. Provide the confidence level of the analysis (0.0-1.0).

[0150] The output JSON format is as follows: { "agent_name": "AFA_Agent", "request_id": "{{request_id}}", "target_application": "{{parameters.target_application_identifier}}", "analysis_summary": "Summary of application firewall log analysis...", "detected_attack_events": [ { "timestamp": "YYYY-MM-DDTHH:MM:SSZ", "source_ip": "...", "target_url": "...", "http_method": "POST", "attack_type_detected": "SQL Injection", "rule_id": "WAF_SQLI_RULE_942100", "action_taken": "Block", / / Alert, Pass "payload_snippet": " ' OR '1'='1 ", / / Optional "threat_intel_source_ip": "(Optional source IP information)" } ], "potential_bypass_indicators": [ / / If check_allowed_suspicious is true] / / Describe suspicious events that were allowed to proceed or only triggered an alert. ], "confidence_score": 0.88 } (5) Application Log Analysis Agent (ALA) The core function of this intelligent agent is to analyze access logs, error logs, or transaction logs of specific business applications to detect abnormal user behavior, unauthorized access, abuse of business logic, or indicate errors in application layer attacks.

[0151] Inputs include: business application access logs, error logs; and parameters passed by the deep investigation decision-making agent.

[0152] The output includes: structured JSON containing suspicious activity / errors, potentially risky accounts, and confidence levels.

[0153] Dependency: The Log Query API is used to query business application access logs, error logs, etc.

[0154] The prompt word template used in this method is: As an application log analysis expert, you will analyze specific business application logs related to the event [{{request_id}}].

[0155] Initial alarm information: {{initial_alert_context}} Analysis parameters: - Target application name / service: {{parameters.target_application_name}} - The user ID you want to follow (optional): {{parameters.target_user_id}} - Analysis time window: Past {{parameters.time_window_hours_ala | default(12)}} hours - Key event / error types to focus on: {{parameters.event_focus_ala}} (e.g., ["multiple_failed_logins","admin_function_access_by_non_admin", "excessive_api_errors_4xx_5xx","unusual_data_query_volume","transaction_anomaly"]) Asset Information Summary (Application): {{asset_summary}} (Includes application type, such as CRM, ERP, Billing) Your task is: 1. Use the [Log Query API] tool to retrieve relevant logs for the "target application name / service" within a specified time window. If a "following user ID" is provided, prioritize filtering the activity of that user.

[0156] 2. Analyze the logs to find patterns matching the "key events / error types" and other unusual behaviors: a. Abnormal login behavior: brute-force attacks, logins from different locations, signs of account theft.

[0157] b. Abuse of privileges: Ordinary users attempt to access administrator functions or access unauthorized data.

[0158] c. Abuse of business logic: Abnormal transaction frequency / amount, exploiting application process vulnerabilities.

[0159] d. Numerous application-layer errors (such as HTTP 500, 403, 401), especially when associated with a specific user or IP address.

[0160] e. Deviation of user behavior from a known baseline (if inferable).

[0161] 3. Summarize the analysis results and list suspicious activities, potential account risks, application errors, or abuses.

[0162] 4. Provide the confidence level of the analysis (0.0-1.0).

[0163] The output JSON format is as follows: { "agent_name": "ALA_Agent", "request_id": "{{request_id}}", "target_application": "{{parameters.target_application_name}}", "analysis_summary": "Application log analysis summary...", "suspicious_activities_or_errors": [ { "timestamp": "YYYY-MM-DDTHH:MM:SSZ", "user_id": "(if applicable)", "source_ip": "...", "activity_description": "User 'john.doe' failed to access the / admin / settings interface (403 Forbidden)." "event_type": "unauthorized_access_attempt", "log_evidence": ["Relevant log snippets"] }, { "timestamp_start": "YYYY-MM-DDTHH:MM:SSZ", "timestamp_end": "YYYY-MM-DDTHH:MM:SSZ", "error_type": "API_Endpoint_Timeout", "affected_endpoint": " / api / v1 / processData", "occurrence_count": 150, "related_ips": ["...", "..."], "reason_for_suspicion": "An unusually high timeout error rate may indicate a denial-of-service or backend issue." } ], "potential_compromised_accounts": ["user_x"], "confidence_score": 0.7 } Step 5: The integrated risk decision assessment agent (hereinafter referred to as the "integrated agent") receives the output results from each sub-expert agent and the risk intelligence platform. This information is uniformly packaged and input into the locally deployed LLM as a key component of complex prompt words. After confidence calculation, the agent relies on the large model to make joint decisions and generate a cybersecurity situation assessment report after in-depth investigation. The report is output in a structured form.

[0164] This step aims to achieve intelligent fusion and evaluation of multi-source analysis results through a comprehensive risk decision-making and assessment agent, generating a comprehensive and reliable situation assessment report. The core operation of the comprehensive agent relies on LLM combined with complex cue words for driving, but in its evaluation phase, it will fully consider and integrate the confidence levels in the structured data output by each sub-expert agent, performing weighted calculations and logical judgments, rather than simply inputting raw data directly into the LLM for black-box output.

[0165] The integrated intelligent agent receives outputs from various sub-expert agents (such as Host Behavior Analysis Agent HSP, Antivirus Analysis Agent AVP, Raw Traffic Analysis Agent RTA, Application Firewall Analysis Agent AFA, and Application Log Analysis Agent ALA) and external risk intelligence platforms via a predefined data interface in a unified JSON data format. Simultaneously, it also receives intermediate decision results returned by the deep investigation decision agent based on local large-scale model analysis (e.g., which sub-agents were invoked and the reasons). All input data is integrated into a local cache or time-series database to ensure data consistency, integrity, and traceability.

[0166] The next step involves multi-source information fusion and confidence calculation, which is the core of the integrated agent. Guided by complex prompts, the LLM performs semantic understanding, correlation analysis, and conflict resolution on the collected multi-source data. Crucially, the integrated agent does not directly generate evaluation results from the LLM; instead, it first extracts the independent confidence scores from the structured data output by each sub-agent. For a specific security event or threat indicator, multiple sub-agents may jointly report it or provide evidence from different dimensions. The integrated agent will employ a weighted confidence fusion algorithm. Assume that for a specific alert or entity (such as a suspicious IP), N sub-agents provide analysis results, and each sub-agent i gives a confidence score of C. i Its corresponding weight is W i (This weight can be dynamically adjusted based on the reliability of the sub-agent, the accuracy of the data source, and the context of the current analysis scenario.) Then, the overall confidence level C of the event or metric is... integrated The calculation method is as follows:

[0167] LLM will use these calculated composite confidence levels, combined with compliance requirements, asset importance information, and the potential impact of events obtained from the management knowledge base, to conduct a deeper risk assessment.

[0168] Simultaneously, guided by complex prompts, LLM will attempt to connect temporally and logically related security events and alerts from different sub-agents, possessing high overall confidence levels, to reconstruct and analyze potential attack chains. This includes identifying each stage of an attack (such as initial reconnaissance, weapon delivery, vulnerability exploitation, privilege escalation, lateral movement, data breaches, command and control, etc.), and labeling the key activities, assets involved, tools or technologies used, and corresponding evidence and confidence levels for each stage. LLM will leverage its knowledge and reasoning capabilities to fill in any analytical gaps and infer attack paths, reconstructing the attack chain as comprehensively as possible.

[0169] Finally, based on the information fusion, confidence calculation, and attack chain analysis results, LLM, guided by complex prompts, conducts a final joint decision and risk assessment. This includes determining the root cause of the security incident, assessing its actual impact on business and potential risks, and predicting possible subsequent actions by attackers.

[0170] Finally, the integrated intelligent agent will generate a structured cybersecurity situation assessment report. This report includes the following core components: (1) Security incident summary: an overview of the type of security incident detected, the scope of impact, the overall confidence level assessment and the overall severity.

[0171] (2) Attack chain analysis: Describe the reconstructed attack chain in detail, including each stage of the attack, key nodes, technologies used, assets involved, and the confidence level of each stage.

[0172] (3) Detailed analysis and evidence: Integrate the main findings and key evidence (such as suspicious connections, IOCs, host abnormal behavior logs, virus detection results, etc.) of each sub-expert agent and their original confidence levels.

[0173] (4) Risk assessment: Display the comprehensive risk score and risk level (combining asset value, threat severity and overall confidence level), and list the key risk factors.

[0174] (5) Impact analysis: Assess the potential impact of security incidents on business continuity, data security and compliance.

[0175] (6) Handling recommendations: Provide handling recommendations based on current security policies, best practices and attack chain analysis results, including short-term mitigation measures (such as isolating infected hosts and blocking malicious connections) and long-term hardening solutions (such as vulnerability patching, policy adjustment and security awareness training).

[0176] (7) Compliance analysis: Assess the compliance requirements and potential risks of violation related to the incident, referring to the management regulations knowledge base.

[0177] Key words for integrated intelligent agents: 1. Core Task You are a high-level cybersecurity analysis and report generation agent. Your task is to receive structured data from multiple sub-expert agents, external risk intelligence platforms, and deep investigation decision-making agents, perform comprehensive information fusion, attack chain analysis, risk assessment, and generate a structured cybersecurity posture assessment report. Please strictly adhere to the following processing logic and report structure.

[0178] 2. Input data (provided in JSON format) `{{sub_agent_outputs}}`: An array containing multiple JSON objects, each representing the analysis results of a sub-expert agent (such as HSP, AVP, RTA, AFA, ALA).

[0179] Examples of key fields: `agent_name`, `request_id`, `analysis_scope`, `analysis_summary`, `suspicious_connections`, `identified_iocs` (ips, domains, urls), `confidence_score` (the sub-agent's confidence in its output), `asset_details` (the type, business affiliation, importance level, etc. of the affected assets, from the asset query API in step 2).

[0180] `{{external_risk_intelligence}}`: JSON data from an external threat intelligence platform, which may contain information such as the reputation of the IOC, related threat activities, and attacker organizations.

[0181] `{{deep_investigation_decision_output}}`: JSON output from the deep investigation decision agent (step 3), containing its decision logic, focus, and why a specific sub-agent was invoked.

[0182] `{{management_rules_and_compliance_kb_summary}}`: A summary of management rules, compliance requirements, and disposal recommendations related to the current event and asset (from the knowledge base query in step 2).

[0183] `{{calculated_event_confidences}}`: A JSON object containing weighted integrated confidence scores calculated for the initially associated key events or Indices of Conformity (IOCs) (based on the formula $C_{integrated}= \frac{\sum W_i\times C_i}{\sum W_i}$). You will need to use these pre-calculated confidence scores.

[0184] 3. Processing Instructions and Analysis Logic 3.1 Data Fusion and Contextual Understanding Carefully review all input data.

[0185] Information from different sub-agents and intelligence sources is correlated based on timestamps, common IOCs (IP addresses, domain names, file hashes, user accounts, etc.) and affected asset IDs.

[0186] Refer to `{{deep_investigation_decision_output}}` to understand the background and focus of the preliminary investigation.

[0187] Pay special attention to the high-confidence events in `{{calculated_event_confidences}}`, as these are the focus of the analysis.

[0188] 3.2 Attack Chain Reconstruction Objective: To reconstruct the most likely attack chain based on related events and alerts, in chronological order and logical relationships.

[0189] method: 1. Identify the initial entry point of the attack (e.g., network connection from RTA, malware detection from AVP).

[0190] 2. Track attackers’ activities within the network, such as: lateral movement (HSP host behavior), privilege escalation, C2 communication (RTA traffic analysis), and data access / leakage (ALA application logs, AFA WAF logs).

[0191] 3. Label each stage of the attack chain (e.g., reconnaissance, implantation, C2 communication, lateral movement, objective achievement): The TTPs involved (tactics, techniques and processes, which, if possible, can be mapped to the MITRE ATT&CK framework).

[0192] Key pieces of evidence (e.g., specific log entry summaries, traffic patterns, malware names).

[0193] This involves source / target IPs, hostnames, domain names, URLs, file hashes, and other IOCs.

[0194] The overall confidence level of this stage or key behavior (refer to `{{calculated_event_confidences}}` or make reasonable inferences based on the strength of the evidence).

[0195] 4. If there are multiple possible attack paths, please list them all and assess their probability.

[0196] Output: A clear and complete narrative of the attack.

[0197] 3.3 Comprehensive Risk Assessment For identified complete attack chains or individual high-risk security incidents: 1. Severity: Assess the destructive potential of the attack itself (e.g., ransomware encryption, data theft, service disruption).

[0198] 2. Impact Scope: Assess the number and importance of the affected assets (refer to the business attribution and importance level in `asset_details`).

[0199] 3. Business Impact: Based on asset information and attack behavior, assess the potential or actual impact on core business, data security, financial losses, reputation, etc.

[0200] 4. Overall Risk Level: Based on the severity, scope of impact, business impact, and overall confidence level of the event / attack chain (calculated event confidences), assign an overall risk level (e.g., Critical, High, Medium, Low, Informational). Please explain the rationale behind the rating.

[0201] 3.4 Compliance Analysis Refer to `{{management_rules_and_compliance_kb_summary}}` (or use tools to query the knowledge base) to assess whether past security incidents violated relevant management regulations or compliance requirements. Clearly identify any potentially non-compliant clauses.

[0202] 3.5 Recommendations for Handling the Issue Based on risk assessment and attack chain analysis, specific and actionable recommendations are provided: 1. Short-term mitigation measures: Take immediate action to stop the attack and limit its impact (e.g., isolate infected hosts, block malicious IPs / domains, disable suspicious accounts, and patch known exploited vulnerabilities).

[0203] 2. Long-term hardening solutions: Measures to prevent similar incidents in the future (e.g., updating security policies, strengthening security monitoring in specific areas, deploying new security technologies, conducting security awareness training, and improving incident response procedures).

[0204] 4. Output Report Structure According to the appendix Figure 1 As shown, the network security incident analysis system based on multi-agent decision-making, which applies the above method, mainly includes: Alarm data processing module: Configured to periodically acquire raw alarm data from various monitoring and alarm platforms, perform noise reduction on raw alarms through data cleaning, key field filtering, data transformation and alarm merging, and establish a unified data acquisition interface to realize centralized collection and standardization of multi-source heterogeneous alarm data.

[0205] Deep Investigation Decision-Making Agent: This agent combines the victim IP's asset information (queried via a self-deployed API) and management-defined knowledge base information (queried via vector matching). It is configured to perform deep analysis and intelligent decision-making on the integrated data. Through reinforcement learning, it dynamically optimizes its decision-making strategy to balance investigation benefits and costs, and outputs structured JSON decision results. These results determine the subsequent calls to sub-agents and external risk intelligence platforms in a probabilistic weighted manner.

[0206] Sub-expert analysis module: includes multiple sub-expert agents driven by LLM, prompt words, and tool calls (such as raw traffic analysis agent, host behavior analysis agent, etc.); executes specific analysis tasks in parallel based on the output and parameters passed by the deep investigation decision agent, and outputs structured JSON analysis results.

[0207] The integrated risk decision assessment agent is configured to receive the output results from each sub-expert agent and the risk intelligence platform, encapsulate the information as complex prompt words and input them into the locally deployed LLM, perform joint decision-making after confidence calculation, and finally generate a structured network security situation assessment report.

[0208] Application Examples Appendix Figure 4 This document presents a block diagram illustrating an example of an in-depth investigation event triggered by an alert from a security monitoring platform, which involves analyzing host behavior and traffic. After receiving an anomaly alarm from a monitoring platform, the system conducts an in-depth investigation by a deep decision-making agent. When the calculated probability of in-depth investigation exceeds a threshold, an in-depth investigation is triggered. The system calls upon and integrates the outputs of the host behavior analysis agent (which detects abnormal processes) and the original traffic analysis agent (which confirms traffic characteristics). Simultaneously, it combines the latest vulnerability exploitation intelligence provided by the risk intelligence platform. Through joint decision-making, the comprehensive agent determines the security level of the event and generates a structured report containing event details, investigation process, and emergency isolation recommendations.

[0209] The above technical solutions are merely exemplary embodiments of the present invention. For those skilled in the art, based on the application methods and principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the methods described in the specific embodiments of the present invention. Therefore, the methods described above are merely preferred and not restrictive.

Claims

1. A network security event analysis method based on multi-agent decision, characterized in that, The method comprises the following steps: S1, obtaining original alarm data of each monitoring alarm platform, and performing noise reduction processing on the original alarm; S2, obtaining asset information of the victim IP in the alarm, and compliance requirements and disposal suggestions related to the alarm type and asset attributes; S3, using a deep investigation decision-making agent to perform deep analysis and intelligent decision-making on the obtained data, to determine whether to start a deep investigation, and which sub-agent or risk intelligence platform to start to complete the deep investigation; S4, according to the decision output and the parameters transmitted by the deep investigation decision-making agent, driving the corresponding sub-agent and / or risk intelligence platform to execute their respective network analysis tasks in parallel, and outputting a structured analysis result; S5, receiving the analysis result output by each sub-agent and risk intelligence platform by the comprehensive risk decision evaluation agent, as the prompt word of the locally deployed LLM large language model, and extracting the confidence information therefrom, and after confidence weighting calculation, performing joint analysis and decision-making based on the high-confidence alarm by the LLM model, and outputting a network security situation evaluation report after the deep investigation.

2. The method of claim 1, wherein, The step S1 specifically comprises: establishing a unified data acquisition interface to centrally collect and standardize processing of multi-source heterogeneous alarm data; performing noise reduction processing on the original alarm through data cleaning, key field screening, data transformation and alarm merging.

3. The method of claim 1, wherein, The step S2 specifically comprises: obtaining detailed asset information of the victim IP in the alarm data from the asset management system through a pre-packaged asset query API interface, including one or more of device type, business ownership, business type and network policy; obtaining compliance requirements and disposal suggestions related to the alarm type and asset attributes by querying a management regulation knowledge base through a vector matching algorithm.

4. The method of claim 1, wherein, The step S3 specifically comprises: S31, constructing the deep investigation decision-making agent: The core of the deep investigation decision-making agent is a policy network π based on reinforcement learning. θ ( A t | S t The network is based on the current state vector. S t Output a complex action A t ;in: S t The data obtained from step S1 and step S2 are converted into a fixed-length vector representation, and then the text type information is processed by an embedding layer to finally splice a high-dimensional state vector. A t A structured data containing risk metrics and probabilities of invocation of each sub-agent / information platform: ， Specifically comprising: (1) risk measurement indicators The deep investigation decision-making agent policy network first outputs a set of intermediate risk measurement indicators, which are the comprehensive evaluation results of the current alarm and asset state, including: alert apparent severity score Score sev representing the potential harm indicated by the alert itself, ; Asset importance score Score asset : represents a criticality of the affected asset, ； Compliance urgency score Score comp : represents the degree of urgency of the event touching a compliance red line, ； Wherein, f(·) is the corresponding part of the neural network, and θ is the parameter thereof; (2) sub-agent calling decision and parameters For each pre-defined sub-agent j and external intelligence platform k, the deep investigation decision-making agent policy network outputs two types of parameters: Call probability P call_sub_j and P call_intel_k : represents the expected benefit or necessity of calling the sub-agent and intelligence platform, where P call_sub_j represents the probability of calling the jth sub-agent, P call_intel_k represents the probability of calling the kth external intelligence platform; Dynamic parameter configuration Params sub_j and Params intel_k preset parameters for configuring different sub-agent intelligence, which are used to set the specific working mode of the sub-agent and the intelligence platform; S32, based on the risk measurement indicators output by the deep investigation decision-making agent, the final deep investigation starting probability is calculated according to the following formula: ， wherein, w sev , w aseet, w comp are weight coefficients of each risk metric indicator, which are obtained according to a security policy preset; b is a bias term; and the sigmoid function maps the weighted sum of the risk metric indicators to a probability interval of [0, 1]. S33, when P deep_investigation Set the investigation threshold, then decide to conduct in-depth investigation; According to A t Call probability P call_sub_j Or P call_intel_k Sub-agents or intelligence platforms greater than the set investigation threshold are included in the deep investigation.

5. The method of claim 4, wherein, The reinforcement learning training method of the deep investigation decision-making agent comprises: (1) Policy network π θ Training reward function setup: Reward function R t For quantifying the decision made by the deep investigation decision-making agent A t The good or bad degree is calculated after the comprehensive evaluation at the end of each time step t, that is, after completing a decision. ， wherein, W benefit and W cost is a weight hyperparameter for balancing benefit and cost. Benefit t To investigate the benefits of the comprehensive investigation, according to the follow-up steps in the comprehensive risk decision assessment report and artificial verification results: ， wherein, w tp , w fp , w fn , w crit is the weight of each benefit indicator; TruePos t Reward for true alarm discovery; FalsePos t Punishment for false positives investigation; FalseNeg t FalseNeg t FalseNeg t FalseNeg t CriAli t a critical alignment reward, representing a risk measure indicator output by the deep investigation decision agent Score sev , Score asset , Score comp the degree of match with the event composite risk level assessed at step S5 Cost t To investigate and analyze the cost, determined by statistical data: ， wherein, w num_agents ，w time are the weights of the respective cost indicators; NumCalledSubAgents t NumCalledSubAgents is the number of called sub-agent, i.e. the number of actually called sub-agent and intelligence platform; TotalAnalysisTime t TotalAnalysisTime is the total time consumed by all called sub-agents and intelligence platforms to complete the analysis. (2) loss function setting: Adopting PPO proximal policy optimization to train the policy network π of a deep investigation decision-making agent θ ( A t ∣ S t ) and an auxiliary value network V ϕ ( S t ), wherein the value network is used to evaluate the value of the state to reduce the variance of the policy gradient, and the policy network π θ ( A t ∣ S t ) parameters θ are optimized by maximizing the clipping surrogate objective function of PPO L CLIP (θ) Optimization is achieved by gradient ascent, ， wherein, denotes the expectation over a batch of experience samples; r t (θ) the current policy π θ and the old policy θ old the probability ratio of outputting the same action, ， For the advantage function estimate at time step t, it measures how good the state S t Take an action A t The GAE generalized advantage estimate is used to compute how good or bad an action was relative to the average action. ， where K is the number of GAE steps; γ ∈ [0, 1] is a discount factor for future rewards; λ ∈ [0, 1] is a trace decay parameter in GAE; δ t+l is the TD error, ； Value network V ϕ ( S t ) The parameter f is optimized using a mean squared error approach by minimizing the value loss function L VF ( f ), ， Finally, the total loss function is: ， wherein, H (⋅) is the entropy of the policy distribution, used for the entropy reward to encourage exploration; c 1 is a coefficient for the value loss; c 2 is a coefficient for the entropy reward; (3) specific training and feedback iteration process of the deep investigation decision-making agent: θ and value network V ϕ assign initial parameters θ to θ' and ϕ to ϕ'​ ii. Data collection: the decision-making agent interacts with the environment according to the current policy, i.e., p θ′ , collecting experience sequences (s S t , A t , R t , S t+1 ); iii. Advantage computation: Using the collected rewards and the value network's predictions, i.e., the parameters for V ϕ′ , compute the advantage A and the value target (V R t + γV ϕ′ ( S t+1 )) for each time step; (iv) parameter update: using the collected data, update the policy network parameters θ' to θ and the value network parameters φ' to φ by optimizing the above L total (θ, ϕ) to (θ', ϕ'). ⑤ iteration: repeat steps ②-④ until the performance of the deep investigation decision-making agent converges or reaches the preset training budget.

6. The method of claim 1, wherein, The sub-expert intelligent agent in the step S3 includes one or more of a host behavior analysis intelligent agent, an antivirus analysis intelligent agent, an original traffic analysis intelligent agent, an application firewall analysis intelligent agent, and an application log analysis intelligent agent; Each sub-expert intelligent agent is driven by LLM+prompt+tool invocation, wherein the LLM is responsible for understanding the task in the prompt, invoking the tool, parsing the data obtained from the tool, executing the analysis logic, and finally generating a structured JSON output for subsequent step analysis.

7. The method of claim 1, wherein, The step S5 specifically includes: The comprehensive intelligent agent receives the output results from each sub-expert intelligent agent and an external risk intelligence platform, encapsulates the complex prompt of the locally deployed LLM large language model, and extracts the independent confidence score in the structured data output by each sub-intelligent agent for weighted calculation. Data fusion: LLM uses the calculated comprehensive confidence to combine the compliance requirements obtained from the management regulation knowledge base, asset importance information, and the potential impact of the event, and under the guidance of the complex prompt, it associates the security events and alerts from different sub-agents, the comprehensive confidence exceeding the set threshold, and the time and logically related security events and alerts. Assume that for a particular alarm or entity, there are N sub-agents providing analysis results, each sub-agent i gives a confidence level of C i and the corresponding weight is W i then the comprehensive confidence level of the event or index is C integrated The calculation method is: ， Attack chain analysis: based on the associated events and alerts, the most possible attack chain is reconstructed in chronological order and logical relationship. Finally, based on the above confidence calculation, information fusion, and attack chain analysis results, the LLM makes a final joint decision and risk judgment under the guidance of the complex prompt, including one or more of comprehensive risk level assessment, assessment of the actual impact and potential risks on the business, and prediction of the subsequent actions of the attacker. The network security posture assessment report includes one or more of the following parts:

8. The method of claim 1, wherein, Security event summary, attack chain analysis, detailed analysis and evidence, risk assessment, impact analysis, disposal suggestion, compliance analysis. It includes:

9. A multi-agent decision based cyber-security event analysis system applying the method of any one of claims 1-8, characterized in that, Alarm data processing module: configured to regularly obtain original alarm data of each monitoring alarm platform, perform noise reduction processing on the original alarm, and establish a unified data acquisition interface to realize centralized collection and standardization of multi-source heterogeneous alarm data; Deep investigation decision intelligent agent: combined with the asset information of the victim IP and the management regulation knowledge base information, the integrated data is analyzed and intelligently decided, and a structured JSON decision result is output, which determines the subsequent calling of sub-intelligent agents and external risk intelligence platforms in a probabilistic weighted manner; Sub-expert analysis module: including a plurality of sub-expert intelligent agents driven by LLM, prompt, and tool invocation; according to the output of the deep investigation decision intelligent agent and the transmitted parameters, the corresponding analysis tasks are executed in parallel, and a structured JSON analysis result is output; Comprehensive risk decision evaluation intelligent agent: used to receive the analysis results output by each sub-expert intelligent agent and risk intelligence platform as the prompt of the locally deployed LLM large language model, and extract the confidence information therefrom, after confidence weighted calculation, the LLM large model makes a joint analysis decision based on the high-confidence alarm, and outputs the network security posture assessment report after deep investigation. ​ 10. A storage medium having stored thereon a computer program, characterized in that The computer program, when installed into a computer system or executed by a processor, can implement the method according to any one of claims 1-8.

Images