Network security automatic analysis response method based on intelligent agent

Abstract

The invention relates to the technical field of network security, and discloses an agent-based network security automatic analysis response method, which comprises the following steps of: deploying a network agent of a target area network, collecting multi-source log data of a mail server covered by the network agent, a terminal EDR system and a DNS log server, extracting a key behavior segment to construct an event sequence, checking a corresponding multi-scene log stream to judge a security threat level, calculating a risk influence value of an attack event according to the security threat level, evaluating a disposal priority, and generating a response instruction set in combination with a current network operation state; according to the method, network agent function units are cooperatively scheduled to obtain unit cooperation pairs, communication association data are determined, a data interaction index is calculated, a complete attack chain is generated based on the data interaction index, response processing logic is extracted, and finally a security protection strategy of a target area network is formulated. According to the invention, the multi-scene cooperation capability and the response accuracy under the network security can be improved.

Description

Technical Field

[0001] This invention relates to an agent-based automated analysis and response method for network security, belonging to the field of network security technology. Background Technology

[0002] Automated network security analysis and response is a core technology for protecting digital systems from cyberattacks. It needs to cover multiple network scenarios such as email, terminals, and DNS. By capturing attack behavior, assessing risks, and responding to incidents, it can build a closed loop of network security protection and provide support for the stable operation of enterprise and target area networks.

[0003] Currently, automated network security analysis often employs decentralized detection tools (such as independent email anomaly detection systems and endpoint log analysis tools), requiring manual aggregation of logs from different scenarios to correlate attack clues. Attack phase identification relies solely on matching single behavioral features, making it difficult to accurately classify the attack's current stage. Response strategies are often based on preset fixed rules (such as blocking a single IP address), and protection policies cannot be adjusted according to the real-time network status. This results in weak cross-scenario log linkage, ambiguous attack phase determination, delayed response, and poor protection adaptability, easily leading to incomplete attack chain tracing and risk spread. It is difficult to meet the dynamic protection needs of the target area's network. Therefore, an efficient automated network security analysis and response method is needed to improve multi-scenario collaborative capabilities and response accuracy in network security. Summary of the Invention

[0004] This invention provides an agent-based automated analysis and response method for network security, the main purpose of which is to improve the multi-scenario collaborative capability and response accuracy in network security.

[0005] To achieve the above objectives, the present invention provides an agent-based automated network security analysis and response method, comprising: Deploy network agents in the target area network, and collect multi-source log data from mail servers, terminal EDR systems and DNS log servers covered by the network agents. Extract key behavior segments from the multi-source log data, and construct the event sequence corresponding to the network agents based on the key behavior segments. Based on the event sequence, identify the attack stage corresponding to the attack event in the target area network, query the multi-scenario log stream corresponding to the attack stage, and determine the security threat level corresponding to the attack event based on the multi-scenario log stream. Based on the security threat level, calculate the risk impact value corresponding to the attack event, assess the handling priority corresponding to the risk impact value, and generate a response instruction set corresponding to the attack event based on the handling priority and the current network operating status. Based on the response instruction set, the functional units in the network agent are coordinated and scheduled to obtain unit cooperation pairs. Based on the unit cooperation pairs, the communication association data corresponding to the functional units is determined, and the data interaction index corresponding to the communication association data is calculated. Based on the data interaction index, a complete attack chain corresponding to the attack event is generated, the response and handling logic corresponding to the complete attack chain is extracted, and a security protection strategy corresponding to the target area network is formulated based on the response and handling logic.

[0006] Optionally, constructing the event sequence corresponding to the network agent based on the key behavior segments includes: Extract behavioral data from the key behavioral segments; Generate a timestamp sequence corresponding to the behavioral data; Divide the timestamp sequence into time periods; Identify key time points within the stated time period; Based on the key time points, an event sequence corresponding to the network agent is constructed.

[0007] Optionally, constructing the event sequence corresponding to the network agent based on the key time points includes: Obtain the time log identifier corresponding to the key time point; Associate the data asset number to which the time log identifier belongs; Integrate the log entries corresponding to the data asset numbers; Sort the log entries according to the order of the events they correspond to; Based on the order of the events in the entries, an event sequence corresponding to the network agent is generated.

[0008] Optionally, the step of coordinating the functional units in the network agent based on the response instruction set to obtain unit cooperation pairs includes: Parse the control instruction items contained in the response instruction set; Match the scheduling unit corresponding to the control instruction item; Verify the unit connection status between functional units in the unit to be scheduled; Based on the unit connection status, a collaborative relationship table corresponding to the functional units in the network agent is generated. Based on the aforementioned collaborative relationship table, the functional units in the network agent are collaboratively scheduled to obtain unit collaborative pairs.

[0009] Optionally, the step of generating a collaborative relationship table corresponding to the functional units in the network agent based on the unit connection state includes: Based on the unit connection status, determine the unit connection channels between the functional units; Analyze the coordination requirements corresponding to the unit connection channels; Query collaborative interaction paths that meet the aforementioned collaborative requirements; Verify the collaborative transmission index corresponding to the collaborative interaction path; Based on the cooperative transmission index, a cooperative relationship table corresponding to the functional units in the network agent is generated.

[0010] Optionally, calculating the risk impact value corresponding to the attack event based on the security threat level includes: Analyze the impact values ​​of the elements covered by each level in the security threat level classification; Query the network smart terminals associated with the influence values ​​of the aforementioned elements; Identify the risk diffusion index corresponding to the attack event; Based on the risk diffusion index, identify the risk-affected terminals among the network smart terminals; The risk impact value corresponding to the risk-affected terminal is calculated using the following formula:

[0011] in, This indicates the risk impact value corresponding to the terminal affected by the risk. Indicates the level of security threat. Indicates the duration of the phase. and These represent the start and end times of the attack phase, respectively. This indicates the total number of terminals affected by the risk. This indicates the quantity index corresponding to the terminal affected by the risk. Indicates time Time flow to the first One risk affects the terminal's data rate. Indicates the reference flow rate.

[0012] Optionally, determining the communication association data corresponding to the functional unit based on the unit cooperation pair, and calculating the data interaction index corresponding to the communication association data, includes: Identify the communication connection protocol between the unit cooperative pairs; Based on the communication connection protocol, the communication events in the functional unit are determined; Collect the real-time communication stream from the communication events; Analyze the communication interaction volume in the real-time communication stream; Based on the communication interaction volume, determine the communication association data corresponding to the functional unit; The data interaction index corresponding to the communication-related data is calculated using the following formula:

[0013] in, This represents the data interaction index corresponding to the communication-related data. This indicates the total number of the communication events. This indicates the quantity index corresponding to the communication event. Indicates the first The event risk weight corresponding to each communication event. Indicates the first The amount of communication data corresponding to each communication event This indicates the acquisition time of the real-time communication stream. This indicates the number of network hops corresponding to the communication event.

[0014] Optionally, identifying the attack stage corresponding to the attack event in the target area network based on the event sequence includes: Analyze the time windows corresponding to the events in the event sequence; Match the behavior sequence between the time window and historical attack behaviors; Based on the behavioral sequence, the current attack behavior in the target area network is determined; Based on the current attack behavior, the attack steps corresponding to the attack events in the target area network are divided; Identify the attack stage corresponding to the attack steps.

[0015] Optionally, determining the security threat level corresponding to the attack event based on the multi-scenario log stream includes: Extract abnormal log features from the multi-scenario log stream; Based on the abnormal log characteristics, calculate the event threat value corresponding to the attack event; Based on the event threat value, assess the scope of impact corresponding to the target area network; Determine the threat level range corresponding to the affected area; Based on the threat level range, the security threat level corresponding to the attack event is determined.

[0016] Optionally, generating the complete attack chain corresponding to the attack event based on the data interaction index includes: Based on the data interaction index, filter out abnormal connection pairs in the communication-related data; Based on the abnormal connection pairs, reconstruct the event behavior sequence between the attack events; Identify behavioral logic gaps in the event behavior sequence; Based on the aforementioned behavioral logic gaps, formulate attack protection measures corresponding to the attack events; Based on the attack protection measures, a complete attack chain corresponding to the attack event is generated.

[0017] Compared to the problems described in the background technology, this invention, by deploying network agents in the target area network and collecting multi-source log data from mail servers, terminal EDR systems, and DNS log servers covered by the network agents, effectively breaks through the fragmented limitations of single-scenario detection in existing technologies. It achieves centralized integration of multi-dimensional security log data and allows the agents to comprehensively grasp the security status information of the target area network, providing core data support for subsequent phased automated handling, attack tracing, and evidence preservation. This enhances the systematic and intelligent starting point of network security defense from a data perspective. Based on the event sequence, this invention identifies the attack stages corresponding to attack events in the target area network, effectively integrating coherent abnormal behavior trajectories across multiple scenarios. This breaks through the limitations of fragmented single-scenario detection in existing technologies, allowing the determination of attack stages to no longer be limited to isolated behaviors, improving the completeness and accuracy of identification. Furthermore, based on the security threat level, this invention calculates the risk impact value corresponding to the attack event, transforming qualitative threat levels into quantitative risk data, making the risk perception of attack events more accurate and objective. This invention provides core data support for subsequent priority assessment and data reference for optimizing security protection strategies for target area networks, helping to focus on high-risk links and strengthen defense. Furthermore, based on the response instruction set, this invention coordinates and schedules functional units in the network intelligent agent to obtain unit cooperation pairs. This breaks the limitation of isolated operation of each functional unit, allowing units such as log collection, attack handling, and evidence retention to cooperate precisely according to instruction requirements. It clarifies the responsibilities and cooperation processes of each unit, prevents operational conflicts between different units due to target deviations, avoids handling gaps caused by insufficient capabilities of a single unit, and improves the overall responsiveness of attack events. Finally, based on the data interaction index, this invention generates a complete attack chain corresponding to the attack event. It can rely on high-quality unit communication association data to ensure that there is no missing or biased information in each link of the attack chain (such as initial delivery, malicious execution, and data transmission), avoiding attack chain breaks caused by data interaction problems. It also provides a solid basis for subsequent attack tracing, attack pattern summarization, and defense strategy optimization, helping to strengthen weak links in the network and improve overall anti-attack capabilities. Therefore, the agent-based automated network security analysis and response method provided in this embodiment of the invention can improve the multi-scenario collaborative capability and response accuracy under network security. Attached Figure Description

[0018] Figure 1This is a flowchart illustrating an automated network security analysis and response method based on intelligent agents, provided as an embodiment of the present invention. Figure 2 This is a diagram illustrating the overall architecture of an agent-based automated analysis and response method for network security, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of attack chain detection in an agent-based automated network security analysis and response method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a module for implementing an agent-based automated network security analysis and response system, as provided in an embodiment of the present invention.

[0019] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0021] This application provides an agent-based automated network security analysis and response method. The executing entity of this agent-based automated network security analysis and response method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the agent-based automated network security analysis and response method can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0022] Reference Figure 1 The diagram shown is a flowchart illustrating an agent-based automated network security analysis and response method according to an embodiment of the present invention. In this embodiment, the agent-based automated network security analysis and response method includes: S1. Deploy network agents in the target area network, and collect multi-source log data from the mail server, terminal EDR system and DNS log server covered by the network agents. Extract key behavior segments from the multi-source log data, and construct the event sequence corresponding to the network agents based on the key behavior segments.

[0023] This invention, by deploying network agents in the target area network and collecting multi-source log data from mail servers, terminal EDR systems, and DNS log servers covered by the network agents, can effectively break through the fragmented limitations of single-scenario detection in existing technologies, achieve centralized integration of multi-dimensional security log data, and enable the agents to fully grasp the security status information of the target area network. This provides core data support for subsequent phased automated handling, attack tracing, and evidence preservation, thereby improving the systematic and intelligent starting point of network security defense from a data perspective.

[0024] The target area network refers to the specific network range where the network agent is deployed and requires security protection. This is typically a corporate intranet, covering devices such as mail servers, terminal EDR systems, and DNS log servers that the agent needs to connect to. It is the core area for the agent to conduct log collection, attack detection, and response. For example, a corporate headquarters intranet might cover 10 mail servers, 500 terminals (including EDR systems), and 3 DNS log servers. The agent is deployed within this intranet to monitor and handle network security incidents throughout the entire process. The network agent refers to the core carrier integrating four functional modules: log collection, attack identification, link matching, and emergency response. It connects to mail servers, terminal EDR systems, and DNS log servers through a unified interface, enabling multi-source... Intelligent components for centralized log processing, multi-scenario attack detection, and phased automated handling. For example, a network agent includes a log collection module (real-time acquisition of email logs) and an attack identification module (using deep learning models to detect phishing emails). It connects to an enterprise email server (IP: 192.168.1.10) and can identify phishing emails, isolate them, and preserve evidence. The email server refers to a device used for storing and sending / receiving emails, generating logs containing sender information, email body, attachment characteristics, and sending time. It is the core source of email scenario logs collected by the agent, providing data support for phishing email detection. For example, an enterprise might deploy an Exchange email server (IP: 192.168.2.20), from which the agent collects data for 2025-04-10. The log at 08:30 includes the sender's IP (5.44.57.89) and attachment hash (85e015e6f76...), used to identify phishing emails at that time. The aforementioned terminal EDR system refers to a terminal detection and response system deployed on terminal devices (such as computers). It records logs of process operations, command execution, and system calls, and can identify abnormal terminal behavior (such as commands to establish a hidden tunnel). It is a key source for intelligent agents to collect terminal scenario logs. For example, an enterprise might have an EDR system (version V4.0) installed on 500 terminals (such as PC-001, IP: 192.168.3.50). The intelligent agent collects logs from this system for April 10, 2025. The log at 08:35 contains the process name (unknown.exe) and the executed command (ssh-L8080:192.168.1.60:80200.24.99.12), used to detect malicious operations on the terminal. The DNS log server refers to the device that stores DNS query logs. The logs contain information such as the query domain name, query time, source IP, query frequency, and domain entropy value. It is the core source for the intelligent agent to collect DNS scenario logs and detect hidden DNS tunnels. For example, a DNS log server deployed by a certain enterprise (IP: 192.168.4).30) The agent collects logs from 08:45 on April 10, 2025, including the queried domain name (XXX.xxx.com), query frequency (60 times / minute), and source IP (192.168.3.50), to identify DNS covert tunnel transmission behavior. The multi-source log data refers to the collection of logs collected by the agent from the mail server, terminal EDR system, and DNS log server, covering key information from the three major scenarios of email, terminal, and DNS, providing a data foundation for cross-domain correlation analysis and attack chain reconstruction. For example, the logs collected by the agent from 08:30 to 08:45 on April 10, 2025, include phishing email logs from the mail server (sender IP: 5.44.57.89), malicious process logs from the terminal EDR (process name: unknown.exe), and abnormal query logs from the DNS log server (domain name: XXX.xxx.com), which can support attack chain matching analysis. Optionally, the network agent deployed in the target area network can be implemented through automated deployment tools, such as using Ansible to write play. The book automatically installs and configures the intelligent agent software, thereby obtaining a network intelligent agent; the collection of multi-source log data from the mail servers, terminal EDR systems, and DNS log servers covered by the network intelligent agent can be achieved through a log collection agent, such as using Fluentd to configure an input plugin to collect logs from each server in real time, thereby obtaining multi-source log data.

[0025] Furthermore, by extracting key behavioral segments from the multi-source log data, this invention can effectively filter redundant routine operation logs, focus on core information related to network security, reduce the interference of invalid data on subsequent analysis, improve data processing efficiency, and provide core behavioral basis for attack stage identification and attack chain matching. This lays a solid data foundation for subsequent security threat classification, phased automated handling, and attack evidence preservation, and promotes the precise analysis and upgrading of network security defense.

[0026] The key behavioral segments refer to the core information fragments that reflect potential attack behaviors extracted from multi-source log data collected by the agent from mail servers, terminal EDR systems, and DNS log servers. Meaningless routine operation records need to be excluded to provide key evidence for subsequent attack identification and attack chain matching. For example, extracting information fragments such as "abnormal sender domain name + malicious link attachment" from email logs, "unknown process startup + execution of port forwarding command" from terminal EDR logs, and "domain entropy value > 5 + query frequency > 50 times / minute" from DNS logs. These fragments all point to possible attack behaviors and are the core data for subsequent analysis. Optionally, the extraction of key behavioral segments from the multi-source log data can be achieved through time-series pattern mining algorithms, such as using the Kibana Timelion module in the ELK stack for time-series anomaly detection to obtain key behavioral segments.

[0027] Furthermore, based on the key behavior segments, this invention constructs the event sequence corresponding to the network intelligent agent, which can connect the scattered core security-related information in multiple scenarios according to time and asset identification logic, breaking the fragmentation limitations of single-scenario logs and solving the problem of attack behavior identification in the prior art; it can clearly present the development trajectory of abnormal behavior in the target area network, providing coherent and orderly data support for accurately identifying the attack stage corresponding to the attack event, and avoiding misjudgment of attack stage due to information dispersion.

[0028] The event sequence refers to a coherent abnormal behavior trajectory formed by connecting key behavioral data from various scenarios in chronological order, with key time points as the core. It needs to reflect the temporal correlation of behaviors in multiple scenarios to provide a structured basis for reconstructing the attack chain. For example, based on the above key time points, the event sequence can be constructed as follows: 2025-04-10 08:30 (receive email with malicious attachment, sender IP: 5.44.57.89) → 08:35 (execute unknown.exe process, issue tunnel command) → 08:45 (initiate abnormal query, frequency 60 times / minute), which fully presents the attack-related behavior process.

[0029] As an embodiment of the present invention, the step of constructing the event sequence corresponding to the network agent based on the key behavior segment includes: extracting behavior data from the key behavior segment; generating a timestamp sequence corresponding to the behavior data; dividing the time period corresponding to the timestamp sequence; identifying key time points in the time period; and constructing the event sequence corresponding to the network agent based on the key time points.

[0030] The behavioral data refers to specific network security-related information extracted from key behavioral segments of multi-source logs, covering core behavioral characteristics of three major scenarios: email, terminal EDR, and DNS. It serves as the foundational data for constructing event sequences. For example, the sender's IP (5.44.57.89) and attachment hash (85e015e6f7...) are extracted from key email behavioral segments; the process name and executed command are extracted from key terminal EDR behavioral segments; and the query domain name and query frequency (60 times / minute) are extracted from key DNS behavioral segments. The timestamp sequence refers to a continuous set of time stamps formed by arranging the occurrence times corresponding to the extracted behavioral data from each scenario in chronological order. It must correspond one-to-one with the behavioral data to ensure a clear temporal sequence of events. For example, corresponding to the above behavioral data, the timestamp sequence generated is: 2025-04-10 08:30 (email behavior), 2025-04-10 08:35 (terminal EDR behavior), 2025-04-10 08:45 (DNS behavior) visually presents the order of occurrence of abnormal behaviors in different scenarios, providing a basis for subsequent time period division. The time period refers to a continuous time interval divided according to the distribution characteristics of the timestamp sequence and preset rules (such as possible associated time intervals of attack behaviors). Each interval must contain at least one scenario's behavior data timestamp to facilitate focusing on abnormal behaviors within a specific time range. For example, considering the attack chain association requirements, the above timestamp sequence is divided into 2025-04-10 08:20-08:40, 2025-04-10... The attack chain is divided into two time periods: 08:40 and 09:00. The first time period includes email and terminal behavior timestamps, while the second time period includes DNS behavior timestamps. The critical time points refer to the specific times within the defined time periods when core abnormal behaviors (directly pointing to the attack stage) occur. These are key nodes in constructing the subsequent event sequence and must be strongly correlated with the core behaviors within the critical behavior segments. For example, within the time period 08:20-08:40 on 2025-04-10, 08:30 (phishing email reception) and 08:35 (malicious terminal process execution) are critical time points; within the time period 08:40-09:00, 08:45 (abnormal DNS query) is a critical time point. These time points correspond to different stages of the attack chain.

[0031] Furthermore, the extraction of behavioral data from the key behavioral segments can be achieved through regular expression matching methods, such as using Python's `re` module to write specific pattern matching rules to extract operation commands and objects from log text, thereby obtaining behavioral data; the generation of the timestamp sequence corresponding to the behavioral data can be achieved through time serialization processing methods, such as using the `to_datetime` function of the Pandas library to convert the time strings in the log entries into standardized timestamps and sort them, thereby obtaining a timestamp sequence; the division of the time periods corresponding to the timestamp sequence can be achieved through a fixed time window segmentation algorithm, such as using Pandas' `resample` method to group the timestamp sequence by hourly granularity, thereby obtaining time periods; the identification of key time points in the time periods can be achieved through outlier detection algorithms, such as using the KNN model in the PyOD library to detect outliers in the timestamp density distribution, thereby obtaining key time points; the construction of the event sequence corresponding to the network agent can be achieved through a directed graph construction algorithm, such as using the NetworkX library to construct a directed graph with time attributes for key time points and their associated behavioral data, thereby obtaining an event sequence.

[0032] In detail, as another embodiment of the present invention, the step of constructing the event sequence corresponding to the network agent based on the key time point includes: obtaining the time log identifier corresponding to the key time point; associating the data asset number to which the time log identifier belongs; integrating the log entries corresponding to the data asset number; sorting the event order of the log entries; and generating the event sequence corresponding to the network agent based on the event order of the log entries.

[0033] The time log identifier refers to the unique identifier of the log corresponding to a key time point. It is composed of the time information of the key time point and the unique code of the log itself. It is used to accurately associate the original log corresponding to the key time point and is the core index for subsequent association of data asset numbers. For example, if the key time point is 2025-04-10 08:30 (the time of receiving the phishing email), its corresponding time log identifier can be "202504100830_LOG5969", where "202504100830" is the key time point and "LOG5969" is the unique code of the phishing email log in the mail server. The original email log of this key time point can be quickly located through this identifier. The data asset number refers to the code used to uniquely distinguish each data asset (such as terminal, mail server, DNS server) in the target area network. It consists of the asset type abbreviation and the serial number and is associated with the same The core basis for asset multi-scenario logs conforms to the design of "unique asset identifier". For example, the asset number of a terminal device is "PC-001", the asset number of a mail server is "MAIL-SRV02", and the asset number of a DNS log server is "DNS-SRV03". The time log identifier "202504100830_LOG5969" can be associated with its corresponding data asset number "MAIL-SRV02", clearly indicating which mail server the log originated from. The log entry refers to the original log fragment corresponding to the data asset number, containing complete behavioral information and covering the specific content of key behavioral segments (such as behavior type and associated parameters). It is the basic data unit for constructing event sequences and is consistent with the storage format of "multi-source log data". For example, the log entry corresponding to the data asset number "PC-001" (terminal) is: "Time: 2025-04-10". At 08:35, the behavior was: process started, process name: unknown.exe, command executed: ssh -L8080:192.168.1.60:80200.24.99.12, log ID: LOG44403. This record fully documents the details of the terminal's abnormal behavior. The event sequence refers to the order of actions formed by sorting log entries under the same data asset number or associated asset number according to their corresponding key time points. It needs to reflect the temporal logic of the abnormal behavior and provide ordered data support for generating the event sequence. For example, the log entries of associated asset numbers "MAIL-SRV02", "PC-001", and "DNS-SRV03" after being sorted by key time points are: 2025-04-10 08:30 (phishing email log entry for MAIL-SRV02) → 2025-04-10 08:35 (malicious process log entry for PC-001) → 2025-04-10 08:45 (Abnormal query log entry for DNS-SRV03).

[0034] Furthermore, obtaining the time log identifier corresponding to the key time point can be achieved through a hash digest algorithm, such as using the SHA-256 function to generate a unique encrypted digest of the key time point, thereby obtaining the time log identifier; associating the data asset number to which the time log identifier belongs can be achieved through a database association query method, such as using an SQL left join operation to perform an association query between the time log identifier and the asset number field of the asset inventory table, thereby obtaining the data asset number; integrating the log entries corresponding to the data asset number can be achieved through a log aggregation tool, such as using the Splunk search language to merge log entries with the same data asset number into a unified data set, thereby obtaining the log entries; sorting the event order of the log entries can be achieved through a timestamp sorting algorithm, such as applying Unix timestamp values ​​to sort the log entries in ascending order, thereby obtaining the event order of the entries; generating the event sequence corresponding to the network agent can be achieved through a directed acyclic graph (DAG) construction method, such as using Apache Airflow to write a DAG workflow to define event dependencies and execution order, thereby obtaining the event sequence.

[0035] Specifically, for a more intuitive understanding of the execution logic and data flow relationship between network security protection and log processing in this solution, please refer to [link / reference]. Figure 2 ,Should Figure 2 As an overall architecture diagram of the intelligent agent, it clearly presents the complete link from multi-source log input to security handling and auditing: The data access layer focuses on the collection of information from various log servers such as email, EDR, and DNS, which is the basic data source for subsequent security analysis; The core layer of the intelligent agent uses a progressive logic of "log collection → attack identification → link matching → emergency handling" combined with models such as email detection and EDR detection to intelligently analyze and respond to threats; The collaborative handling layer undertakes the intelligent analysis results to carry out joint protection; The storage and auditing layer completes data retention and audit tracing with "raw logs, processing records, and evidence chains". It should be noted that the relationship between the layers in the architecture diagram is essentially an abstract refinement of the "detection-analysis-handling-auditing" logic of network security. In actual scenarios, the complexity of multi-source log fusion (such as the adaptation of different log formats and real-time requirements) and the decision diversity of intelligent models (different attack chain characteristics correspond to differentiated detection and handling strategies) are far greater than what is shown in the diagram. This architecture is only a concise display of the core logic to provide an intuitive reference for understanding the systematic thinking of intelligent network security defense.

[0036] S2. Based on the event sequence, identify the attack stage corresponding to the attack event in the target area network, query the multi-scenario log stream corresponding to the attack stage, and determine the security threat level corresponding to the attack event based on the multi-scenario log stream.

[0037] Based on the event sequence, this invention identifies the attack phase corresponding to the attack event in the target area network. It can effectively integrate coherent abnormal behavior trajectories in multiple scenarios, breaking the limitations of fragmented detection in a single scenario in the prior art. This allows the determination of the attack phase to no longer be limited to isolated behaviors, improving the completeness and accuracy of the identification.

[0038] The aforementioned attack events refer to network security threats that occur within a target area network, initiated through multiple scenarios such as email, terminals, and DNS, and involve coherent attack behaviors that may form a complete or partial attack chain. Identification relies on multi-source log correlation analysis, covering a series of stages from initial attack delivery to subsequent malicious behavior execution and data theft. These attacks target “cross-scenario, long-chain complex attacks.” For example, an attack event might involve: first, a phishing email (attachment hash 85e015e6f76...) sent from a sender with IP address 5.44.57.89; then, the terminal executes the unknown.exe process and issues a tunneling command; finally, the attack involves querying a domain name (at a frequency of 60 queries per minute). (Zhong) Establishes a DNS tunnel to transmit data, forming a complete attack process; the attack stage refers to a set of attack links consisting of multiple functionally related and sequentially continuous attack steps, corresponding to the stage with a clear target in the attack chain (such as delivery, execution, and transmission), which is the core basis for "phased automated handling" and needs to reflect the phased characteristics of the attack. For example, combined with the functions of the attack steps, the identified attack stages are: phishing email stage (including step 1: phishing email delivery), terminal tunnel establishment stage (including step 2: malicious process startup and tunnel command execution), and DNS tunnel transmission preparation stage (including step 3: DNS abnormal domain name query). Each stage corresponds to different defense and handling requirements.

[0039] As an embodiment of the present invention, the step of identifying the attack stage corresponding to the attack event in the target area network based on the event sequence includes: analyzing the time window corresponding to the event in the event sequence; matching the behavior sequence between the time window and historical attack behavior; determining the current attack behavior in the target area network based on the behavior sequence; dividing the attack steps corresponding to the attack event in the target area network according to the current attack behavior; and identifying the attack stage corresponding to the attack step.

[0040] The time window refers to a continuous time interval defined around key events (such as the time of occurrence of abnormal behavior) in an event sequence. It is used to associate log behaviors of the same asset in multiple scenarios within this interval. It is the core time range for matching historical attack behaviors and identifying current attack correlations, meeting the requirements of "cross-scenario log correlation analysis". For example, the time of the key event in the event sequence is 2025-04-10. 08:35 (malicious process execution on the terminal), the defined time window is 08:25-08:45 on 2025-04-10, covering 10 minutes before and after the event, and can be correlated with email receiving logs and DNS query logs within this interval; the historical attack behavior refers to a set of recorded network attack cases containing complete attack chains and behavioral characteristics, covering the attack scenarios, behavioral sequence, key characteristics (such as phishing email attachment types, tunnel command formats), etc., which is a reference for matching the current event sequence and identifying attack patterns, corresponding to "historical experience data for attack chain identification". For example, historical attack behavior record: 2025-03-20 An attack was delivered through a phishing email (attachment hash 72cd0989304f...) sent by a sender with IP 6.33.46.78, the terminal executed the mal.exe process, and then established a DNS tunnel through a random domain name, containing complete behavioral characteristics and time sequence; the behavioral sequence refers to the event sequence corresponding to the time sequence, arranged in chronological order. The specific set of attack-related behaviors, or the set of behaviors ordered by attack flow in historical attack behaviors, needs to reflect the temporal correlation of behaviors across multiple scenarios. It serves as a bridge connecting the current event with historical attacks and determining the current attack behavior. For example, the behavior sequence within the current time window (2025-04-10 08:25-08:45) is: 08:30 receiving a phishing email (sender IP: 5.44.57.89) → 08:35 executing the unknown.exe process → 08:38 initiating a DNS query, consistent with the behavior sequence structure of historical attack behaviors. The current attack behavior refers to specific malicious behaviors identified from the target area network event sequence based on the matching results of the behavior sequence within the time window and historical attack behaviors. It covers abnormal operations in scenarios such as email, terminals, and DNS, and is the basis for dividing attack steps. This corresponds to the output result of "multi-scenario attack behavior detection." For example, through matching, the current attack behavior is determined to include: 2025-04-10 At 08:30, a phishing email containing malicious attachments (hash: 85e015e6...) was received. At 08:35, the terminal executed a tunnel establishment command (ssh -L8080:192.168.1.60:80200.24.99).12) etc.; The attack steps refer to the independent links with sequential logical relationships formed by breaking down the current attack behavior according to the attack flow. Each step corresponds to an attack action in a single scenario or across scenarios, and is the basic unit constituting the attack stage. It conforms to the idea of ​​"step-by-step reconstruction of the attack chain". For example, based on the current attack behavior, the attack steps are divided as follows: Step 1 (2025-04-10 08:30): Phishing email delivery (email scenario); Step 2 (08:35): Terminal malicious process startup and tunnel command execution (terminal scenario); Step 3 (08:45): DNS abnormal domain name query (DNS scenario). Each step is logically connected according to time.

[0041] Furthermore, the analysis of the time window corresponding to the event in the event sequence can be implemented using a sliding window algorithm, such as using the rolling function of the Pandas library to dynamically divide the event sequence at fixed time intervals to obtain the time window; the matching of the behavior sequence between the time window and historical attack behavior can be implemented using a sequence similarity algorithm, such as using the sequence Matcher of the RapidFuzz library to calculate the pattern matching degree between the behavior sequence and the attack knowledge base to obtain the behavior sequence; the determination of the current attack behavior in the target area network can be implemented using an abnormal behavior detection algorithm, such as using the Isolation Forest model of the PyOD library to identify abnormal network behaviors that deviate from the normal baseline to obtain the current attack behavior; the division of the attack steps corresponding to the attack events in the target area network can be implemented using a directed graph segmentation algorithm, such as using the strongly_connected_components function of the NetworkX library to decompose the attack action dependencies to obtain the attack steps; the identification of the attack stage corresponding to the attack step can be implemented using an attack chain modeling method, such as using the tactical classification model of the MITREAT T&CK framework to perform tactical annotation on the attack steps to obtain the attack stage.

[0042] This invention, by querying multi-scenario log streams corresponding to the attack phase, can break through the fragmented limitations of single-scenario log detection, integrate multi-dimensional log data such as emails, terminals, and DNS associated with the attack phase, avoid information loss caused by relying on a single log, provide more comprehensive data support for attack event analysis, and improve the systematicness and accuracy of network security defense.

[0043] The multi-scenario log stream refers to a continuous collection of logs collected by the intelligent agent from the mail server, terminal EDR system, and DNS log server it connects to for the identified attack phase. These logs are linked by time sequence or asset unique identifier and cover key information related to the attack in each scenario. This is the core data for cross-domain correlation analysis and can avoid the fragmentation problem of single-scenario logs. For example, when the attack phase is the terminal tunnel establishment phase, the multi-scenario log stream includes: phishing email logs from the mail server at 08:30 on 2025-04-10 (sender IP: 5.44.57.89), malicious process logs from the terminal EDR at 08:35 (process name: unknown.exe), and abnormal query logs from the DNS log server at 08:40. Optionally, the query for the multi-scenario log stream corresponding to the attack phase can be implemented through a distributed log query method, such as using Elasticsearch's DSL syntax to write multi-condition query statements to retrieve data across multiple log indexes, thereby obtaining the multi-scenario log stream.

[0044] Furthermore, based on the multi-scenario log stream, this invention determines the security threat level corresponding to the attack event. By integrating logs from multiple scenarios such as email, terminals, and DNS, it avoids false alarms caused by fragmented logs from a single scenario, making the level determination more accurate. This promotes an orderly connection between detection and response in the defense process, enhancing the pertinence and scientific nature of the overall network security defense.

[0045] The security threat level refers to the attack threat level determined based on the event threat value, impact range, and corresponding threat level range of the attack event. It is usually divided into three levels: low, medium, and high. It is a key decision-making basis for "phased automated handling". For example, if an attack event has an event threat value of 7.15 and an impact range of 12 terminals, it corresponds to the "high threat range" and its security threat level is determined to be "high threat". Subsequently, the highest priority automated handling process (such as emergency blocking and full evidence retention) will be triggered.

[0046] As an embodiment of the present invention, determining the security threat level corresponding to the attack event based on the multi-scenario log stream includes: extracting abnormal log features from the multi-scenario log stream; calculating the event threat value corresponding to the attack event based on the abnormal log features; assessing the impact range corresponding to the target area network based on the event threat value; determining the threat level range corresponding to the impact range; and determining the security threat level corresponding to the attack event based on the threat level range.

[0047] The abnormal log features mentioned above refer to key features extracted from multi-scenario log streams (email, terminal EDR, DNS logs) that reflect attack behavior. These features encompass specific information related to attacks in each scenario and are the core basis for calculating event threat values. They correspond to the feature extraction requirements for "multi-scenario attack behavior detection." For example, extracting from log streams: malicious attachment hashes (85e015e6f764...) from email logs, abnormal process names (unknown.exe) and tunnel commands from terminal EDR logs, and high-frequency queries and high-entropy domain names (entropy value > 5.2) from DNS logs. All are typical abnormal log characteristics; the event threat value refers to the attack threat quantification value calculated based on abnormal log characteristics in multi-scenario log streams, according to preset weights (e.g., malicious attachment feature weight 35%, abnormal terminal process weight 30%, high-frequency DNS query weight 25%, other feature weight 10%), used to intuitively reflect the maliciousness of the attack event. For example, in an attack event, the malicious attachment feature scores 8 points, the abnormal terminal process scores 7 points, and the high-frequency DNS query scores 9 points. The event threat value calculated according to the weights is: 8×0.35+7×0.3+9×0.25=2.8+2.1+2.2 5 = 7.15, with higher values ​​indicating more severe threats. The scope of impact refers to the range of network assets that an attack event may affect, assessed by combining the event threat value with the distribution of network assets in the target area. This includes the types of assets affected (terminals, servers), their quantity, and whether core business assets are involved. This corresponds to the core content of "attack propagation risk assessment." For example, an attack event, after assessment, has the following scope of impact: affecting 12 terminals (asset numbers PC-001 to PC-012) within the target area network, but not involving core business servers (such as database server DB-SRV01), and no cross-network incidents have yet occurred. The spread of the attack clearly defines the actual impact boundary of the attack. The threat level range refers to the preset range of event threat values ​​or impact areas used to classify security threat levels. It is usually divided into three ranges: low, medium, and high, providing a clear standard for determining the security threat level. For example, the adapted threat level range is set as follows: event threat value 0-3.5 and impact area < 5 terminals is the "low threat range"; 3.5-7 and impact area 5-10 terminals is the "medium threat range"; 7-10 and impact area ≥ 10 terminals is the "high threat range". Each range corresponds to a clear level determination criterion.

[0048] Furthermore, the extraction of abnormal log features from the multi-scenario log stream can be achieved using an isolated forest detection algorithm, such as using the Isolation Forest model from the PyOD library to identify outlier patterns in the log stream, thereby obtaining abnormal log features; the calculation of the event threat value corresponding to the attack event can be achieved using a weighted scoring model, such as using the CVSS scoring framework combined with attack complexity and impact parameters for quantitative calculation, thereby obtaining the event threat value; the assessment of the impact range corresponding to the target area network can be achieved using a graph propagation algorithm, such as using the breadth-first search algorithm from the NetworkX library to traverse the network topology connections, thereby obtaining the impact range; the determination of the threat level interval corresponding to the impact range can be achieved using a numerical binning method, such as using the cut function from the Pandas library to discretize continuous impact values ​​into three intervals: high, medium, and low, thereby obtaining the threat level interval; the determination of the security threat level corresponding to the attack event can be achieved using rule engine reasoning, such as configuring the mapping rules between threat value intervals and level labels through the Drools rule engine, thereby obtaining the security threat level.

[0049] S3. Based on the security threat level, calculate the risk impact value corresponding to the attack event, assess the handling priority corresponding to the risk impact value, and generate a response instruction set corresponding to the attack event based on the handling priority and the current network operating status.

[0050] Based on the security threat level, this invention calculates the risk impact value corresponding to the attack event, which can transform the qualitative threat level into quantitative risk data, making the risk perception of the attack event more accurate and objective. It can provide core data support for subsequent priority assessment and provide data reference for optimizing the security protection strategy of the target area network, helping to focus on high-risk links and strengthen defense.

[0051] The risk impact value refers to the total risk value of an attack event, quantified by combining the impact values ​​of elements corresponding to the security threat level with the number / importance of terminals affected by the attack. The formula can be set as "risk impact value = average element impact value × number of terminals affected by the attack × terminal importance coefficient". For example, under the high threat level, the average element impact value is 8.5, and the number of terminals affected by the attack is 10 (all of which are core business terminals with an importance coefficient of 1.2). The calculated risk impact value is 8.5 × 10 × 1.2 = 102. This value directly reflects the actual risk level of the attack on the target area network and provides a basis for assessing the priority of handling.

[0052] As an embodiment of the present invention, the step of calculating the risk impact value corresponding to the attack event based on the security threat level includes: analyzing the element impact values ​​covered by each level in the security threat level; querying the network intelligent terminals associated with the element impact values; identifying the risk diffusion index corresponding to the attack event; determining the risk-affected terminals among the network intelligent terminals based on the risk diffusion index; and calculating the risk impact value corresponding to the risk-affected terminals.

[0053] The element impact value refers to the quantified value corresponding to the core elements (such as attack type severity, importance of affected assets, and data leakage risk) that constitute each threat level (low, medium, and high) in the security threat level system. It serves as the basic parameter for subsequent risk impact value calculations, reflecting the weight of different elements on network security. For example, under the high threat level, the impact value of the "DNS tunnel data theft" element is set to 8 (out of 10), the impact value of the "core terminal intrusion" element is set to 9, and the impact value of the "non-core data leakage" element is set to 6. Each value is preset according to the defense focus to ensure that the quantification logic aligns with the actual attack harm. The network intelligent terminal refers to terminal devices (such as employee office computers and business-specific terminals) deployed in the target area network that can be covered and managed by network intelligent agents. These devices support intelligent agents in collecting their operation logs and executing disposal instructions, serving as the core terminal carrier for "multi-scenario fusion detection." For example, 500 terminals (asset numbers PC-001 to PC-500) in a company's target area network are all equipped with an EDR system (version V4.0). Intelligent agents connect to these terminals through a unified interface to collect process logs and command execution records in real time. The record belongs to a typical network intelligent terminal; the risk diffusion index refers to the multi-scenario log stream (such as terminal connection logs, DNS query range logs), which is an index to quantitatively assess the ability of an attack event to spread from the affected terminal to other network intelligent terminals. The value range is usually 0-2 (0 is no diffusion risk, 2 is high diffusion risk). For example, in a certain attack event, log analysis revealed that the affected terminal (PC-001) had frequent file transfer records with 20 other terminals, and the DNS query involved 5 internal network subdomains. The calculated risk diffusion index was 1.8, indicating a strong cross-terminal and cross-regional risk. Subdomain diffusion risk; the risk-affected terminals refer to terminal devices in network intelligent terminals that have been affected by the attack or have a high diffusion risk, as determined based on the risk diffusion index. These are key targets identified by combining the terminal EDR logs collected by the intelligent agent with the correlation analysis results. For example, in an attack event, the risk diffusion index is 1.8. Based on the EDR logs, the following 10 terminals are identified as risk-affected terminals: PC-001 (which has executed a malicious process), and PC-002 to PC-010 (which have file transfers with PC-001 and have abnormal processes). These terminals require priority handling.

[0054] Furthermore, the analysis of the influence values ​​of elements covered by each level in the security threat level can be achieved through the analytic hierarchy process (AHP), such as using the Python pyahp library to construct a judgment matrix to calculate the weight distribution of each threat element, thereby obtaining the element influence value; the query of the network intelligent terminals associated with the element influence value can be achieved through a graph database traversal algorithm, such as using Neo4j's Cypher query language to find associated terminal nodes according to the influence value path, thereby obtaining the network intelligent terminals; the identification of the risk diffusion index corresponding to the attack event can be achieved through a propagation dynamics model, such as using the SIR model of the NetworkX library to simulate the propagation rate of risk in the network topology, thereby obtaining the risk diffusion index; the determination of the risk-affected terminals among the network intelligent terminals can be achieved through a threshold screening method, such as using the query function of the Pandas library to screen terminal devices with a risk diffusion index higher than 0.7, thereby obtaining the risk-affected terminals; the calculation of the risk influence value corresponding to the risk-affected terminals can be achieved through the following formula.

[0055] In detail, as another embodiment of the present invention, the risk impact value corresponding to the risk-affected terminal is calculated using the following formula:

[0056] in, This indicates the risk impact value corresponding to the terminal affected by the risk. Indicates the level of security threat. Indicates the duration of a phase (in seconds). and These represent the start and end times of the attack phase (in seconds). This indicates the total number of terminals affected by the risk. This indicates the quantity index corresponding to the terminal affected by the risk. Indicates time Time flow to the first Each risk affects the terminal's data rate (in bytes / second). Indicates the reference flow rate (unit: bytes / s).

[0057] In detail, the risk impact value Ez is an integral result of the comprehensive security threat level, attack phase duration, and abnormal traffic levels of each terminal, used to quantify the risk impact of the attack on the terminal group. The security threat level L reflects the severity of the threat; for example, L is 5 for a high-risk ransomware attack and 3 for a medium-risk Trojan. The phase duration T is the total duration of the attack phase (in seconds). For example, if an attack starts at time t1 = 10 seconds and ends at time t2 = 100 seconds, then T = - =90s; Flow rate This refers to the real-time data flow rate (in bytes / s) to the i-th terminal affected by risk at time t. For example, at t=30s, the data flow to the second terminal... (30) is 1200 bytes / s; the reference traffic rate R is the baseline value of traffic under normal terminal operation (unit: bytes / s), used to determine whether the traffic is abnormal. For example, when a terminal is normally processing an HTTP request, R can be set to 800 bytes / s. When an attack occurs, if there are 3 risky terminals affecting the terminal, within a certain period of time... (t) = 1000 bytes / s (t) = 1200 bytes / s (t) = 900 bytes / s, combined with L = 5 (ransomware threat) and T = 90s, the formula will be calculated by... (At this point, the ∑ term is (1000 / 800)² + (1200 / 800)² + (900 / 800)², reflecting the sum of squared deviations of each terminal's traffic from the baseline.) arrive By integrating over the interval and then weighting it with L・(1 / T), the final calculated Ez can accurately reflect the degree of risk impact of this attack on these three terminals.

[0058] This invention, by assessing the handling priority corresponding to the risk impact value, can effectively avoid the ineffective allocation of defense resources to low-risk events, ensuring that core resources are prioritized for attacks with high risk impact values, improving resource utilization efficiency, and also enhancing the initiative and organization of network intelligent agent defense. This makes defense actions more aligned with the actual risk situation of the target area network, meeting the core objective of improving the intelligence and response efficiency of network security defense. The handling priority refers to the order in which attack events are processed based on their risk impact value and the current operating status of the target area network (such as bandwidth utilization and core server load). The core principle is to prioritize high-risk events for defensive resources and response operations, preventing low-risk events from consuming resources and causing delays in handling high-risk events, thus ensuring efficient and orderly network security response. For example, an attack event with a risk impact value of 102 (involving 10 core business terminals) and a low current network load has a "high" handling priority, prioritizing malicious process blocking and full evidence retention. Another event with a risk impact value of 35 (involving 3 non-core terminals) has a "low" handling priority, scheduled for log review and routine isolation during off-peak network hours. Optionally, the assessment of the handling priority corresponding to the risk impact value can be achieved through multi-criteria decision analysis methods, such as using Python's scikit-criteria library to implement a weighted sum model to comprehensively evaluate the risk value and business criticality factors, thereby obtaining the handling priority.

[0059] Furthermore, based on the aforementioned handling priority and the current network operating status, this invention generates a response instruction set corresponding to the attack event. This allows the response operation to be both aligned with the attack risk level and adapted to the actual network carrying capacity, effectively optimizing the allocation of defense resources, preventing low-priority tasks from occupying critical resources, and ensuring that high-priority tasks are executed efficiently when network conditions permit. It also provides a clear basis for the coordinated scheduling of subsequent functional units, ensuring that handling actions are accurately implemented, quickly curbing the spread of attacks without affecting the normal business operation of the target area network.

[0060] The response instruction set refers to a set of instructions generated based on the handling priority of attack events and the current network operating status, containing specific handling actions. It specifies the instruction type (e.g., isolation, blocking, source tracing, log retention), execution target (e.g., email gateway, terminal EDR, firewall, source tracing module), and execution parameters (e.g., isolation duration, blocked IP / domain name, source tracing depth). This is used to guide the network intelligent agent functional units to collaboratively complete the handling. For example, for a high-priority phishing email event, the response instruction set includes: "Email gateway: Isolate suspicious emails (ID: LOG5969, isolate for 24 hours); EDR: Detect attachment execution records on terminal PC-001; Source tracing module: Query the sender's IP address (5.44.57.89); Log retention module: Save attachment hash 85e015e6...". The current network operating status refers to the target... The real-time operation status of the regional network when generating the response instruction set includes key indicators such as network bandwidth utilization, core server CPU load, and core business response time. This is used to dynamically adjust the timing of the response actions to avoid excessive resource consumption and disruption to normal business operations. For example, if the target regional network status at a certain moment is: bandwidth utilization 82% (preset peak threshold 90%), core business server CPU load 73% (high load threshold 80%), and office system response time 0.7 seconds (normal threshold 1 second), then high-priority actions should be prioritized, while non-core medium-priority tasks should be delayed. Optionally, the generation of the response instruction set corresponding to the attack event can be achieved through security orchestration automation technology, such as using the Swimlane platform's visual Playbook designer to configure a predefined response workflow to obtain the response instruction set.

[0061] S4. Based on the response instruction set, the functional units in the network agent are coordinated and scheduled to obtain unit cooperation pairs. Based on the unit cooperation pairs, the communication association data corresponding to the functional units is determined, and the data interaction index corresponding to the communication association data is calculated.

[0062] Based on the aforementioned response instruction set, this invention coordinates and schedules the functional units within the network intelligent agent to obtain unit cooperation pairs. This breaks the limitation of isolated operation of each functional unit, allowing units such as log collection, attack handling, and evidence preservation to cooperate precisely according to instruction requirements. It clarifies the responsibilities and cooperation processes of each unit, prevents operational conflicts between different units due to target deviations, avoids processing gaps caused by insufficient capabilities of a single unit, and improves the overall effectiveness of attack event response.

[0063] The functional units refer to independent modules within the network intelligent agent that perform specific security functions. These modules can complete dedicated tasks (such as log processing, attack handling, and evidence preservation) according to response instruction sets and can collaborate with other units. They are core components for achieving a full-process response to attack events. Each unit has clearly defined responsibilities and operational scope. For example, the log collection unit (retrieving logs from mail servers and terminal EDRs in real time, processing 300 data entries per second), the terminal management unit (blocking processes on risky terminals, with a response delay of ≤0.5 seconds), and the source tracing and analysis unit (tracking the attribution of abnormal IPs, with a single source tracing taking ≤5 minutes). These units can achieve high efficiency through collaboration. Effectively complete the detection and handling of attack events; the unit cooperation pair refers to the pairing of functional units with cooperative relationship formed after scheduling the functional units of the network intelligent agent according to the cooperation relationship table. Each pair of units needs to cooperate according to the instruction requirements (such as one to perform operation and one to synchronize data). For example, after scheduling, a cooperation pair of "email gateway management unit + IP source analysis unit" is formed: the former performs email isolation operation and synchronizes the isolation result (such as email ID, isolation time) to the latter; the latter automatically initiates source tracing of the sending IP (5.44.57.89) of the email based on the synchronization result, realizing the coherent cooperation of "operation-data synchronization-subsequent handling".

[0064] As an embodiment of the present invention, the step of coordinating the functional units in the network agent based on the response instruction set to obtain unit cooperation pairs includes: parsing the control instruction items contained in the response instruction set; matching the units to be scheduled corresponding to the control instruction items; verifying the unit connection status between the functional units in the units to be scheduled; generating a cooperation relationship table corresponding to the functional units in the network agent based on the unit connection status; and coordinating the functional units in the network agent based on the cooperation relationship table to obtain unit cooperation pairs.

[0065] The control instruction item refers to a specific instruction extracted from the response instruction set, which has a clear operational objective and parameters. It covers instruction type (such as isolation, blocking, source tracing), execution object (such as terminal, domain name, IP), and operation parameters (such as duration, depth). It is the core basis for matching the unit to be scheduled. For example, for a high-priority phishing email event, a certain control instruction item is "Isolation Instruction - Object: Suspicious Email (ID: LOG5969) - Parameter: Isolation Duration 24 Hours - Execution Carrier: Email Gateway", which clearly defines the key information of "what to do, what to do, and how to do it". This ensures that the units to be scheduled can execute accurately. The units to be scheduled refer to the network intelligent agent functional units matched according to the operational requirements of the control instructions, each corresponding to a specific instruction type and meeting the instruction execution capability requirements (such as response speed and processing volume). For example, when matching the "isolate suspicious emails" instruction, the unit to be scheduled is the email gateway management unit (supporting single / batch email isolation, response latency ≤ 1 second); when matching the "trace the sender's IP" instruction, the unit to be scheduled is the IP tracing analysis unit (supporting real-time location query, single analysis time ≤ 3 minutes). There are two units to be scheduled. The unit connection status refers to the communication and collaboration status between the units to be scheduled for data interaction and instruction synchronization. Key indicators include connection connectivity, data transmission latency, and packet loss rate. It is necessary to verify whether the status meets the collaboration requirements to avoid interruption of processing due to connection abnormalities. For example, verify the connection status between the email gateway management unit and the IP source tracing analysis unit: if the connection status is "normal", the data transmission latency is 120ms (threshold ≤ 200ms), and the packet loss rate is 0% (threshold ≤ 1%), it indicates that the two units can collaborate normally and can achieve real-time synchronization of isolation results and source tracing requirements. The collaborative relationship table refers to a structured table that integrates information such as unit connection channels, collaborative requirements, collaborative interaction paths, and collaborative transmission indexes. It clearly records functional unit pairs, collaboration details, and path quality, providing an intuitive basis for subsequent scheduling. For example, a certain collaborative relationship table includes: unit pair (A-email gateway management / B-IP tracing), connection channel (TCP, 100Mbps), collaborative requirements (transmit IP+ID within 10 seconds), interaction path (A→192.168.1.1→firewall→B), and transmission index 4.7, fully presenting the core elements of unit collaboration.

[0066] Furthermore, parsing the control instruction items contained in the response instruction set can be achieved through natural language processing methods, such as using the dependency parsing technology of the spaCy library to extract the verb-object structure in the instruction text, thereby obtaining the control instruction items; matching the scheduling units corresponding to the control instruction items can be achieved through graph neural network matching algorithms, such as using the node matching model in the Deep Graph Library to calculate the semantic similarity between the instruction and the functional unit, thereby obtaining the scheduling unit; verifying the unit connection status between the functional units in the scheduling unit can be achieved through network probing technology, such as using the port scanning function of the Nmap tool to detect the connectivity of the communication links between units, thereby obtaining the unit connection status; combining and generating the collaborative relationship table corresponding to the functional units in the network agent can be achieved through relationship graph construction methods, such as using the Cypher statement of the Neo4j graph database to generate an adjacency matrix containing unit dependencies, thereby obtaining the collaborative relationship table; the collaborative scheduling of the functional units in the network agent can be achieved through distributed scheduling algorithms, such as using the DAG scheduling engine of Apache Airflow to execute the unit call sequence according to the dependency relationship, thereby obtaining unit collaborative pairs.

[0067] As another embodiment of the present invention, the step of generating a collaborative relationship table corresponding to the functional units in the network agent based on the unit connection state includes: determining the unit connection channel between the functional units according to the unit connection state; analyzing the collaborative requirements corresponding to the unit connection channel; querying the collaborative interaction path that meets the collaborative requirements; verifying the collaborative transmission index corresponding to the collaborative interaction path; and generating a collaborative relationship table corresponding to the functional units in the network agent based on the collaborative transmission index.

[0068] The unit connection channel refers to the physical or logical transmission channel used between functional units in a network intelligent agent to transmit data and synchronize instructions. The channel type (e.g., TCP, UDP), bandwidth capacity, communication protocol, and transmission range must be clearly defined. It serves as the basic carrier for inter-unit collaboration. For example, the unit connection channel between the email gateway management unit (A) and the IP source tracing analysis unit (B) is of type TCP, with a bandwidth of 100Mbps, and uses the HTTP / 2 communication protocol. Only A is allowed to transmit critical data such as the ID and time of isolated emails to B. The channel stability must meet a connectivity rate of over 99.9% to ensure that collaborative data is not lost. Interruption; The aforementioned collaborative requirements refer to the clearly defined inter-unit collaboration requirements based on the control command objectives and functional unit responsibilities, covering key parameters such as data transmission content, synchronization time limits, and interaction frequency, which need to be compatible with the capabilities of the unit connection channel. For example, for the "isolate email + trace IP" command, the collaborative requirements are: within 10 seconds after completing email isolation, the email gateway management unit (A) transmits the sender IP (e.g., 5.44.57.89) and email ID (LOG5969) of the isolated email to the IP trace analysis unit (B), and B needs to receive and provide feedback confirmation in real time to ensure that subsequent trace actions are triggered in a timely manner; The collaborative interaction path refers to the specific data transmission path planned within the unit connection channel to meet collaborative requirements, from the initiating functional unit to the receiving functional unit. It must include the network nodes (such as switches and firewalls) along the path and path latency requirements. For example, the collaborative interaction path from the email gateway management unit (A) to the IP source analysis unit (B) is: A → Core Switch (IP: 192.168.1.1) → Operation and Maintenance Firewall (Port 8080, rules allow A / B communication) → B. The total path latency must be ≤150ms, and the nodes along the path must support data priority marking to ensure collaborative data transmission. Priority transmission; the cooperative transmission index refers to a comprehensive indicator that quantitatively evaluates the transmission quality of cooperative interaction paths. It is usually calculated by combining three dimensions: path delay, packet loss rate, and bandwidth utilization (e.g., index = delay score × 40% + packet loss rate score × 30% + bandwidth utilization score × 30%, with a maximum score of 5 points). It is used to determine whether the path meets the cooperative requirements. For example, if a path has a delay of 120ms (score 5), a packet loss rate of 0% (score 5), and a bandwidth utilization of 30% (score 4), the calculated cooperative transmission index is 5 × 0.4 + 5 × 0.3 + 4 × 0.3 = 4.7, which meets the cooperative requirement of "index ≥ 4.0".

[0069] Furthermore, determining the unit connection channels between the functional units can be achieved through network topology discovery technology, such as using the LLDP protocol to automatically detect the physical connection relationships between adjacent devices, thereby obtaining the unit connection channels; analyzing the collaborative requirements corresponding to the unit connection channels can be achieved through dependency analysis algorithms, such as using the maximum flow minimum cut theorem in graph theory to calculate the service dependency strength carried by the channel, thereby obtaining the collaborative requirements; querying collaborative interaction paths that meet the collaborative requirements can be achieved through shortest path algorithms, such as applying Dijkstra's algorithm to find the optimal transmission path that meets the requirement constraints in the connection topology, thereby obtaining the collaborative interaction path; verifying the collaborative transmission index corresponding to the collaborative interaction path can be achieved through network performance evaluation methods, such as using the iPerf tool to test the end-to-end bandwidth and latency indicators of the path and calculate the weighted score, thereby obtaining the collaborative transmission index; combining and generating the collaborative relationship table corresponding to the functional units in the network agent can be achieved through graph database modeling technology, such as using Neo4j's Cypher statement to integrate channels, paths, and transmission indices into a relationship graph, thereby obtaining the collaborative relationship table.

[0070] Based on the unit collaboration pairs, this invention determines the communication association data corresponding to the functional units and calculates the data interaction index corresponding to the communication association data. This clearly outlines the content and flow of data interaction between units, breaks the ambiguity of data transmission, ensures that collaborative data accurately matches unit needs, avoids collaboration deviations caused by data misalignment, provides a clear basis for optimizing communication links, further enhances the overall efficiency of the network intelligent agent's response, and ensures that attack event handling actions are carried out consistently and reliably.

[0071] The communication-related data refers to a structured data set formed by integrating key information of communication connection protocols, communication events, and real-time communication streams based on communication interaction volume. It covers collaborative unit identifiers, protocol types, event details (trigger time, type), interaction volume indicators, and data integrity status (such as whether it is lost). It is the core basis for subsequent calculation of data interaction index. For example, the communication-related data of the above-mentioned collaborative pair includes: unit pair (terminal EDR - log retention), protocol (TCP), event (09:15 data reporting), interaction volume (204 bytes / 0.8 seconds, 2.5 times / second), and data integrity (100%), which fully associates the comprehensive information of the collaborative unit communication.

[0072] As an embodiment of the present invention, determining the communication association data corresponding to the functional unit based on the unit cooperation pair includes: identifying the communication connection protocol between the unit cooperation pairs; determining the communication events in the functional unit based on the communication connection protocol; collecting the real-time communication stream in the communication events; parsing the communication interaction volume in the real-time communication stream; and determining the communication association data corresponding to the functional unit based on the communication interaction volume.

[0073] The communication connection protocol refers to the standardized rule system followed by functional units in a collaborative pair when interacting with each other to achieve data exchange. It specifies the type of data transmission (e.g., TCP, UDP, HTTP / 2), data format (e.g., JSON, binary stream), interaction logic (e.g., request-response, bidirectional real-time synchronization), and error retransmission mechanism. It is the foundation for ensuring communication compatibility and data accuracy. For example, the "Terminal EDR Unit - Log Retention Unit" collaborative pair uses the TCP protocol for communication, specifies that data is encapsulated in JSON format (including process ID, executed command, and timestamp fields), and requires the receiver to return "received successfully" within 3 seconds. The confirmation code triggers retransmission if it times out, ensuring no data loss. The communication event refers to the specific communication behavior between functional units in a collaborative unit pair based on the communication connection protocol. Each event corresponds to a specific interaction stage agreed upon in the protocol, including event type (e.g., data sending, receiving confirmation, abnormal alarm), triggering conditions (e.g., functional unit completing instruction execution, detecting data update), and time node. For example, in the aforementioned collaborative pair, when the terminal EDR unit completes malicious process blocking (triggering condition), it initiates a "data reporting event" according to the TCP protocol, transmitting the blocking record to the log retention unit. The event trigger time is 2025-04-10 09:15:30, corresponding to the "active data push" stage in the protocol. The real-time communication stream refers to the continuous data sequence transmitted in real-time between collaborative units during the communication event. Each data entry includes a precise timestamp (e.g., millisecond level), data type (e.g., business data, control instructions, response signals), data length (bytes), and source / target unit identifier, completely recording the dynamic data transmission process of the communication event. For example, in the aforementioned "data reporting event," the real-time communication stream is 2025-04-10. 09:15:30.003 (Data length 180 bytes, type: business data, source: terminal EDR unit) → 09:15:30.501 (Data length 24 bytes, type: confirmation response, source: log retention unit), with no data interruption throughout; the communication interaction volume refers to the core indicator set extracted by parsing the real-time communication stream to quantify the scale and frequency of communication event data interaction. It mainly includes the total amount of data transmitted per unit time (e.g., KB / minute), data interaction frequency (e.g., times / second), average data length per interaction (e.g., bytes / time), and interaction duration (seconds). For example, in the above communication event, parsing the real-time communication stream yields: interaction duration 0.8 seconds, total data transmission volume 204 bytes (including 180 bytes of blocking records and 24 bytes of confirmation response), interaction frequency 2.5 times / second, and average data length per interaction 81.6 bytes, which intuitively reflects the activity level and data volume of the communication.

[0074] Furthermore, identifying the communication connection protocol between the collaborative units can be achieved using network protocol analysis tools, such as using Wireshark's protocol parsing function to capture and decode the packet header information between collaborative units to obtain the communication connection protocol; determining the communication events in the functional unit can be achieved using time-series event detection algorithms, such as using Apache Kafka's stream processing engine to aggregate unit communication behavior based on time windows to obtain communication events; collecting the real-time communication stream in the communication events can be achieved using network traffic mirroring technology, such as using port mirroring (SPAN) to copy the communication traffic on the switch to the collection terminal to obtain the real-time communication stream; parsing the communication interaction volume in the real-time communication stream can be achieved using traffic statistics algorithms, such as using the traffic analysis module of the ntopng tool to count the number of packets and bytes per second to obtain the communication interaction volume; determining the communication association data corresponding to the functional unit can be achieved using data association analysis technology, such as using Elasticsearch's association rule engine to perform multi-dimensional association of protocols, events, and interaction volumes to obtain communication association data.

[0075] In detail, as another embodiment of the present invention, the data interaction index corresponding to the communication-related data is calculated using the following formula:

[0076] in, This represents the data interaction index (unit: bytes / s) corresponding to the communication-related data. This indicates the total number of the communication events. This indicates the quantity index corresponding to the communication event. Indicates the first The event risk weight corresponding to each communication event. Indicates the first The amount of communication data corresponding to each communication event (unit: bytes / s). This indicates the acquisition time of the real-time communication stream (unit: bytes / s). This indicates the number of network hops corresponding to the communication event.

[0077] In detail, the data interaction index Iz is an indicator (unit: bytes / s) used to quantify the strength and risk correlation of data interaction in communication associations. It is calculated by integrating the risk of communication events, data volume, collection duration, and network transmission path characteristics. Among these, the event risk weight... This reflects the risk level of the j-th communication event, such as an event transmitting core transaction data. A value of 0.9 (high risk) can be used for transmitting events in ordinary logs. A value of 0.3 (low risk) is acceptable; communication data volume It is the real-time data transmission rate of the j-th communication event, for example, when a certain event transmits customer order information. 1500 bytes / s; acquisition time This refers to the acquisition duration of the real-time communication stream (unit: seconds, used to reflect the time dimension coverage of the data). For example, if a 10-second communication stream was acquired... =10; Network hop count It refers to the number of network nodes a communication event passes through. For example, a communication from a terminal to a server passes through 3 routers. =3.

[0078] For example, suppose there are M=5 communication events, and the events... =0.8 (transmitting payment data) =0.6 (transmitting product information) =0.5 (transmitted user profile) =0.4 (transmission system status) =0.2 (transmitted heartbeat packet); corresponding =1200 bytes / s =1000 bytes / s =800 bytes / s =500 bytes / s =200 bytes / s; Acquisition time =6s; network hop count ts=2. First calculate =0.8×1200+0.6×1000+0.5×800+0.4×500+0.2×200=960+600+400+200+40=2200; then divide by T' to get 2200 / 6≈366.67; then calculate = ≈1.12; final ≈366.67×1.12≈410.67 bytes / s. This result not only reflects the dominant role of high-risk, large-volume communication events in the intensity of interaction, but also reasonably reflects the impact of communication time coverage and transmission path on data interaction by collecting time and network hop count, making the index more in line with the risk and interaction characteristics of actual communication.

[0079] S5. Based on the data interaction index, generate the complete attack chain corresponding to the attack event, extract the response and handling logic corresponding to the complete attack chain, and formulate the security protection strategy corresponding to the target area network based on the response and handling logic.

[0080] Based on the data interaction index, this invention generates a complete attack chain corresponding to the attack event. It can rely on high-quality unit communication association data to ensure that the information in each link of the attack chain (such as initial delivery, malicious execution, and data transmission) is complete and without deviation, avoiding the breakage of the attack chain due to data interaction problems. It can also provide a solid basis for subsequent attack tracing, attack pattern summarization, and defense strategy optimization, helping to strengthen network weaknesses and improve the overall anti-attack capability.

[0081] The complete attack chain refers to a structured attack path that integrates abnormal connection pairs, event behavior sequences, completed behavioral logic (eliminating gaps), and attack protection measures, forming a complete attack process (from initial delivery to target achievement). It clearly presents the attack links, related units, timelines, and defense points. For example, a complete attack chain might be: phishing email delivery (08:30, IP 5.44.57.89) → terminal process execution (08:35, unknown.exe, containing tunnel commands) → DNS tunnel establishment (08:40, random domain name, abnormal connection pair), along with "EDR command collection + domain name interception" protection measures, fully reflecting the full-dimensional information of attack and defense.

[0082] As an embodiment of the present invention, generating a complete attack chain corresponding to the attack event based on the data interaction index includes: filtering abnormal connection pairs in the communication association data according to the data interaction index; reconstructing the event behavior sequence between the attack events based on the abnormal connection pairs; identifying behavioral logic gaps in the event behavior sequence; formulating attack protection measures corresponding to the attack event based on the behavioral logic gaps; and generating a complete attack chain corresponding to the attack event based on the attack protection measures.

[0083] The abnormal connection pairs refer to functional unit collaboration pairs that do not meet normal communication standards, selected based on data interaction indices (such as latency, packet loss rate, and interaction frequency). Their data interaction characteristics deviate from preset thresholds (such as latency > 200ms, packet loss rate > 1%) and are associated with attack events. For example, the connection pair "EDR unit of terminal PC-001 - DNS resolution unit of external domain name" shows a latency of 350ms (threshold 200ms), a packet loss rate of 2.5% (threshold 1%), and an interaction frequency of 60 times / minute (normal ≤ 10 times / minute), thus being judged as an abnormal connection pair. This seems to be used for attacking data transmission; the event behavior sequence refers to a continuous set of behaviors related to the attack event, reconstructed chronologically based on the communication data of abnormal connection pairs. It covers the specific operations (such as delivery, execution, and transmission) and corresponding time nodes of each stage of the attack, reflecting the temporal logic of the attack. For example, the event behavior sequence of a certain attack event: 2025-04-10 08:30 (PC-001 receives phishing email, sender IP 5.44.57.89) → 08:35 (executes unknown.exe process, EDR record abnormal) → 08:40 (establishes DNS connection with random domain name, (Abnormal connection triggers) to fully present the timeline of the attack behavior; the behavioral logic gap refers to a link in the event behavior sequence that is not coherent due to missing data or interrupted interaction, which manifests as a lack of necessary transition operation records between the previous and subsequent behaviors, affecting the integrity of the attack chain. For example, in the above sequence, after the unknown.exe process is executed at 08:35, the operation log of "process issuing tunnel command" is missing before the DNS connection is established at 08:40, making it unclear how the process triggered the DNS connection. This disconnected link is the behavioral logic gap, which needs to be supplemented by the data collection terminal. Command execution logs; the attack protection measures refer to measures formulated to supplement attack chain data collection or block attack spread, based on behavioral logic gaps and attack behavior characteristics. These measures cover log supplementation collection, addition of monitoring rules, and adjustment of defense strategies to ensure the integrity of the attack chain and its subsequent defense capability. For example, to address the logical gap of "missing process command logs," the attack protection measures are as follows: add a "real-time process command line collection rule" (collection frequency 1 time / second) to the terminal EDR system, and add a "unknown.exe process associated domain name blocking rule" to the firewall, which both supplements the data and blocks subsequent attacks.

[0084] Furthermore, the screening of abnormal connection pairs in the communication association data can be achieved through anomaly detection algorithms, such as using the IsolationForest model from the PyOD library to identify abnormal connection patterns in communication traffic, thereby obtaining abnormal connection pairs; the reconstruction of the event behavior sequence between the attack events can be achieved through sequence modeling methods, such as using the Hidden Markov Model from the hmmlearn library to reconstruct the sequence of discrete attack actions, thereby obtaining the event behavior sequence; the identification of behavioral logic gaps in the event behavior sequence can be achieved through sequence alignment algorithms, such as applying the Smith-Waterman algorithm from the BioPython library to detect breaks and missing segments in the sequence, thereby obtaining behavioral logic gaps; the formulation of attack protection measures corresponding to the attack events can be achieved through threat management frameworks, such as using the proactive defense technology of the MITRE Shield framework to generate targeted mitigation schemes, thereby obtaining attack protection measures; the generation of the complete attack chain corresponding to the attack events can be achieved through attack chain modeling tools, such as using the MITRE Shield & CKNavigator matrix to visualize attack steps and tactical stages, thereby obtaining the complete attack chain.

[0085] Specifically, for a more intuitive understanding of the execution logic and data flow relationships corresponding to network security threat detection and handling in this solution, please refer to [link / reference]. Figure 3 ,Should Figure 3 As a schematic diagram of attack chain detection, it clearly presents the complete link from multi-source log input to disposal solution output: The input layer focuses on various types of log data such as phishing emails, EDR, and DNS (including information such as email subject, sender, terminal executed commands, and DNS query domain names), which is the basis for subsequent threat analysis; The processing layer transforms scattered log data into accurate identification of threat links through a progressive logic of "phishing email detection → EDR terminal abnormal behavior detection → DNS covert tunnel detection" combined with multi-dimensional correlation analysis of "dual-chain detection → triple-chain detection (rule matching stage, agent detection stage)"; The output layer takes "phishing email disposal solution, terminal abnormality disposal solution, and DNS covert tunnel disposal solution" as the final result. It should be noted that the correlation of each link in the flowchart is essentially an abstract refinement of the detection and disposal logic of the "phishing intrusion-terminal penetration-covert communication" link of network attacks. In actual scenarios, the complexity of log correlation (such as the difficulty of matching dimensions such as time and agent number across log sources) and the diversity of detection rules (different multi-chain correlation rules corresponding to different attack scenarios) are far greater than what is shown in the diagram. This architecture is only a concise display of the core logic.

[0086] This invention extracts the response and handling logic corresponding to the complete attack chain, enabling precise matching of handling actions to each stage of the attack (such as initial delivery, malicious execution, and data transmission). This avoids blind defense caused by ambiguous attack paths and ensures that each step of the handling can effectively curb the spread of the attack. It can also provide a basis for optimizing defense strategies for similar attacks in the future. By summarizing the adaptation experience between handling logic and attack chains, it helps to strengthen weak links in the network and gradually improve the long-term anti-attack capability of the target area network.

[0087] The response and handling logic refers to a rule system that clearly defines the handling actions, execution order, triggering conditions, and responsible functional units for different attack behaviors based on each link of the complete attack chain (such as initial delivery, malicious execution, and data transmission). This ensures that the handling actions are accurately matched with the attack process, avoids disordered or repeated responses, and guarantees the coherence of each link. For example, if an attack chain includes the links "phishing email delivery → unknown.exe process execution → xyom.nfl.com DNS connection", its response and handling logic is as follows: the email gateway detects a phishing email (triggering condition: attachment hash 85e015e6...) and isolates the email within 10 minutes; the terminal EDR immediately blocks the unknown.exe process (triggering condition: process ID 12345); the firewall detects the target DNS request (triggering condition: domain name matches the blacklist) and intercepts it in real time. Each action is executed sequentially according to the attack timeline. Optionally, the extraction of the response and handling logic corresponding to the complete attack chain can be achieved through attack simulation derivation methods, such as using the response policy generator of the MITRECTID platform to automatically generate handling rules based on the tactical nodes of the attack chain, thereby obtaining the response and handling logic.

[0088] Furthermore, based on the aforementioned response and handling logic, this invention formulates a security protection strategy corresponding to the target area network, which allows the protection measures to precisely match the defense needs of each link in the attack chain, avoids resource waste and defense vulnerabilities caused by indiscriminate protection, improves the targeting of protection, and can dynamically adjust the protection rules based on the attack characteristics and defense experience summarized in the handling logic, so that the strategy is more adaptable to changes in the network security situation and enhances the long-term anti-attack capability of the target area network.

[0089] The security protection strategy refers to a set of systematic protection rules for the target area network, which combines the characteristics of the complete attack chain with response and handling logic. This set includes preventative monitoring, real-time interception, and regular optimization. It clarifies the protection responsibilities, operating standards, and update mechanisms of functional units such as email gateways, endpoint EDRs, and firewalls, ensuring network security throughout the entire process from attack prevention to subsequent defense. For example, a strategy might stipulate that: the email gateway updates its phishing email signature database daily (including ≥500 new hash values), and the response time for intercepting malicious attachment emails is ≤3 seconds; the endpoint EDR triggers alarms for unknown processes that start ≥2 times within 1 minute; and the firewall blocks domains with a DNS query frequency ≥50 times / minute, forming a multi-stage collaborative protection. Optionally, the security protection strategy for the target area network can be implemented using a network security framework, such as using the core functional modules of the NISTCybersecurity Framework to construct an integrated defense-detection-response strategy, thereby obtaining the security protection strategy.

[0090] In detail, the aforementioned security protection strategy enables full-process control of network attack risks in the target area. The strategy targets key links in the attack chain (such as phishing email delivery, malicious process execution, and abnormal DNS connections), clearly defining the protection responsibilities and operational standards of functional units such as email gateways, endpoint EDRs, and firewalls. It can accurately intercept threats from the initial attack stage, reducing the probability of malicious behavior penetrating core businesses and lowering the frequency of security incidents such as data breaches and system downtime. Simultaneously, the strategy avoids the resource waste caused by indiscriminate protection by focusing defense resources on high-risk links, allowing functional units to collaborate efficiently according to rules, thus improving overall protection efficiency. It also includes a regular update mechanism, which can optimize protection rules based on newly discovered attack characteristics, dynamically adapting to changes in the network security landscape and effectively responding to new attack methods. Furthermore, the strategy does not interfere with normal network communication and business operations when intercepting threats, ensuring the continuity of core businesses. In the long term, it can also continuously strengthen weak links in the network by accumulating defense experience, forming a "monitoring-interception-optimization" defense closed loop, steadily improving the long-term anti-attack capability of the target area network.

[0091] Compared to the problems described in the background technology, this invention, by deploying network agents in the target area network and collecting multi-source log data from mail servers, terminal EDR systems, and DNS log servers covered by the network agents, effectively breaks through the fragmented limitations of single-scenario detection in existing technologies. It achieves centralized integration of multi-dimensional security log data and allows the agents to comprehensively grasp the security status information of the target area network, providing core data support for subsequent phased automated handling, attack tracing, and evidence preservation. This enhances the systematic and intelligent starting point of network security defense from a data perspective. Based on the event sequence, this invention identifies the attack stages corresponding to attack events in the target area network, effectively integrating coherent abnormal behavior trajectories across multiple scenarios. This breaks through the limitations of fragmented single-scenario detection in existing technologies, allowing the determination of attack stages to no longer be limited to isolated behaviors, improving the completeness and accuracy of identification. Furthermore, based on the security threat level, this invention calculates the risk impact value corresponding to the attack event, transforming qualitative threat levels into quantitative risk data, making the risk perception of attack events more accurate and objective. This invention provides core data support for subsequent priority assessment and data reference for optimizing security protection strategies for target area networks, helping to focus on high-risk links and strengthen defense. Furthermore, based on the response instruction set, this invention coordinates and schedules functional units in the network intelligent agent to obtain unit cooperation pairs. This breaks the limitation of isolated operation of each functional unit, allowing units such as log collection, attack handling, and evidence retention to cooperate precisely according to instruction requirements. It clarifies the responsibilities and cooperation processes of each unit, prevents operational conflicts between different units due to target deviations, avoids handling gaps caused by insufficient capabilities of a single unit, and improves the overall responsiveness of attack events. Finally, based on the data interaction index, this invention generates a complete attack chain corresponding to the attack event. It can rely on high-quality unit communication association data to ensure that there is no missing or biased information in each link of the attack chain (such as initial delivery, malicious execution, and data transmission), avoiding attack chain breaks caused by data interaction problems. It also provides a solid basis for subsequent attack tracing, attack pattern summarization, and defense strategy optimization, helping to strengthen weak links in the network and improve overall anti-attack capabilities. Therefore, the agent-based automated network security analysis and response method provided in this embodiment of the invention can improve the multi-scenario collaborative capability and response accuracy under network security.

[0092] like Figure 4 The diagram shown is a functional block diagram of an agent-based automated network security analysis and response system according to the present invention.

[0093] The agent-based automated network security analysis and response system 200 described in this invention can be installed in an electronic device. Depending on the functions implemented, the agent-based automated network security analysis and response system may include a sequence construction module 201, a level determination module 202, an instruction generation module 203, an index calculation module 204, and a strategy formulation module 205. The module described in this invention can also be called a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, stored in the memory of the electronic device.

[0094] In this embodiment of the invention, the functions of each module / unit are as follows: The sequence construction module 201 is used to deploy network agents in the target area network, collect multi-source log data from mail servers, terminal EDR systems and DNS log servers covered by the network agents, extract key behavior segments from the multi-source log data, and construct the event sequence corresponding to the network agents based on the key behavior segments. The level determination module 202 is used to identify the attack stage corresponding to the attack event in the target area network based on the event sequence, query the multi-scenario log stream corresponding to the attack stage, and determine the security threat level corresponding to the attack event based on the multi-scenario log stream. The instruction generation module 203 is used to calculate the risk impact value corresponding to the attack event based on the security threat level, evaluate the handling priority corresponding to the risk impact value, and generate a response instruction set corresponding to the attack event based on the handling priority and the current network operation status. The index calculation module 204 is used to coordinate and schedule the functional units in the network agent based on the response instruction set to obtain unit cooperation pairs, determine the communication association data corresponding to the functional unit based on the unit cooperation pairs, and calculate the data interaction index corresponding to the communication association data. The strategy formulation module 205 is used to generate a complete attack chain corresponding to the attack event based on the data interaction index, extract the response and handling logic corresponding to the complete attack chain, and formulate a security protection strategy corresponding to the target area network based on the response and handling logic.

[0095] In detail, the modules in the agent-based automated network security analysis and response system 200 described in this embodiment of the invention employ the same methods as described above. Figure 1 This method employs the same technical means as the agent-based automated network security analysis and response method described above, and can produce the same technical effects, so it will not be elaborated here.

[0096] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. In the above multiple embodiments, each embodiment can be combined with each other or independent. Deleting any one of them will not affect the technical implementation of other embodiments. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An agent-based automated analysis and response method for network security, characterized in that, The method includes: Deploy network agents in the target area network, and collect multi-source log data from mail servers, terminal EDR systems and DNS log servers covered by the network agents. Extract key behavior segments from the multi-source log data, and construct the event sequence corresponding to the network agents based on the key behavior segments. Based on the event sequence, identify the attack stage corresponding to the attack event in the target area network, query the multi-scenario log stream corresponding to the attack stage, and determine the security threat level corresponding to the attack event based on the multi-scenario log stream. Based on the security threat level, calculate the risk impact value corresponding to the attack event, assess the handling priority corresponding to the risk impact value, and generate a response instruction set corresponding to the attack event based on the handling priority and the current network operating status. Based on the response instruction set, the functional units in the network agent are coordinated and scheduled to obtain unit cooperation pairs. Based on the unit cooperation pairs, the communication association data corresponding to the functional units is determined, and the data interaction index corresponding to the communication association data is calculated. Based on the data interaction index, a complete attack chain corresponding to the attack event is generated, the response and handling logic corresponding to the complete attack chain is extracted, and a security protection strategy corresponding to the target area network is formulated based on the response and handling logic.

2. The agent-based automated network security analysis and response method as described in claim 1, characterized in that, The construction of the event sequence corresponding to the network agent based on the key behavior segments includes: Extract behavioral data from the key behavioral segments; Generate a timestamp sequence corresponding to the behavioral data; Divide the timestamp sequence into time periods; Identify key time points within the stated time period; Based on the key time points, an event sequence corresponding to the network agent is constructed.

3. The agent-based automated analysis and response method for network security as described in claim 2, characterized in that, The construction of the event sequence corresponding to the network agent based on the key time points includes: Obtain the time log identifier corresponding to the key time point; Associate the data asset number to which the time log identifier belongs; Integrate the log entries corresponding to the data asset numbers; Sort the log entries according to the order of the events they correspond to; Based on the order of the events in the entries, an event sequence corresponding to the network agent is generated.

4. The agent-based automated network security analysis and response method as described in claim 1, characterized in that, The step of coordinating the functional units in the network agent based on the response instruction set to obtain unit cooperation pairs includes: Parse the control instruction items contained in the response instruction set; Match the scheduling unit corresponding to the control instruction item; Verify the unit connection status between functional units in the unit to be scheduled; Based on the unit connection status, a collaborative relationship table corresponding to the functional units in the network agent is generated. Based on the aforementioned collaborative relationship table, the functional units in the network agent are collaboratively scheduled to obtain unit collaborative pairs.

5. The agent-based automated analysis and response method for network security as described in claim 4, characterized in that, The step of generating a collaborative relationship table corresponding to the functional units in the network agent based on the unit connection state includes: Based on the unit connection status, determine the unit connection channels between the functional units; Analyze the coordination requirements corresponding to the unit connection channels; Query collaborative interaction paths that meet the aforementioned collaborative requirements; Verify the collaborative transmission index corresponding to the collaborative interaction path; Based on the cooperative transmission index, a cooperative relationship table corresponding to the functional units in the network agent is generated.

6. The agent-based automated network security analysis and response method as described in claim 1, characterized in that, The calculation of the risk impact value corresponding to the attack event based on the security threat level includes: Analyze the impact values ​​of the elements covered by each level in the security threat level classification; Query the network smart terminals associated with the influence values ​​of the aforementioned elements; Identify the risk diffusion index corresponding to the attack event; Based on the risk diffusion index, identify the risk-affected terminals among the network smart terminals; The risk impact value corresponding to the risk-affected terminal is calculated using the following formula: in, This indicates the risk impact value corresponding to the terminal affected by the risk. Indicates the level of security threat. Indicates the duration of the phase. and These represent the start and end times of the attack phase, respectively. This indicates the total number of terminals affected by the risk. This indicates the quantity index corresponding to the terminal affected by the risk. Indicates time Time flow to the first One risk affects the terminal's data rate. Indicates the reference flow rate.

7. The agent-based automated network security analysis and response method as described in claim 1, characterized in that, The step of determining the communication association data corresponding to the functional unit based on the unit cooperation pair, and calculating the data interaction index corresponding to the communication association data, includes: Identify the communication connection protocol between the unit cooperative pairs; Based on the communication connection protocol, the communication events in the functional unit are determined; Collect the real-time communication stream from the communication events; Analyze the communication interaction volume in the real-time communication stream; Based on the communication interaction volume, determine the communication association data corresponding to the functional unit; The data interaction index corresponding to the communication-related data is calculated using the following formula: in, This represents the data interaction index corresponding to the communication-related data. This indicates the total number of the communication events. This indicates the quantity index corresponding to the communication event. Indicates the first The event risk weight corresponding to each communication event Indicates the first The amount of communication data corresponding to each communication event This indicates the acquisition time of the real-time communication stream. This indicates the number of network hops corresponding to the communication event.

8. The agent-based automated network security analysis and response method as described in claim 1, characterized in that, The step of identifying the attack phase corresponding to the attack event in the target area network based on the event sequence includes: Analyze the time windows corresponding to the events in the event sequence; Match the behavior sequence between the time window and historical attack behaviors; Based on the behavioral sequence, the current attack behavior in the target area network is determined; Based on the current attack behavior, the attack steps corresponding to the attack events in the target area network are divided; Identify the attack stage corresponding to the attack steps.

9. The agent-based automated analysis and response method for network security as described in claim 1, characterized in that, The determination of the security threat level corresponding to the attack event based on the multi-scenario log stream includes: Extract abnormal log features from the multi-scenario log stream; Based on the abnormal log characteristics, calculate the event threat value corresponding to the attack event; Based on the event threat value, assess the scope of impact corresponding to the target area network; Determine the threat level range corresponding to the affected area; Based on the threat level range, the security threat level corresponding to the attack event is determined.

10. The agent-based automated analysis and response method for network security as described in claim 1, characterized in that, The process of generating a complete attack chain corresponding to the attack event based on the data interaction index includes: Based on the data interaction index, filter out abnormal connection pairs in the communication-related data; Based on the abnormal connection pairs, reconstruct the event behavior sequence between the attack events; Identify behavioral logic gaps in the event behavior sequence; Based on the aforementioned behavioral logic gaps, formulate attack protection measures corresponding to the attack events; Based on the attack protection measures, a complete attack chain corresponding to the attack event is generated.

Images